Remove WebGLObject maps from WebGLRenderingContextBase and WebGLContextGroup.

third_party/WebKit/Source/modules/webgl/WebGLContextGroup.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "modules/webgl/WebGLContextGroup.h"
 
-#include "modules/webgl/WebGLSharedObject.h"
-
 namespace blink {
 
-PassRefPtr<WebGLContextGroup> WebGLContextGroup::create() {
-  RefPtr<WebGLContextGroup> contextGroup = adoptRef(new WebGLContextGroup());
-  return contextGroup.release();
-}
-
-WebGLContextGroup::WebGLContextGroup() {}
-
-WebGLContextGroup::~WebGLContextGroup() {
-  detachAndRemoveAllObjects();
-}
+WebGLContextGroup::WebGLContextGroup() : m_numberOfContextLosses(0) {}
 
 gpu::gles2::GLES2Interface* WebGLContextGroup::getAGLInterface() {
   ASSERT(!m_contexts.isEmpty());
+  // Weak processing removes dead entries from the HeapHashSet, so it's
+  // guaranteed that this will not return null for the reason that a
+  // WeakMember was nulled out.
   return (*m_contexts.begin())->contextGL();
 }
 
 void WebGLContextGroup::addContext(WebGLRenderingContextBase* context) {
   m_contexts.add(context);

[haraken, 2016/12/05 05:15:59]

You need to add a write barrier here.

[Ken Russell (switch to Gerrit), 2016/12/05 06:03:40]

What should it read?

ScriptWrappableVisitor::writeBarrier(this, context)?
ScriptWrappableVisitor::writeBarrier(this, m_contexts)?
ScriptWrappableVisitor::writeBarrier(m_contexts, context)?

From
https://chromium.googlesource.com/chromium/src/+/master/third_party/WebKit/So...
I don't understand what the rules are when using a collection class holding
Members (or WeakMembers, in this case).

[haraken, 2016/12/05 06:08:39]

ScriptWrappableVisitor::writeBarrier(this, context)

Write barrier should be added from an object that has traceWrappers() to an
object that has traceWrappers().

Micheal: Would you update the document?

[Ken Russell (switch to Gerrit), 2016/12/05 06:36:20]

Thanks, will add.

 }
 
-void WebGLContextGroup::removeContext(WebGLRenderingContextBase* context) {
-  // We must call detachAndRemoveAllObjects before removing the last context.
-  if (m_contexts.size() == 1 && m_contexts.contains(context))
-    detachAndRemoveAllObjects();
-
-  m_contexts.remove(context);
-}
-
-void WebGLContextGroup::removeObject(WebGLSharedObject* object) {
-  m_groupObjects.remove(object);
-}
-
-void WebGLContextGroup::addObject(WebGLSharedObject* object) {
-  m_groupObjects.add(object);
-}
-
-void WebGLContextGroup::detachAndRemoveAllObjects() {
-  while (!m_groupObjects.isEmpty()) {
-    (*m_groupObjects.begin())->detachContextGroup();
-  }
-}
-
 void WebGLContextGroup::loseContextGroup(
     WebGLRenderingContextBase::LostContextMode mode,
     WebGLRenderingContextBase::AutoRecoveryMethod autoRecoveryMethod) {
-  // Detach must happen before loseContextImpl, which destroys the
-  // GraphicsContext3D and prevents groupObjects from being properly deleted.
-  detachAndRemoveAllObjects();
-
+  ++m_numberOfContextLosses;

[haraken, 2016/12/05 05:15:59]

Shall we add CHECK(m_numberOfContextLosses > 0) to prevent some overflow attack?

[Ken Russell (switch to Gerrit), 2016/12/05 06:03:40]

I don't think it's necessary. In the very unlikely case of overflow, it doesn't
invalidate the algorithm.

   for (WebGLRenderingContextBase* const context : m_contexts)
     context->loseContextImpl(mode, autoRecoveryMethod);
 }
 
+uint32_t WebGLContextGroup::numberOfContextLosses() const {
+  return m_numberOfContextLosses;
+}
+
+DEFINE_TRACE_WRAPPERS(WebGLContextGroup) {
+  // TODO(kbr, mlippautz): need to use the manual write barrier since we
+  // need to use weak members to get the desired semantics in Oilpan, but
+  // no such TraceWrapperMember (like TraceWrapperWeakMember) exists yet.

[haraken, 2016/12/05 05:15:59]

You need to add the write barrier to line 41.

[Ken Russell (switch to Gerrit), 2016/12/05 06:03:40]

Please see question above.

+  for (auto context : m_contexts) {
+    visitor->traceWrappersWithManualWriteBarrier(context);
+  }
+}
+
 }  // namespace blink