exo::CompositorFrameSinkHolder's release callbacks hold ref

components/exo/compositor_frame_sink_holder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/exo/compositor_frame_sink_holder.h"
 
+#include "base/callback_helpers.h"
 #include "cc/resources/returned_resource.h"
 #include "components/exo/surface.h"
 
 namespace exo {
 
 ////////////////////////////////////////////////////////////////////////////////
 // CompositorFrameSinkHolder, public:
 
 CompositorFrameSinkHolder::CompositorFrameSinkHolder(
     Surface* surface,
     std::unique_ptr<CompositorFrameSink> frame_sink,
     cc::mojom::MojoCompositorFrameSinkClientRequest request)
     : surface_(surface),
       frame_sink_(std::move(frame_sink)),
       begin_frame_source_(base::MakeUnique<cc::ExternalBeginFrameSource>(this)),
       binding_(this, std::move(request)),
       weak_factory_(this) {
   surface_->AddSurfaceObserver(this);
 }
 
 bool CompositorFrameSinkHolder::HasReleaseCallbackForResource(
     cc::ResourceId id) {
   return release_callbacks_.find(id) != release_callbacks_.end();
 }
 
 void CompositorFrameSinkHolder::AddResourceReleaseCallback(
     cc::ResourceId id,
     std::unique_ptr<cc::SingleReleaseCallback> callback) {
-  release_callbacks_[id] = std::make_pair(this, std::move(callback));
+  release_callbacks_[id] = std::move(callback);
 }
 
 void CompositorFrameSinkHolder::ActivateFrameCallbacks(
     std::list<FrameCallback>* frame_callbacks) {
   active_frame_callbacks_.splice(active_frame_callbacks_.end(),
                                  *frame_callbacks);
   UpdateNeedsBeginFrame();
 }
 
 void CompositorFrameSinkHolder::CancelFrameCallbacks() {
@@ skipping 30 matching lines @@
     active_frame_callbacks_.pop_front();
   }
   begin_frame_source_->OnBeginFrame(args);
 }
 
 void CompositorFrameSinkHolder::ReclaimResources(
     const cc::ReturnedResourceArray& resources) {
   for (auto& resource : resources) {
     auto it = release_callbacks_.find(resource.id);
     DCHECK(it != release_callbacks_.end());
-    std::unique_ptr<cc::SingleReleaseCallback> callback =
-        std::move(it->second.second);
+    base::ScopedClosureRunner runner(base::Bind(

[reveman, 2016/12/22 17:00:53]

You're still not using PostTask here so this sink holder instance might be
destroyed before this function returns. That it might be destroyed in the middle
of a loop seems especially bad. Please use PostTask or at least move all
callbacks to a temporary variable and run them after the loop that access
release_callbacks_.

[Alex Z., 2016/12/22 18:08:48]

I thought you wanted the ScopedClosureRunner to protect the callback against the
message loop shutting down before the callback gets to run?

[reveman, 2016/12/22 20:29:49]

Yes, the only way that can happen is if you post a task to the message loop.
Without a PostTask you're still letting the callback run here and the sink
holder instance to be destroyed in the middle of this loop inside a member
function of the sink holder.

[Alex Z., 2016/12/23 22:45:38]

Done.

+        &cc::SingleReleaseCallback::Run, base::Passed(std::move(it->second)),
+        resource.sync_token, resource.lost));
     release_callbacks_.erase(it);
-    callback->Run(resource.sync_token, resource.lost);
   }
 }
 
 void CompositorFrameSinkHolder::WillDrawSurface() {
   if (surface_)
     surface_->WillDraw();
 
   UpdateNeedsBeginFrame();
 }
 
@@ skipping 33 matching lines @@
 
   bool needs_begin_frame = !active_frame_callbacks_.empty();
   if (needs_begin_frame == needs_begin_frame_)
     return;
 
   needs_begin_frame_ = needs_begin_frame;
   OnNeedsBeginFrames(needs_begin_frame_);
 }
 
 }  // namespace exo