Avoid returning a shallow copy of gfx::Image from gfx::ImageFamily::CreateExact

ui/gfx/image/image_family.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/gfx/image/image_family.h"
 
 #include <cmath>
 
 #include "skia/ext/image_operations.h"
 #include "ui/gfx/geometry/size.h"
@@ skipping 99 matching lines @@
 
 gfx::Image ImageFamily::CreateExact(int width, int height) const {
   // Resize crashes if width or height is 0, so just return an empty image.
   if (width == 0 || height == 0)
     return gfx::Image();
 
   const gfx::Image* image = GetBest(width, height);
   if (!image)
     return gfx::Image();
 
-  if (image->Width() == width && image->Height() == height)
-    return gfx::Image(*image);
+  if (image->Width() == width && image->Height() == height) {
+    // Make a copy at gfx::ImageSkia level, so that resulting image's ref count
+    // is not racy to |image|. Since this function can run on a different thread
+    // than the thread |image| created on, we should not touch the
+    // non-thread-safe ref count in gfx::Image here.
+    std::unique_ptr<gfx::ImageSkia> image_skia(image->CopyImageSkia());
+    return gfx::Image(*image_skia);
+  }
 
   SkBitmap bitmap = image->AsBitmap();
   SkBitmap resized_bitmap = skia::ImageOperations::Resize(
       bitmap, skia::ImageOperations::RESIZE_LANCZOS3, width, height);
   return gfx::Image::CreateFrom1xBitmap(resized_bitmap);
 }
 
 gfx::Image ImageFamily::CreateExact(const gfx::Size& size) const {
   return CreateExact(size.width(), size.height());
 }
@@ skipping 12 matching lines @@
   DCHECK(greater_or_equal != map_.begin());
   std::map<MapKey, gfx::Image>::const_iterator less_than = greater_or_equal;
   --less_than;
   // This must be true because there must be at least one image with |aspect|.
   DCHECK_EQ(less_than->first.aspect(), aspect);
   // We have found the largest image smaller than desired.
   return &less_than->second;
 }
 
 }  // namespace gfx