Check StaticBitmapImage has changed from Mailbox to Skia in OffscreenCanvas commit

third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp

Index: third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
diff --git a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
index 3aaeca3982eafcac2635ed4910aa06a91b166d2e..e0bc9505f502004542ea95de7916a4aa5d61744a 100644
--- a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
+++ b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
@@ -404,7 +404,14 @@ void OffscreenCanvasFrameDispatcherImpl::ReclaimResources(
     const cc::ReturnedResourceArray& resources) {
   for (const auto& resource : resources) {
     RefPtr<StaticBitmapImage> image = m_cachedImages.at(resource.id);
-    if (image)
+    // Although image has MailboxTextureHolder at the time when it is
+    // inserted to m_cachedImages, the
+    // OffscreenCanvasPlaceHolder::placeholderFrame() exposes this image to
+    // everyone accessing the placeholder canvas as an image source, some of
+    // which may want to consume the image as a SkImage, thereby converting
+    // the MailTextureHolder to a SkiaTextureHolder. So we must double check
+    // image->hasMailBox() here.
+    if (image && image->hasMailbox())

[Justin Novosad, 2017/03/10 18:41:36]

I don't think this is the right thing to do.  I think SkiaTextureHolder needs to
store the syncToken, And do a WaitSyncToken in its destructor in order to
prevent the texture from being recycled by skia while it is still used by the
compositor.

       image->updateSyncToken(resource.sync_token);
     reclaimResource(resource.id);
   }