Fixing GraphicsContext state checks to support oilpan

Source/core/html/HTMLCanvasElement.cpp

Index: Source/core/html/HTMLCanvasElement.cpp
diff --git a/Source/core/html/HTMLCanvasElement.cpp b/Source/core/html/HTMLCanvasElement.cpp
index 737f7fb5fea854996ca309abbd6bfbdc52ab697f..ed3bc2c48ea8520ba9d9e16c10236bc755b74f4f 100644
--- a/Source/core/html/HTMLCanvasElement.cpp
+++ b/Source/core/html/HTMLCanvasElement.cpp
@@ -98,7 +98,9 @@ HTMLCanvasElement::~HTMLCanvasElement()
     HashSet<RawPtr<CanvasObserver> >::iterator end = m_observers.end();
     for (HashSet<RawPtr<CanvasObserver> >::iterator it = m_observers.begin(); it != end; ++it)
         (*it)->canvasDestroyed(this);
-    m_context.clear(); // Ensure this goes away before the ImageBuffer.
+    // Ensure these go away before the ImageBuffer.
+    m_contextStateSaver.clear();

[zerny-chromium, 2014/05/28 06:17:26]

This should be outside the #if !ENABLE(OILPAN) since it is an own ptr in both
builds.

A quick question regarding the comment above: what issue can arise if the
ImageBuffer is torn down before the CanvasRenderingContext?

In the oilpan build the HTMLCanvasElement (and via an OwnPtr ImageBuffer) can be
torn down in the same GC round as the CanvasRenderingContext which means their
finalization order is not known.

+    m_context.clear();
 #endif
 }
 
@@ -515,6 +517,9 @@ void HTMLCanvasElement::createImageBufferInternal()
     // See CanvasRenderingContext2D::State::State() for more information.
     m_imageBuffer->context()->setMiterLimit(10);
     m_imageBuffer->context()->setStrokeThickness(1);
+#if !ASSERT_DISABLED
+    m_imageBuffer->context()->disableDestructionChecks(); // 2D canvas is allowed to leave context in an unfinalized state.
+#endif
     m_contextStateSaver = adoptPtr(new GraphicsContextStateSaver(*m_imageBuffer->context()));
 
     if (m_context)