gpu: Reduce direct use of BrowserGpuMemoryBufferManager

content/browser/gpu/browser_gpu_memory_buffer_manager.cc

Index: content/browser/gpu/browser_gpu_memory_buffer_manager.cc
diff --git a/content/browser/gpu/browser_gpu_memory_buffer_manager.cc b/content/browser/gpu/browser_gpu_memory_buffer_manager.cc
index 93310633ae2c0fe5da07cbe272140910ac0178e1..404ea86476b3a4cb1b521efaaaef01ffc73e0507 100644
--- a/content/browser/gpu/browser_gpu_memory_buffer_manager.cc
+++ b/content/browser/gpu/browser_gpu_memory_buffer_manager.cc
@@ -12,6 +12,7 @@
 #include "base/strings/stringprintf.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/threading/thread_restrictions.h"
+#include "base/trace_event/memory_dump_manager.h"
 #include "base/trace_event/process_memory_dump.h"
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
@@ -71,6 +72,13 @@ BrowserGpuMemoryBufferManager::BrowserGpuMemoryBufferManager(
       gpu_client_tracing_id_(gpu_client_tracing_id) {
   DCHECK(!g_gpu_memory_buffer_manager);
   g_gpu_memory_buffer_manager = this;
+
+  // Enable the dump provider with IO thread affinity. Note that
+  // unregistration happens on the IO thread (See
+  // BrowserProcessSubThread::IOThreadPreCleanUp).

[jbauman, 2017/07/06 21:39:18]

This comment about unregistration is incorrect now. Also, shouldn't we still
unregister it? I can imagine us wanting to do a memory dump on shutdown in the
future.

[sadrul, 2017/07/06 23:38:18]

Hm, you are right. The MemoryDumpManager does not trigger the provider if the
provider is not running on the specified task-runner, and since the IO thread
has been torn down at this point, it would never run for
BrowserGpuMemoryBufferManager. However, if we attempt to do a memory dump during
tear-down, it will still try to poke the now-destroyed provider to look at its
task-runner, causing uaf.

I have restored the unregistration in BrowserProcessSubThread.

+  base::trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
+      this, "BrowserGpuMemoryBufferManager",
+      BrowserThread::GetTaskRunnerForThread(BrowserThread::IO));
 }
 
 BrowserGpuMemoryBufferManager::~BrowserGpuMemoryBufferManager() {