During image destroy, delete textures only if we have a GL context.

gpu/command_buffer/service/image_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/image_manager.h"
 
+#include "base/logging.h"
 #include "ui/gl/gl_image.h"
 
 namespace gpu {
 namespace gles2 {
 
 ImageManager::ImageManager() {
 }
 
 ImageManager::~ImageManager() {
 }
 
-void ImageManager::AddImage(gfx::GLImage* image, int32 service_id) {
+void ImageManager::Destroy(bool have_context) {
+  for (GLImageMap::const_iterator iter = images_.begin(); iter != images_.end();
+       ++iter)
+    iter->second.get()->Destroy(have_context);
+  images_.clear();
+}
+
+bool ImageManager::AddImage(gfx::GLImage* image, int32 service_id) {
+  GLImageMap::const_iterator iter = images_.find(service_id);
+  if (iter != images_.end()) {
+    LOG(ERROR) << "Image already exists with same ID.";
+    return false;
+  }
   images_[service_id] = image;
+  return true;
 }
 
 void ImageManager::RemoveImage(int32 service_id) {
-  images_.erase(service_id);
+  GLImageMap::iterator iter = images_.find(service_id);
+  LOG_IF(ERROR, iter == images_.end());

[reveman, 2014/07/30 14:11:12]

You need to return early if the service id doesn't exist. As of right now, a
compromised renderer can cause the GPU process to crash or worse by sending an
invalid ID with UnregisterGpuMemoryBuffer IPC.

+  iter->second.get()->Destroy(true);

[reveman, 2014/07/30 14:11:12]

This is where the GPU process would crash or behave in an unknown way if ID was
invalid.

+  images_.erase(iter);
 }
 
 gfx::GLImage* ImageManager::LookupImage(int32 service_id) {
   GLImageMap::const_iterator iter = images_.find(service_id);
   if (iter != images_.end())
     return iter->second.get();
 
   return NULL;
 }
 
 }  // namespace gles2
 }  // namespace gpu