During image destroy, delete textures only if we have a GL context.

gpu/command_buffer/service/image_manager.cc

Index: gpu/command_buffer/service/image_manager.cc
diff --git a/gpu/command_buffer/service/image_manager.cc b/gpu/command_buffer/service/image_manager.cc
index 953e3bcb5731b3b98bfaeef8d6b7bae11c96d376..7c958498b3887d22c11a10665a4db57fa46e514a 100644
--- a/gpu/command_buffer/service/image_manager.cc
+++ b/gpu/command_buffer/service/image_manager.cc
@@ -4,6 +4,7 @@
 
 #include "gpu/command_buffer/service/image_manager.h"
 
+#include "base/logging.h"
 #include "ui/gl/gl_image.h"
 
 namespace gpu {
@@ -15,12 +16,28 @@ ImageManager::ImageManager() {
 ImageManager::~ImageManager() {
 }
 
-void ImageManager::AddImage(gfx::GLImage* image, int32 service_id) {
+void ImageManager::Destroy(bool have_context) {
+  for (GLImageMap::const_iterator iter = images_.begin(); iter != images_.end();
+       ++iter)
+    iter->second.get()->Destroy(have_context);
+  images_.clear();
+}
+
+bool ImageManager::AddImage(gfx::GLImage* image, int32 service_id) {
+  GLImageMap::const_iterator iter = images_.find(service_id);
+  if (iter != images_.end()) {
+    LOG(ERROR) << "Image already exists with same ID.";
+    return false;
+  }
   images_[service_id] = image;
+  return true;
 }
 
 void ImageManager::RemoveImage(int32 service_id) {
-  images_.erase(service_id);
+  GLImageMap::iterator iter = images_.find(service_id);
+  LOG_IF(ERROR, iter == images_.end());

[reveman, 2014/07/30 14:11:12]

You need to return early if the service id doesn't exist. As of right now, a
compromised renderer can cause the GPU process to crash or worse by sending an
invalid ID with UnregisterGpuMemoryBuffer IPC.

+  iter->second.get()->Destroy(true);

[reveman, 2014/07/30 14:11:12]

This is where the GPU process would crash or behave in an unknown way if ID was
invalid.

+  images_.erase(iter);
 }
 
 gfx::GLImage* ImageManager::LookupImage(int32 service_id) {