Prevent garbage collection from deleting a context during its eviction.

Source/core/html/canvas/WebGLRenderingContextBase.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 94 matching lines @@
 }
 
 void WebGLRenderingContextBase::forciblyLoseOldestContext(const String& reason)
 {
     size_t candidateID = oldestContextIndex();
     if (candidateID >= activeContexts().size())
         return;
 
     WebGLRenderingContextBase* candidate = activeContexts()[candidateID];
 
+    // This context could belong to a dead page and the last JavaScript reference has already
+    // been lost. Garbage collection might be triggered in the middle of this function, for
+    // example, printWarningToConsol() causes an upcall to JavaScript.

[Ken Russell (switch to Gerrit), 2014/06/30 18:28:57]

typo: printWarningToConsole

[Zhenyao Mo, 2014/07/02 22:45:23]

Done.

+    // Must make sure that the context is not deleted until the call stack unwinds.
+    RefPtr<WebGLRenderingContextBase> protect(candidate);
+
     activeContexts().remove(candidateID);
 
     candidate->printWarningToConsole(reason);
     InspectorInstrumentation::didFireWebGLWarning(candidate->canvas());
 
     // This will call deactivateContext once the context has actually been lost.
     candidate->forceLostContext(WebGLRenderingContextBase::SyntheticLostContext);
 }
 
 size_t WebGLRenderingContextBase::oldestContextIndex()
@@ skipping 4051 matching lines @@
     if (isContextLost()) {
         synthesizeGLError(GL_INVALID_OPERATION, "loseContext", "context already lost");
         return;
     }
 
     m_contextGroup->loseContextGroup(mode);
 }
 
 void WebGLRenderingContextBase::loseContextImpl(WebGLRenderingContextBase::LostContextMode mode)
 {
-#ifndef NDEBUG
-    printWarningToConsole("loseContextImpl(): begin");
-#endif
-
     if (isContextLost())
         return;
 
     m_contextLost = true;
     m_contextLostMode = mode;
 
     if (mode == RealLostContext) {
         // Inform the embedder that a lost context was received. In response, the embedder might
         // decide to take action such as asking the user for permission to use WebGL again.
         if (LocalFrame* frame = canvas()->document().frame())
             frame->loader().client()->didLoseWebGLContext(webContext()->getGraphicsResetStatusARB());
     }
 
     // Make absolutely sure we do not refer to an already-deleted texture or framebuffer.
     m_drawingBuffer->setTexture2DBinding(0);
     m_drawingBuffer->setFramebufferBinding(0);
 
     detachAndRemoveAllObjects();
 
-#ifndef NDEBUG
-    printWarningToConsole("loseContextImpl(): after detachAndRemoveAllObjects()");
-#endif
-
     // Lose all the extensions.
     for (size_t i = 0; i < m_extensions.size(); ++i) {
         ExtensionTracker* tracker = m_extensions[i];
         tracker->loseExtension();
     }
 
     for (size_t i = 0; i < WebGLExtensionNameCount; ++i)
         m_extensionEnabled[i] = false;
 
     removeAllCompressedTextureFormats();
 
     if (mode != RealLostContext)
         destroyContext();
 
-#ifndef NDEBUG
-    printWarningToConsole("loseContextImpl(): after destroyContext()");
-#endif
-
     ConsoleDisplayPreference display = (mode == RealLostContext) ? DisplayInConsole: DontDisplayInConsole;
     synthesizeGLError(GC3D_CONTEXT_LOST_WEBGL, "loseContext", "context lost", display);
 
     // Don't allow restoration unless the context lost event has both been
     // dispatched and its default behavior prevented.
     m_restoreAllowed = false;
 
     // Always defer the dispatch of the context lost event, to implement
     // the spec behavior of queueing a task.
     m_dispatchContextLostEventTimer.startOneShot(0, FROM_HERE);
-
-#ifndef NDEBUG
-    printWarningToConsole("loseContextImpl(): end");
-#endif
 }
 
 void WebGLRenderingContextBase::forceRestoreContext()
 {
     if (!isContextLost()) {
         synthesizeGLError(GL_INVALID_OPERATION, "restoreContext", "context not lost");
         return;
     }
 
     if (!m_restoreAllowed) {
@@ skipping 1199 matching lines @@
     RefPtrWillBeRawPtr<WebGLContextEvent> event = WebGLContextEvent::create(EventTypeNames::webglcontextlost, false, true, "");
     canvas()->dispatchEvent(event);
     m_restoreAllowed = event->defaultPrevented();
     deactivateContext(this, m_contextLostMode != RealLostContext && m_restoreAllowed);
     if ((m_contextLostMode == RealLostContext || m_contextLostMode == AutoRecoverSyntheticLostContext) && m_restoreAllowed)
         m_restoreTimer.startOneShot(0, FROM_HERE);
 }
 
 void WebGLRenderingContextBase::maybeRestoreContext(Timer<WebGLRenderingContextBase>*)
 {
-#ifndef NDEBUG
-    printWarningToConsole("maybeRestoreContext(): begin");
-#endif
     ASSERT(isContextLost());
 
     // The rendering context is not restored unless the default behavior of the
     // webglcontextlost event was prevented earlier.
     //
     // Because of the way m_restoreTimer is set up for real vs. synthetic lost
     // context events, we don't have to worry about this test short-circuiting
     // the retry loop for real context lost events.
     if (!m_restoreAllowed)
         return;
 
     LocalFrame* frame = canvas()->document().frame();
     if (!frame)
         return;
 
     Settings* settings = frame->settings();
 
     if (!frame->loader().client()->allowWebGL(settings && settings->webGLEnabled()))
         return;
 
     // If the context was lost due to RealLostContext, we need to destroy the old DrawingBuffer before creating new DrawingBuffer to ensure resource budget enough.
     if (m_drawingBuffer) {
         m_drawingBuffer->beginDestruction();
         m_drawingBuffer.clear();
     }
-#ifndef NDEBUG
-    printWarningToConsole("maybeRestoreContext(): destroyed old DrawingBuffer");
-#endif
 
     blink::WebGraphicsContext3D::Attributes attributes = m_requestedAttributes->attributes(canvas()->document().topDocument().url().string(), settings);
     OwnPtr<blink::WebGraphicsContext3D> context = adoptPtr(blink::Platform::current()->createOffscreenGraphicsContext3D(attributes, 0));
     RefPtr<DrawingBuffer> drawingBuffer;
     // Even if a non-null WebGraphicsContext3D is created, until it's made current, it isn't known whether the context is still lost.
     if (context) {
         // Construct a new drawing buffer with the new WebGraphicsContext3D.
         drawingBuffer = createDrawingBuffer(context.release());
         // If DrawingBuffer::create() fails to allocate a fbo, |drawingBuffer| is set to null.
     }
     if (!drawingBuffer) {
         if (m_contextLostMode == RealLostContext) {
             m_restoreTimer.startOneShot(secondsBetweenRestoreAttempts, FROM_HERE);
         } else {
             // This likely shouldn't happen but is the best way to report it to the WebGL app.
             synthesizeGLError(GL_INVALID_OPERATION, "", "error restoring context");
         }
         return;
     }
-#ifndef NDEBUG
-    printWarningToConsole("maybeRestoreContext(): created new DrawingBuffer");
-#endif
 
     m_drawingBuffer = drawingBuffer.release();
     m_drawingBuffer->bind();
     m_lostContextErrors.clear();
     m_contextLost = false;
 
     setupFlags();
     initializeNewContext();
     markContextChanged(CanvasContextChanged);
-#ifndef NDEBUG
-    printWarningToConsole("maybeRestoreContext(): before dispatchEvent");
-#endif
     canvas()->dispatchEvent(WebGLContextEvent::create(EventTypeNames::webglcontextrestored, false, true, ""));
-#ifndef NDEBUG
-    printWarningToConsole("maybeRestoreContext(): end");
-#endif
 }
 
 String WebGLRenderingContextBase::ensureNotNull(const String& text) const
 {
     if (text.isNull())
         return WTF::emptyString();
     return text;
 }
 
 WebGLRenderingContextBase::LRUImageBufferCache::LRUImageBufferCache(int capacity)
@@ skipping 176 matching lines @@
         if (m_textureUnits[i].m_texture2DBinding
             || m_textureUnits[i].m_textureCubeMapBinding) {
             m_onePlusMaxNonDefaultTextureUnit = i + 1;
             return;
         }
     }
     m_onePlusMaxNonDefaultTextureUnit = 0;
 }
 
 } // namespace WebCore