cc: Remove tilings from recycle tree when active tree removes them.

cc/layers/picture_layer_impl.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/layers/picture_layer_impl.h"
 
 #include <algorithm>
 #include <limits>
 
 #include "base/time/time.h"
@@ skipping 1183 matching lines @@
     }
 
     // Don't remove tilings that are being used (and thus would cause a flash.)
     if (std::find(used_tilings.begin(), used_tilings.end(), tiling) !=
         used_tilings.end())
       continue;
 
     to_remove.push_back(tiling);
   }
 
+  if (to_remove.empty())
+    return;
+
+  // Remove tilings on this tree and the twin tree.
   for (size_t i = 0; i < to_remove.size(); ++i) {
     const PictureLayerTiling* twin_tiling = GetTwinTiling(to_remove[i]);
     // Only remove tilings from the twin layer if they have
     // NON_IDEAL_RESOLUTION.
     if (twin_tiling && twin_tiling->resolution() == NON_IDEAL_RESOLUTION)
       twin->RemoveTiling(to_remove[i]->contents_scale());
     // TODO(enne): temporary sanity CHECK for http://crbug.com/358350
     CHECK_NE(HIGH_RESOLUTION, to_remove[i]->resolution());
     tilings_->Remove(to_remove[i]);
   }
+
   DCHECK_GT(tilings_->num_tilings(), 0u);
+  SanityCheckTilingState();
 
-  SanityCheckTilingState();
+  // Also remove tilings from the recycle tree to ensure that recycle tree
+  // doesn't have any unshared tiles.
+  PictureLayerImpl* recycled_twin = static_cast<PictureLayerImpl*>(
+      layer_tree_impl()->FindRecycleTreeLayerById(id()));
+  if (!recycled_twin)
+    return;
+
+  for (size_t i = 0; i < to_remove.size(); ++i)
+    recycled_twin->RemoveTiling(to_remove[i]->contents_scale());

[danakj, 2014/07/17 22:22:49]

er, wait, to_remove[i] is a use-after-free here, cuz we Remove()'d it above

[vmpstr, 2014/07/17 22:30:59]

Hmm.. that's not good. Good thing my testing worked just fine? I've changed it
around a bit. Good catch.

Should we also change for (i from 0 to to_remove.size()) to be more like

while (!to_remove.empty()) { tiling = to_remove.back() .. to_remove.pop_back() }

to avoid people like me messing this up in the future?

 }
 
 float PictureLayerImpl::MinimumContentsScale() const {
   float setting_min = layer_tree_impl()->settings().minimum_contents_scale;
 
   // If the contents scale is less than 1 / width (also for height),
   // then it will end up having less than one pixel of content in that
   // dimension.  Bump the minimum contents scale up in this case to prevent
   // this from happening.
   int min_dimension = std::min(bounds().width(), bounds().height());
@@ skipping 27 matching lines @@
 bool PictureLayerImpl::CanHaveTilingWithScale(float contents_scale) const {
   if (!CanHaveTilings())
     return false;
   if (contents_scale < MinimumContentsScale())
     return false;
   return true;
 }
 
 void PictureLayerImpl::SanityCheckTilingState() const {
 #if DCHECK_IS_ON
+  // Recycle tree doesn't have any restrictions.
+  if (layer_tree_impl()->IsRecycleTree())
+    return;
+
   if (!CanHaveTilings()) {
     DCHECK_EQ(0u, tilings_->num_tilings());
     return;
   }
   if (tilings_->num_tilings() == 0)
     return;
 
   // MarkVisibleResourcesAsRequired depends on having exactly 1 high res
   // tiling to mark its tiles as being required for activation.
   DCHECK_EQ(1, tilings_->NumHighResTilings());
@@ skipping 361 matching lines @@
   return iterator_index_ < iterators_.size();
 }
 
 bool PictureLayerImpl::LayerEvictionTileIterator::IsCorrectType(
     PictureLayerTiling::TilingEvictionTileIterator* it) const {
   return it->get_type() == iteration_stage_ &&
          (**it)->required_for_activation() == required_for_activation_;
 }
 
 }  // namespace cc