cc: Fix UAF in g_raster_required_for_activation_delay

cc/resources/raster_worker_pool.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/resources/raster_worker_pool.h"
 
 #include <algorithm>
 
 #include "base/debug/trace_event_synthetic_delay.h"
 #include "base/lazy_instance.h"
 #include "base/strings/stringprintf.h"
 #include "base/threading/simple_thread.h"
 #include "cc/base/scoped_ptr_deque.h"
 
 namespace cc {
 namespace {
 
-// Synthetic delay for raster tasks that are required for activation. Global to
-// avoid static initializer on critical path.
-struct RasterRequiredForActivationSyntheticDelayInitializer {
-  RasterRequiredForActivationSyntheticDelayInitializer()
-      : delay(base::debug::TraceEventSyntheticDelay::Lookup(
-            "cc.RasterRequiredForActivation")) {}
-  base::debug::TraceEventSyntheticDelay* delay;
-};
-static base::LazyInstance<RasterRequiredForActivationSyntheticDelayInitializer>
-    g_raster_required_for_activation_delay = LAZY_INSTANCE_INITIALIZER;
-
 class RasterTaskGraphRunner : public TaskGraphRunner,
                               public base::DelegateSimpleThread::Delegate {
  public:
-  RasterTaskGraphRunner() {
+  RasterTaskGraphRunner()
+      : synthetic_delay_(base::debug::TraceEventSyntheticDelay::Lookup(
+            "cc.RasterRequiredForActivation")) {
     size_t num_threads = RasterWorkerPool::GetNumRasterThreads();
     while (workers_.size() < num_threads) {
       scoped_ptr<base::DelegateSimpleThread> worker =
           make_scoped_ptr(new base::DelegateSimpleThread(
               this,
               base::StringPrintf("CompositorRasterWorker%u",
                                  static_cast<unsigned>(workers_.size() + 1))
                   .c_str()));
       worker->Start();
 #if defined(OS_ANDROID) || defined(OS_LINUX)
       worker->SetThreadPriority(base::kThreadPriority_Background);
 #endif
       workers_.push_back(worker.Pass());
     }
   }
 
   virtual ~RasterTaskGraphRunner() { NOTREACHED(); }
 
+  base::debug::TraceEventSyntheticDelay* synthetic_delay() {

[boliu, 2014/08/27 01:14:49]

Removed const here. Learned today that returning a non-const member from a const
method is against the style guide.

Source: https://codereview.chromium.org/502453003#msg12

+    return synthetic_delay_;
+  }
+
  private:
   // Overridden from base::DelegateSimpleThread::Delegate:
   virtual void Run() OVERRIDE {
     TaskGraphRunner::Run();
   }
 
   ScopedPtrDeque<base::DelegateSimpleThread> workers_;
+  base::debug::TraceEventSyntheticDelay* synthetic_delay_;
 };
 
 base::LazyInstance<RasterTaskGraphRunner>::Leaky g_task_graph_runner =
     LAZY_INSTANCE_INITIALIZER;
 
 const int kDefaultNumRasterThreads = 1;
 
 int g_num_raster_threads = 0;
 
 class RasterFinishedTaskImpl : public RasterizerTask {
@@ skipping 33 matching lines @@
     : public RasterFinishedTaskImpl {
  public:
   RasterRequiredForActivationFinishedTaskImpl(
       base::SequencedTaskRunner* task_runner,
       const base::Closure& on_raster_finished_callback,
       size_t tasks_required_for_activation_count)
       : RasterFinishedTaskImpl(task_runner, on_raster_finished_callback),
         tasks_required_for_activation_count_(
             tasks_required_for_activation_count) {
     if (tasks_required_for_activation_count_) {
-      g_raster_required_for_activation_delay.Get().delay->BeginParallel(
+      g_task_graph_runner.Get().synthetic_delay()->BeginParallel(
           &activation_delay_end_time_);
     }
   }
 
   // Overridden from Task:
   virtual void RunOnWorkerThread() OVERRIDE {
     TRACE_EVENT0(
         "cc", "RasterRequiredForActivationFinishedTaskImpl::RunOnWorkerThread");
 
     if (tasks_required_for_activation_count_) {
-      g_raster_required_for_activation_delay.Get().delay->EndParallel(
+      g_task_graph_runner.Get().synthetic_delay()->EndParallel(
           activation_delay_end_time_);
     }
     RasterFinished();
   }
 
  private:
   virtual ~RasterRequiredForActivationFinishedTaskImpl() {}
 
   base::TimeTicks activation_delay_end_time_;
   const size_t tasks_required_for_activation_count_;
@@ skipping 120 matching lines @@
     if (decode_it == graph->nodes.end())
       InsertNodeForTask(graph, decode_task, priority, 0u);
 
     graph->edges.push_back(TaskGraph::Edge(decode_task, raster_task));
   }
 
   InsertNodeForTask(graph, raster_task, priority, dependencies);
 }
 
 }  // namespace cc