Fix crash in Canvas2DLayerBridge after a GPU resource is lost

Source/platform/graphics/Canvas2DLayerBridgeTest.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
@@ skipping 163 matching lines @@
         RefPtr<SkSurface> surface = adoptRef(SkSurface::NewRasterPMColor(300, 150));
         OwnPtr<SkDeferredCanvas> canvas = adoptPtr(SkDeferredCanvas::Create(surface.get()));
         OwnPtr<MockWebGraphicsContext3DProvider> mainMockProvider = adoptPtr(new MockWebGraphicsContext3DProvider(&mainMock));
         Canvas2DLayerBridgePtr bridge(adoptRef(new Canvas2DLayerBridge(mainMockProvider.release(), canvas.release(), surface, 0, NonOpaque)));
         bridge->m_lastImageId = 1;
 
         NullWebExternalBitmap bitmap;
         bridge->prepareMailbox(0, &bitmap);
         EXPECT_EQ(0u, bridge->m_lastImageId);
     }
+
+    void prepareMailboxAndLoseResourceTest()
+    {
+        MockCanvasContext mainMock;
+        RefPtr<SkSurface> surface = adoptRef(SkSurface::NewRasterPMColor(300, 150));
+        bool lostResource = true;
+
+        // Prepare a mailbox, then report the resource as lost.
+        // This test passes by not crashing and not triggering assertions.
+        {
+            WebExternalTextureMailbox mailbox;
+            OwnPtr<SkDeferredCanvas> canvas = adoptPtr(SkDeferredCanvas::Create(surface.get()));
+            OwnPtr<MockWebGraphicsContext3DProvider> mainMockProvider = adoptPtr(new MockWebGraphicsContext3DProvider(&mainMock));
+            Canvas2DLayerBridgePtr bridge(adoptRef(new Canvas2DLayerBridge(mainMockProvider.release(), canvas.release(), surface, 0, NonOpaque)));
+            bridge->prepareMailbox(&mailbox, 0);
+            bridge->mailboxReleased(mailbox, lostResource);
+        }
+
+        // Retry with mailbox released while bridge destruction is in progress
+        {
+            OwnPtr<SkDeferredCanvas> canvas = adoptPtr(SkDeferredCanvas::Create(surface.get()));
+            OwnPtr<MockWebGraphicsContext3DProvider> mainMockProvider = adoptPtr(new MockWebGraphicsContext3DProvider(&mainMock));
+            WebExternalTextureMailbox mailbox;
+            Canvas2DLayerBridge* rawBridge;
+            {
+                Canvas2DLayerBridgePtr bridge(adoptRef(new Canvas2DLayerBridge(mainMockProvider.release(), canvas.release(), surface, 0, NonOpaque)));
+                bridge->prepareMailbox(&mailbox, 0);
+                rawBridge = bridge.get();
+            } // bridge goes out of scope, but object is kept alive by self references
+            // before fixing crbug.com/411864, the following line you cause a memory use after free
+            // that sometimes causes a crash in normal builds and crashes consistently with ASAN.
+            rawBridge->mailboxReleased(mailbox, lostResource); // This should self-destruct the bridge.
+        }
+    }
 };
 
 namespace {
 
 TEST_F(Canvas2DLayerBridgeTest, testFullLifecycleSingleThreaded)
 {
     fullLifecycleTest();
 }
 
 TEST_F(Canvas2DLayerBridgeTest, testNoDrawOnContextLost)
 {
     noDrawOnContextLostTest();
 }
 
-TEST_F(Canvas2DLayerBridgeTest, prepareMailboxWithBitmapTest)
+TEST_F(Canvas2DLayerBridgeTest, testPrepareMailboxWithBitmap)
 {
     prepareMailboxWithBitmapTest();
 }
 
+TEST_F(Canvas2DLayerBridgeTest, testPrepareMailboxAndLoseResource)
+{
+    prepareMailboxAndLoseResourceTest();
+}
+
 } // namespace