Fix crash in Canvas2DLayerBridge after a GPU resource is lost

Source/platform/graphics/Canvas2DLayerBridgeTest.cpp

Index: Source/platform/graphics/Canvas2DLayerBridgeTest.cpp
diff --git a/Source/platform/graphics/Canvas2DLayerBridgeTest.cpp b/Source/platform/graphics/Canvas2DLayerBridgeTest.cpp
index e710614cf71821816a8c14e833282c2b1c26dea6..17f1411fd2ee8d543aa453a8746ce8753ad38b8b 100644
--- a/Source/platform/graphics/Canvas2DLayerBridgeTest.cpp
+++ b/Source/platform/graphics/Canvas2DLayerBridgeTest.cpp
@@ -181,6 +181,40 @@ protected:
         bridge->prepareMailbox(0, &bitmap);
         EXPECT_EQ(0u, bridge->m_lastImageId);
     }
+
+    void prepareMailboxAndLoseResourceTest()
+    {
+        MockCanvasContext mainMock;
+        RefPtr<SkSurface> surface = adoptRef(SkSurface::NewRasterPMColor(300, 150));
+        bool lostResource = true;
+
+        // Prepare a mailbox, then report the resource as lost.
+        // This test passes by not crashing and not triggering assertions.
+        {
+            WebExternalTextureMailbox mailbox;
+            OwnPtr<SkDeferredCanvas> canvas = adoptPtr(SkDeferredCanvas::Create(surface.get()));
+            OwnPtr<MockWebGraphicsContext3DProvider> mainMockProvider = adoptPtr(new MockWebGraphicsContext3DProvider(&mainMock));
+            Canvas2DLayerBridgePtr bridge(adoptRef(new Canvas2DLayerBridge(mainMockProvider.release(), canvas.release(), surface, 0, NonOpaque)));
+            bridge->prepareMailbox(&mailbox, 0);
+            bridge->mailboxReleased(mailbox, lostResource);
+        }
+
+        // Retry with mailbox released while bridge destruction is in progress
+        {
+            OwnPtr<SkDeferredCanvas> canvas = adoptPtr(SkDeferredCanvas::Create(surface.get()));
+            OwnPtr<MockWebGraphicsContext3DProvider> mainMockProvider = adoptPtr(new MockWebGraphicsContext3DProvider(&mainMock));
+            WebExternalTextureMailbox mailbox;
+            Canvas2DLayerBridge* rawBridge;
+            {
+                Canvas2DLayerBridgePtr bridge(adoptRef(new Canvas2DLayerBridge(mainMockProvider.release(), canvas.release(), surface, 0, NonOpaque)));
+                bridge->prepareMailbox(&mailbox, 0);
+                rawBridge = bridge.get();
+            } // bridge goes out of scope, but object is kept alive by self references
+            // before fixing crbug.com/411864, the following line you cause a memory use after free
+            // that sometimes causes a crash in normal builds and crashes consistently with ASAN.
+            rawBridge->mailboxReleased(mailbox, lostResource); // This should self-destruct the bridge.
+        }
+    }
 };
 
 namespace {
@@ -195,9 +229,14 @@ TEST_F(Canvas2DLayerBridgeTest, testNoDrawOnContextLost)
     noDrawOnContextLostTest();
 }
 
-TEST_F(Canvas2DLayerBridgeTest, prepareMailboxWithBitmapTest)
+TEST_F(Canvas2DLayerBridgeTest, testPrepareMailboxWithBitmap)
 {
     prepareMailboxWithBitmapTest();
 }
 
+TEST_F(Canvas2DLayerBridgeTest, testPrepareMailboxAndLoseResource)
+{
+    prepareMailboxAndLoseResourceTest();
+}
+
 } // namespace