aw: Check compositor pointer before use

android_webview/browser/browser_view_renderer.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "android_webview/browser/browser_view_renderer.h"
 
 #include "android_webview/browser/browser_view_renderer_client.h"
 #include "android_webview/browser/shared_renderer_state.h"
 #include "android_webview/common/aw_switches.h"
 #include "android_webview/public/browser/draw_gl.h"
@@ skipping 127 matching lines @@
 // This function updates the resource allocation in GlobalTileManager.
 void BrowserViewRenderer::TrimMemory(const int level, const bool visible) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   // Constants from Android ComponentCallbacks2.
   enum {
     TRIM_MEMORY_RUNNING_LOW = 10,
     TRIM_MEMORY_UI_HIDDEN = 20,
     TRIM_MEMORY_BACKGROUND = 40,
   };
 
+  if (!compositor_ || !hardware_enabled_)
+    return;
+
   // Not urgent enough. TRIM_MEMORY_UI_HIDDEN is treated specially because
   // it does not indicate memory pressure, but merely that the app is
   // backgrounded.
   if (level < TRIM_MEMORY_RUNNING_LOW || level == TRIM_MEMORY_UI_HIDDEN)
     return;
 
   // Do not release resources on view we expect to get DrawGL soon.
   if (level < TRIM_MEMORY_BACKGROUND && visible)
     return;
 
@@ skipping 27 matching lines @@
   // is also kTileAllocationStep.
   tiles = (tiles / kTileAllocationStep + 1) * kTileAllocationStep;
   policy.num_resources_limit = tiles;
   return policy;
 }
 
 // This function updates the cached memory policy in shared renderer state, as
 // well as the tile resource allocation in GlobalTileManager.
 void BrowserViewRenderer::RequestMemoryPolicy(
     SynchronousCompositorMemoryPolicy& new_policy) {
+  DCHECK(compositor_);
   GlobalTileManager* manager = GlobalTileManager::GetInstance();
 
   // The following line will call BrowserViewRenderer::SetMemoryPolicy().
   manager->RequestTiles(new_policy, tile_manager_key_);
 }
 
 void BrowserViewRenderer::SetMemoryPolicy(
     SynchronousCompositorMemoryPolicy new_policy,
     bool effective_immediately) {
   memory_policy_ = new_policy;
@@ skipping 105 matching lines @@
   if (shared_renderer_state_->NeedsForceInvalidateOnNextDrawGL() ||
       !parent_draw_constraints_.Equals(
         shared_renderer_state_->ParentDrawConstraints())) {
     shared_renderer_state_->SetForceInvalidateOnNextDrawGL(false);
     EnsureContinuousInvalidation(true, false);
   }
 }
 
 void BrowserViewRenderer::ReturnUnusedResource(
     scoped_ptr<cc::CompositorFrame> frame) {
+  DCHECK(compositor_);
   if (!frame.get())
     return;
 
   cc::CompositorFrameAck frame_ack;
   cc::TransferableResource::ReturnResources(
       frame->delegated_frame_data->resource_list, &frame_ack.resources);
   if (!frame_ack.resources.empty())
     compositor_->ReturnResources(frame_ack);
 }
 
 void BrowserViewRenderer::ReturnResourceFromParent() {
+  DCHECK(compositor_);
   cc::CompositorFrameAck frame_ack;
   shared_renderer_state_->SwapReturnedResources(&frame_ack.resources);
   if (!frame_ack.resources.empty()) {
     compositor_->ReturnResources(frame_ack);
   }
 }
 
 bool BrowserViewRenderer::OnDrawSoftware(jobject java_canvas) {
   if (!compositor_) {
     TRACE_EVENT_INSTANT0(
@@ skipping 108 matching lines @@
   height_ = height;
 }
 
 void BrowserViewRenderer::OnDetachedFromWindow() {
   TRACE_EVENT0("android_webview", "BrowserViewRenderer::OnDetachedFromWindow");
   attached_to_window_ = false;
   DCHECK(!hardware_enabled_);
 }
 
 void BrowserViewRenderer::ReleaseHardware() {
+  DCHECK(compositor_);
   DCHECK(hardware_enabled_);
   ReturnUnusedResource(shared_renderer_state_->PassCompositorFrame());
   ReturnResourceFromParent();
   DCHECK(shared_renderer_state_->ReturnedResourcesEmpty());
 
   compositor_->ReleaseHwDraw();
   hardware_enabled_ = false;
 
   SynchronousCompositorMemoryPolicy zero_policy;
   RequestMemoryPolicy(zero_policy);
@@ skipping 15 matching lines @@
                "BrowserViewRenderer::DidInitializeCompositor");
   DCHECK(compositor);
   DCHECK(!compositor_);
   compositor_ = compositor;
 }
 
 void BrowserViewRenderer::DidDestroyCompositor(
     content::SynchronousCompositor* compositor) {
   TRACE_EVENT0("android_webview", "BrowserViewRenderer::DidDestroyCompositor");
   DCHECK(compositor_);
+  SynchronousCompositorMemoryPolicy zero_policy;
+  RequestMemoryPolicy(zero_policy);
   compositor_ = NULL;
-  SynchronousCompositorMemoryPolicy zero_policy;
-  DCHECK(memory_policy_ == zero_policy);
+  hardware_enabled_ = false;

[boliu, 2014/10/17 22:59:26]

oh god that's so freaking wrong

[hush (inactive), 2014/10/17 23:04:15]

what do you mean? I thought what you did is replacing this line with
"CHECK(!hardware_enabled)" and hit the crash

[boliu, 2014/10/17 23:06:01]

CHECK was to see it actually happens, not the fix.

But this is totally the wrong fix too. I am ashamed..

 }
 
 void BrowserViewRenderer::SetContinuousInvalidate(bool invalidate) {
   if (compositor_needs_continuous_invalidate_ == invalidate)
     return;
 
   TRACE_EVENT_INSTANT1("android_webview",
                        "BrowserViewRenderer::SetContinuousInvalidate",
                        TRACE_EVENT_SCOPE_THREAD,
                        "invalidate",
@@ skipping 307 matching lines @@
     base::StringAppendF(&str,
                         "surface width height: [%d %d] ",
                         draw_info->width,
                         draw_info->height);
     base::StringAppendF(&str, "is_layer: %d ", draw_info->is_layer);
   }
   return str;
 }
 
 }  // namespace android_webview