Merge 95506 - [chromium] ContentLayer's texture updater deleted during paint when compositing tur...

Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 410 matching lines @@
 
     // Due to borders, when the paint rect is extended to tile boundaries, it
     // may end up overlapping more tiles than the original content rect. Record
     // that original rect so we don't upload more tiles than necessary.
     m_updateRect = contentRect;
 
     m_paintRect = m_tiler->layerRectToContentRect(dirtyLayerRect);
     if (dirtyLayerRect.isEmpty())
         return;
 
+    // Calling prepareToUpdate() calls into WebKit to paint, which may have the side
+    // effect of disabling compositing, which causes our reference to the texture updater to be deleted.
+    // However, we can't free the memory backing the GraphicsContext until the paint finishes,
+    // so we grab a local reference here to hold the updater alive until the paint completes.
+    RefPtr<LayerTextureUpdater> protector(textureUpdater());
     textureUpdater()->prepareToUpdate(m_paintRect, m_tiler->tileSize(), m_tiler->hasBorderTexels());
 }
 
 }
 #endif // USE(ACCELERATED_COMPOSITING)