Fix gpu command buffer use after free by GrContext
ContextProviderCommandBuffer owns a WebGraphicsContext3DCommandBufferImpl and a
GrContextForWebGraphicsContext3D via scoped_ptr. The problem was
that the GrContext object held by GrContextForWebGraphicsContext3D
depended on interface pointers that reference an interface that is owned
by WebGraphicsContext3DCommandBufferImpl, so whenever the
GrContext outlived the ContextProviderCommandBuffer, we ended up in a
state where the interface function pointers are deallocated, but still
referenced. Then, attempts to use the GrContext would result in using
deallocated function pointers. Because the GrContext is a ref counted
object, it can easily outlive the ContextProviderCommandBuffer. This led to
a dangerous situation where we had to be careful about object destruction
order.
This CL fixes the problem for good by wrapping the ownership of the
WebGraphicsContext3DCommandBufferImpl into a subclass of
GrGLInterface, which is a ref counted object that can be owned jointly by
the GrContext and the ContextProviderCommandBuffer, thus guaranteeing
that the command buffer interface will remain valid for the lifetimes of the
GrContext and of the ContextProviderCommandBuffer.
BUG=551143
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
Review URL: https://codereview.chromium.org/1414683003
Cr-Commit-Position: refs/heads/master@{#359493}
16 files changed
