aura/texture transport: Keep ref to texture infos to avoid races with the UI

content/common/gpu/texture_image_transport_surface.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_GPU_TEXTURE_IMAGE_TRANSPORT_SURFACE_H_
 #define CONTENT_COMMON_GPU_TEXTURE_IMAGE_TRANSPORT_SURFACE_H_
 #pragma once
 
 #include "base/basictypes.h"
-#include "base/memory/weak_ptr.h"
 #include "content/common/gpu/gpu_command_buffer_stub.h"
 #include "content/common/gpu/image_transport_surface.h"
 #include "gpu/command_buffer/service/texture_manager.h"
 #include "ui/gfx/gl/gl_surface.h"
 
 class GpuChannelManager;
 
 class TextureImageTransportSurface :
     public ImageTransportSurface,
     public GpuCommandBufferStub::DestructionObserver,
@@ skipping 28 matching lines @@
   virtual void OnPostSubBufferACK() OVERRIDE;
   virtual void OnResizeViewACK() OVERRIDE;
   virtual void OnResize(gfx::Size size) OVERRIDE;
 
   // GpuCommandBufferStub::DestructionObserver implementation.
   virtual void OnWillDestroyStub(GpuCommandBufferStub* stub) OVERRIDE;
 
  private:
   // A texture backing the front/back buffer in the parent stub.
   struct Texture {
-    Texture() : client_id(0), sent_to_client(false) {}
+    Texture();
+    ~Texture();
 
     // The client-side id in the parent stub.
     uint32 client_id;
 
     // The currently allocated size.
     gfx::Size size;
 
     // Whether or not that texture has been sent to the client yet.
     bool sent_to_client;
+
+    // The texture info in the parent stub.
+    scoped_refptr<gpu::gles2::TextureManager::TextureInfo> info;

[jonathan.backer, 2012/04/17 17:21:50]

TextureManager::Ref

[piman, 2012/04/17 17:37:24]

Done.

   };
 
   virtual ~TextureImageTransportSurface();
   void CreateBackTexture(const gfx::Size& size);
   void ReleaseBackTexture();
   void AttachBackTextureToFBO();
-  gpu::gles2::TextureManager::TextureInfo* GetParentInfo(uint32 client_id);
   int back() const { return 1 - front_; }
 
   // The framebuffer that represents this surface (service id). Allocated lazily
   // in OnMakeCurrent.
   uint32 fbo_id_;
 
   // The front and back buffers.
   Texture textures_[2];
 
   gfx::Rect previous_damage_rect_;
 
   // Indicates which of the 2 above is the front buffer.
   int front_;
 
   // Whether or not the command buffer stub has been destroyed.
   bool stub_destroyed_;
 
   scoped_ptr<ImageTransportHelper> helper_;
-  base::WeakPtr<GpuCommandBufferStub> parent_stub_;
+  GpuCommandBufferStub* parent_stub_;

[jonathan.backer, 2012/04/17 17:21:50]

Here's my understanding: we've got a race on teardown. With a weak_ptr,
parent_stub_ is only NULLed in the destructor. However, parent_stub_ is really
invalid during its Destroy. By becoming a DestructionObserver of parent_stub_,
we can invalidate at the appropriate time.

 
   DISALLOW_COPY_AND_ASSIGN(TextureImageTransportSurface);
 };
 
 #endif  // CONTENT_COMMON_GPU_TEXTURE_IMAGE_TRANSPORT_SURFACE_H_