Fix race condition with windowless plugin buffers. The problem, which is already fixed for Mac, is …

content/plugin/webplugin_proxy.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PLUGIN_WEBPLUGIN_PROXY_H_
 #define CONTENT_PLUGIN_WEBPLUGIN_PROXY_H_
 
 #include <string>
 
 #include "base/hash_tables.h"
 #include "base/memory/ref_counted.h"
 #if defined(OS_MACOSX)
 #include "base/mac/scoped_cftyperef.h"
 #endif
 #include "base/memory/scoped_handle.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/shared_memory.h"
 #include "base/timer.h"
 #include "googleurl/src/gurl.h"
 #include "ipc/ipc_message.h"
+#include "third_party/skia/include/core/SkRefCnt.h"
 #if defined(USE_X11)
 #include "ui/base/x/x11_util.h"
 #endif
 #include "ui/gl/gpu_preference.h"
 #include "ui/surface/transport_dib.h"
 #include "webkit/plugins/npapi/webplugin.h"
 
 class PluginChannel;
 
 namespace skia {
@@ skipping 160 matching lines @@
 
 #if defined(OS_WIN) && !defined(USE_AURA)
   // Retrieves the IME status from a windowless plug-in and sends it to a
   // renderer process. A renderer process will convert the coordinates from
   // local to the window coordinates and send the converted coordinates to a
   // browser process.
   void UpdateIMEStatus();
 #endif
 
  private:
+  class SharedTransportDIB : public base::RefCounted<SharedTransportDIB> {
+   public:
+    explicit SharedTransportDIB(TransportDIB* dib);
+    TransportDIB* dib() { return dib_.get(); }
+   private:
+    friend class base::RefCounted<SharedTransportDIB>;
+    ~SharedTransportDIB();
+
+    scoped_ptr<TransportDIB> dib_;
+  };
+
   bool Send(IPC::Message* msg);
 
   // Handler for sending over the paint event to the plugin.
   void OnPaint(const gfx::Rect& damaged_rect);
 
 #if defined(OS_WIN)
   void CreateCanvasFromHandle(const TransportDIB::Handle& dib_handle,
                               const gfx::Rect& window_rect,
-                              scoped_ptr<skia::PlatformCanvas>* canvas_out);
+                              SkAutoTUnref<skia::PlatformCanvas>* canvas);
 #elif defined(OS_MACOSX)
   static void CreateDIBAndCGContextFromHandle(
       const TransportDIB::Handle& dib_handle,
       const gfx::Rect& window_rect,
       scoped_ptr<TransportDIB>* dib_out,
       base::mac::ScopedCFTypeRef<CGContextRef>* cg_context_out);
 #elif defined(USE_X11)
   static void CreateDIBAndCanvasFromHandle(
       const TransportDIB::Handle& dib_handle,
       const gfx::Rect& window_rect,
-      scoped_ptr<TransportDIB>* dib_out,
-      scoped_ptr<skia::PlatformCanvas>* canvas_out);
+      scoped_refptr<SharedTransportDIB>* dib_out,
+      SkAutoTUnref<skia::PlatformCanvas>* canvas);
 
   static void CreateShmPixmapFromDIB(
       TransportDIB* dib,
       const gfx::Rect& window_rect,
       XID* pixmap_out);
 #endif
 
   // Updates the shared memory sections where windowless plugins paint.
   void SetWindowlessBuffers(const TransportDIB::Handle& windowless_buffer0,
                             const TransportDIB::Handle& windowless_buffer1,
@@ skipping 39 matching lines @@
   // back-buffer at any given time.
   bool transparent_;
   int windowless_buffer_index_;
 #if defined(OS_MACOSX)
   scoped_ptr<TransportDIB> windowless_dibs_[2];
   scoped_ptr<TransportDIB> background_dib_;
   base::mac::ScopedCFTypeRef<CGContextRef> windowless_contexts_[2];
   base::mac::ScopedCFTypeRef<CGContextRef> background_context_;
   scoped_ptr<WebPluginAcceleratedSurfaceProxy> accelerated_surface_;
 #else
-  scoped_ptr<skia::PlatformCanvas> windowless_canvases_[2];
-  scoped_ptr<skia::PlatformCanvas> background_canvas_;
+  SkAutoTUnref<skia::PlatformCanvas> windowless_canvases_[2];
+  SkAutoTUnref<skia::PlatformCanvas> background_canvas_;
 
 #if defined(USE_X11)
-  scoped_ptr<TransportDIB> windowless_dibs_[2];
-  scoped_ptr<TransportDIB> background_dib_;
+  scoped_refptr<SharedTransportDIB> windowless_dibs_[2];
+  scoped_refptr<SharedTransportDIB> background_dib_;
   // If we can use SHM pixmaps for windowless plugin painting or not.
   bool use_shm_pixmap_;
   // The SHM pixmaps for windowless plugin painting.
   XID windowless_shm_pixmaps_[2];
 #endif
 
 #endif
 
   // Contains the routing id of the host render view.
   int host_render_view_routing_id_;
 
   base::WeakPtrFactory<WebPluginProxy> weak_factory_;
 };
 
 #endif  // CONTENT_PLUGIN_WEBPLUGIN_PROXY_H_