Null out m_canvas if HTMLCanvasElement is destroyed

 Bug: 6209508

Change-Id: I99be936cde28047d516ecdfcc20cd099241569ca

3 files changed, 25 insertions, 16 deletions

diff --git a/Source/WebCore/platform/graphics/android/CanvasLayer.cpp b/Source/WebCore/platform/graphics/android/CanvasLayer.cpp
index 98cd5ee..7fdd0f4 100644
--- a/Source/WebCore/platform/graphics/android/CanvasLayer.cpp
+++ b/Source/WebCore/platform/graphics/android/CanvasLayer.cpp
@@ -59,6 +59,14 @@ CanvasLayer::CanvasLayer(const CanvasLayer& layer)
     , m_bitmap(0)
 {
     init();
+    if (!layer.m_canvas) {
+        // The canvas has already been destroyed - this shouldn't happen
+        ALOGW("Creating a CanvasLayer for a destroyed canvas!");
+        m_contentRect = IntRect();
+        m_offsetFromRenderer = IntSize();
+        m_texture->setHwAccelerated(false);
+        return;
+    }
     // We are making a copy for the UI, sync the interesting bits
     m_contentRect = layer.contentRect();
     m_offsetFromRenderer = layer.offsetFromRenderer();
@@ -118,6 +126,7 @@ void CanvasLayer::canvasResized(HTMLCanvasElement*)
 
 void CanvasLayer::canvasDestroyed(HTMLCanvasElement*)
 {
+    m_canvas = 0;
 }
 
 void CanvasLayer::clearDirtyRegion()
diff --git a/Source/WebCore/platform/graphics/android/CanvasTexture.cpp b/Source/WebCore/platform/graphics/android/CanvasTexture.cpp
index 90a4798..ca520fd 100644
--- a/Source/WebCore/platform/graphics/android/CanvasTexture.cpp
+++ b/Source/WebCore/platform/graphics/android/CanvasTexture.cpp
@@ -64,6 +64,18 @@ PassRefPtr<CanvasTexture> CanvasTexture::getCanvasTexture(CanvasLayer* layer)
     return adoptRef(new CanvasTexture(layer->uniqueId()));
 }
 
+bool CanvasTexture::setHwAccelerated(bool hwAccelerated)
+{
+    android::Mutex::Autolock lock(m_surfaceLock);
+    if (m_useHwAcceleration == hwAccelerated)
+        return false;
+    m_useHwAcceleration = hwAccelerated;
+    if (!m_ANW.get())
+        return false;
+    destroySurfaceTexture();
+    return true;
+}
+
 /********************************************
  * Called by WebKit thread
  ********************************************/
@@ -159,7 +171,7 @@ bool CanvasTexture::updateTexImage()
 }
 
 /********************************************
- * Called by UI thread (with or without GL context)
+ * Called by both threads
  ********************************************/
 
 void CanvasTexture::destroySurfaceTexture()
@@ -171,18 +183,6 @@ void CanvasTexture::destroySurfaceTexture()
     }
 }
 
-bool CanvasTexture::setHwAccelerated(bool hwAccelerated)
-{
-    android::Mutex::Autolock lock(m_surfaceLock);
-    if (m_useHwAcceleration == hwAccelerated)
-        return false;
-    m_useHwAcceleration = hwAccelerated;
-    if (!m_ANW.get())
-        return false;
-    destroySurfaceTexture();
-    return true;
-}
-
 /********************************************
  * Called by WebKit thread
  ********************************************/
diff --git a/Source/WebCore/platform/graphics/android/CanvasTexture.h b/Source/WebCore/platform/graphics/android/CanvasTexture.h
index 8850705..8875af7 100644
--- a/Source/WebCore/platform/graphics/android/CanvasTexture.h
+++ b/Source/WebCore/platform/graphics/android/CanvasTexture.h
@@ -47,6 +47,7 @@ public:
      * Called by both threads
      ********************************************/
     static PassRefPtr<CanvasTexture> getCanvasTexture(CanvasLayer* layer);
+    bool setHwAccelerated(bool hwAccelerated);
 
     /********************************************
      * Called by WebKit thread
@@ -64,13 +65,12 @@ public:
     GLuint texture() { requireTexture(); return m_texture; }
     bool updateTexImage();
 
+private:
     /********************************************
-     * Called by UI thread (with or without GL context)
+     * Called by both threads
      ********************************************/
     void destroySurfaceTexture();
-    bool setHwAccelerated(bool hwAccelerated);
 
-private:
     /********************************************
      * Called by WebKit thread
      ********************************************/