Fix a browser ANR

Layer release textures (setting their owner to zero). Texture with no
owners are routinely destroyed by the TilesManager.
When a texture is busy, the release is delayed until the end of the
painting; if the owner of the texture is still the same, we then
remove it.

The problem was that a layer could release a busy texture, thereby
delaying the release; and in a next cycle re-acquire that same texture.
The delayed release would then kicks in, and proceed, as the owner
was still the same one as the one that originally asked for the release.

We would then have a situation where the layer thought it acquired a
texture, while that texture's owner was ultimately set to zero.
The TilesManager would then proceed to destroy that texture.
The next time the layer tried to use the texture, it would either crash
or more often block on acquiring a lock on it, causing an ANR.

bug:3472320
Change-Id: I84a064b1aa6636a18e0518e34c8572cbea3eb558

1 files changed, 6 insertions, 1 deletions

diff --git a/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.cpp b/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.cpp
index f68050f..63c9806 100644
--- a/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.cpp
+++ b/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.cpp
@@ -191,8 +191,13 @@ void BackedDoubleBufferedTexture::producerUpdate(TextureInfo* textureInfo)
 
 bool BackedDoubleBufferedTexture::acquire(TextureOwner* owner)
 {
-    if (m_owner == owner)
+    if (m_owner == owner) {
+        if (m_delayedRelease) {
+            m_delayedRelease = false;
+            m_delayedReleaseOwner = 0;
+        }
         return true;
+    }
 
     return setOwner(owner);
 }