Fix tile discard, acquire, transfer, crash

Tile texture discard could leave the transfer queue with a mismatched base tile
and texture, so that the saved tile isn't the correct owner. Detect this case,
and mark the transfer obsolete.

bug:6157456

Change-Id: Ib02ecf877c4b99d07172541db8236e15c528af58

1 files changed, 3 insertions, 2 deletions

diff --git a/Source/WebCore/platform/graphics/android/TransferQueue.cpp b/Source/WebCore/platform/graphics/android/TransferQueue.cpp
index d5ffc1a..ac45112 100644
--- a/Source/WebCore/platform/graphics/android/TransferQueue.cpp
+++ b/Source/WebCore/platform/graphics/android/TransferQueue.cpp
@@ -135,8 +135,9 @@ bool TransferQueue::checkObsolete(const TileTransferData* data)
     }
 
     BaseTileTexture* baseTileTexture = baseTilePtr->backTexture();
-    if (!baseTileTexture) {
-        ALOGV("Invalid baseTileTexture , such that the tile is obsolete");
+    if (!baseTileTexture || baseTileTexture != data->savedBaseTileTexturePtr) {
+        ALOGV("Invalid baseTileTexture %p (vs expected %p), such that the tile is obsolete",
+              baseTileTexture, data->savedBaseTileTexturePtr);
         return true;
     }