diff options
author | Chris Craik <ccraik@google.com> | 2011-10-17 12:18:09 -0700 |
---|---|---|
committer | Chris Craik <ccraik@google.com> | 2011-10-17 15:42:46 -0700 |
commit | 3a819aac70dd26f675644f6a35b13be5fb3de2f1 (patch) | |
tree | 18407791463ebfbf10614304ec129bf20d3a11f7 /Source/WebCore/platform/graphics/android/TransferQueue.cpp | |
parent | 5dbcb79ed2d4e7a3b7ebdf43b7e0048205d5da1a (diff) | |
download | external_webkit-3a819aac70dd26f675644f6a35b13be5fb3de2f1.zip external_webkit-3a819aac70dd26f675644f6a35b13be5fb3de2f1.tar.gz external_webkit-3a819aac70dd26f675644f6a35b13be5fb3de2f1.tar.bz2 |
Prevent race condition in tile texture discard
bug:5461107
Tiles were being destroyed, and subsequently dereferenced in TransferQueue
Change-Id: I4fea289e5fda03a69f07554f57120c4c5bf7b016
Diffstat (limited to 'Source/WebCore/platform/graphics/android/TransferQueue.cpp')
-rw-r--r-- | Source/WebCore/platform/graphics/android/TransferQueue.cpp | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/Source/WebCore/platform/graphics/android/TransferQueue.cpp b/Source/WebCore/platform/graphics/android/TransferQueue.cpp index 3fc1b93..4e29870 100644 --- a/Source/WebCore/platform/graphics/android/TransferQueue.cpp +++ b/Source/WebCore/platform/graphics/android/TransferQueue.cpp @@ -440,6 +440,7 @@ void TransferQueue::addItemInTransferQueue(const TileRenderInfo* renderInfo, XLOG("ERROR update a tile which is dirty already @ index %d", index); } + m_transferQueue[index].savedBaseTileTexturePtr = renderInfo->baseTile->backTexture(); m_transferQueue[index].savedBaseTilePtr = renderInfo->baseTile; m_transferQueue[index].status = pendingBlit; m_transferQueue[index].uploadType = type; @@ -493,14 +494,16 @@ void TransferQueue::cleanupTransportQueue() // since tiles in the queue may be from another webview, remove // their textures so that they will be repainted / retransferred BaseTile* tile = m_transferQueue[index].savedBaseTilePtr; - if (tile) { - BaseTileTexture* texture = tile->backTexture(); - if (texture) - texture->releaseAndRemoveFromTile(); + BaseTileTexture* texture = m_transferQueue[index].savedBaseTileTexturePtr; + if (tile && texture && texture->owner() == tile) { + // since tile destruction removes textures on the UI thread, the + // texture->owner ptr guarantees the tile is valid + tile->discardBackTexture(); + XLOG("transfer queue discarded tile %p, removed texture", tile); } - XLOG("transfer queue discarded tile %p, removed texture", tile); m_transferQueue[index].savedBaseTilePtr = 0; + m_transferQueue[index].savedBaseTileTexturePtr = 0; m_transferQueue[index].status = emptyItem; } index = (index + 1) % ST_BUFFER_NUMBER; |