Avoid unsafe use of SkRefCnt::getRefCnt() in ImagesManager

The function isn't threadsafe, so races would occur and certain textures
wouldn't be removed from ImagesManager's master list. The list would then be
iterated over, all items dereferenced, and bad times would ensue.

The SkRefCnt class uses atomic inc/dec to decide when to destroy an object, but
reading such an integer non-atomically isn't safe. Instead use the real signal
we're looking for - when the ImageTexture is deleted - to know when to remove
the ImageTexture from ImagesManager's list.

Mutual exclusion from editing the list is now maintained by only unref-ing the
ImageTexture within releaseImage, which holds the ImagesManager's m_imagesLock
(which we already do anyway).

bug:6859278
Change-Id: I75ebf79f2617484e7df355d6539226ce64882369

1 files changed, 1 insertions, 0 deletions

diff --git a/Source/WebCore/platform/graphics/android/rendering/ImageTexture.cpp b/Source/WebCore/platform/graphics/android/rendering/ImageTexture.cpp
index aa84427..db03753 100644
--- a/Source/WebCore/platform/graphics/android/rendering/ImageTexture.cpp
+++ b/Source/WebCore/platform/graphics/android/rendering/ImageTexture.cpp
@@ -101,6 +101,7 @@ ImageTexture::~ImageTexture()
     delete m_image;
     delete m_tileGrid;
     SkSafeUnref(m_picture);
+    ImagesManager::instance()->onImageTextureDestroy(m_crc);
 }
 
 SkBitmap* ImageTexture::convertBitmap(SkBitmap* bitmap)