Fix crash in BaseTileTexture

bug:5453156

simplified m_owner management - ONLY modified on UI thread

Previously deferring clear of m_owner, now set immediately since texture thread
doesn't use need stale owner info

Change-Id: I9b6f7bfd27af44a818d378ff750c0170d8122cfd

5 files changed, 16 insertions, 33 deletions

diff --git a/Source/WebCore/platform/graphics/android/BaseTile.cpp b/Source/WebCore/platform/graphics/android/BaseTile.cpp
index b38c590..350001a 100644
--- a/Source/WebCore/platform/graphics/android/BaseTile.cpp
+++ b/Source/WebCore/platform/graphics/android/BaseTile.cpp
@@ -535,6 +535,14 @@ void BaseTile::backTextureTransfer() {
     }
 }
 
+void BaseTile::backTextureTransferFail() {
+    // transfer failed for some reason, mark dirty so it will (repaint and) be
+    // retransferred.
+    android::AutoMutex lock(m_atomicSync);
+    m_state = Unpainted;
+    // whether validatePaint is called before or after, it won't do anything
+}
+
 void BaseTile::validatePaint() {
     // ONLY CALL while m_atomicSync is locked (at the end of paintBitmap())
 
diff --git a/Source/WebCore/platform/graphics/android/BaseTile.h b/Source/WebCore/platform/graphics/android/BaseTile.h
index 27fffc6..cabf5f1 100644
--- a/Source/WebCore/platform/graphics/android/BaseTile.h
+++ b/Source/WebCore/platform/graphics/android/BaseTile.h
@@ -129,6 +129,7 @@ public:
     void discardTextures();
     bool swapTexturesIfNeeded();
     void backTextureTransfer();
+    void backTextureTransferFail();
 
     void setGLWebViewState(GLWebViewState* state) { m_glWebViewState = state; }
 
diff --git a/Source/WebCore/platform/graphics/android/BaseTileTexture.cpp b/Source/WebCore/platform/graphics/android/BaseTileTexture.cpp
index cedad99..5b7acdb 100644
--- a/Source/WebCore/platform/graphics/android/BaseTileTexture.cpp
+++ b/Source/WebCore/platform/graphics/android/BaseTileTexture.cpp
@@ -56,8 +56,6 @@ BaseTileTexture::BaseTileTexture(uint32_t w, uint32_t h)
     : DoubleBufferedTexture(eglGetCurrentContext(),
                             TilesManager::instance()->getSharedTextureMode())
     , m_owner(0)
-    , m_delayedReleaseOwner(0)
-    , m_delayedRelease(false)
     , m_busy(false)
 {
     m_size.set(w, h);
@@ -137,13 +135,6 @@ void BaseTileTexture::setNotBusy()
 {
     android::Mutex::Autolock lock(m_busyLock);
     m_busy = false;
-    if (m_delayedRelease) {
-        if (m_owner == m_delayedReleaseOwner)
-            m_owner = 0;
-
-        m_delayedRelease = false;
-        m_delayedReleaseOwner = 0;
-    }
     m_busyCond.signal();
 }
 
@@ -170,13 +161,8 @@ void BaseTileTexture::producerUpdate(TextureInfo* textureInfo, const SkBitmap& b
 
 bool BaseTileTexture::acquire(TextureOwner* owner, bool force)
 {
-    if (m_owner == owner) {
-        if (m_delayedRelease) {
-            m_delayedRelease = false;
-            m_delayedReleaseOwner = 0;
-        }
+    if (m_owner == owner)
         return true;
-    }
 
     return setOwner(owner, force);
 }
@@ -219,17 +205,13 @@ bool BaseTileTexture::release(TextureOwner* owner)
     if (m_owner != owner)
         return false;
 
-    if (!m_busy) {
-        m_owner = 0;
-    } else {
-        m_delayedRelease = true;
-        m_delayedReleaseOwner = owner;
-    }
+    m_owner = 0;
     return true;
 }
 
 void BaseTileTexture::releaseAndRemoveFromTile()
 {
+    // NOTE: only call on UI thread, so m_owner won't be changing
     if (m_owner) {
         // clear both Tile->Texture and Texture->Tile links
         m_owner->removeTexture(this);
diff --git a/Source/WebCore/platform/graphics/android/BaseTileTexture.h b/Source/WebCore/platform/graphics/android/BaseTileTexture.h
index 6a9ce43..cd8e78b 100644
--- a/Source/WebCore/platform/graphics/android/BaseTileTexture.h
+++ b/Source/WebCore/platform/graphics/android/BaseTileTexture.h
@@ -91,7 +91,6 @@ public:
 
     // private member accessor functions
     TextureOwner* owner() { return m_owner; } // only used by the consumer thread
-    TextureOwner* delayedReleaseOwner() { return m_delayedReleaseOwner; }
 
     bool busy();
     void setNotBusy();
@@ -120,13 +119,9 @@ private:
 
     SkSize m_size;
     SkBitmap::Config m_config;
-    TextureOwner* m_owner;
 
-    // When trying to release a texture, we may delay this if the texture is
-    // currently used (busy being painted). We use the following two variables
-    // to do so in setNotBusy()
-    TextureOwner* m_delayedReleaseOwner;
-    bool m_delayedRelease;
+    // BaseTile owning the texture, only modified by UI thread
+    TextureOwner* m_owner;
 
     // This values signals that the texture is currently in use by the consumer.
     // This allows us to prevent the owner of the texture from changing while the
diff --git a/Source/WebCore/platform/graphics/android/TransferQueue.cpp b/Source/WebCore/platform/graphics/android/TransferQueue.cpp
index a9d6b9a..3fc1b93 100644
--- a/Source/WebCore/platform/graphics/android/TransferQueue.cpp
+++ b/Source/WebCore/platform/graphics/android/TransferQueue.cpp
@@ -361,11 +361,8 @@ void TransferQueue::updateQueueWithBitmap(const TileRenderInfo* renderInfo,
         // failed placing bitmap in queue, discard tile's texture so it will be
         // re-enqueued (and repainted)
         BaseTile* tile = renderInfo->baseTile;
-        if (tile) {
-            BaseTileTexture* texture = tile->backTexture();
-            if (texture)
-                texture->releaseAndRemoveFromTile();
-        }
+        if (tile)
+            tile->backTextureTransferFail();
     }
 }