Fix crash in Canvas2DLayerBridge

In a previous CL: https://chromium-review.googlesource.com/c/579690 where
we refactor the Canvas2DLayerBridge, we did not null check before passing
calling the ReleaseMailboxImageResource.

This CL does the null check.

Bug: 751445
Change-Id: I86f59e8176a44ef53d591a560a4c0c4b6cad2676
Reviewed-on: https://chromium-review.googlesource.com/597226
Commit-Queue: Xida Chen <xidachen@chromium.org>
Reviewed-by: Justin Novosad <junov@chromium.org>
Cr-Commit-Position: refs/heads/master@{#491551}

third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp

@@ -65,11 +65,18 @@ enum {
                                   // two animation frames behind.
 };
 
-static void ReleaseMailboxImageResource(gpu::gles2::GLES2Interface* gl,
-                                        const gpu::SyncToken& sync_token,
-                                        sk_sp<SkImage> skImage,
-                                        const gpu::Mailbox& mailbox,
-                                        bool lost_resource) {
+static void ReleaseMailboxImageResource(
+    WeakPtr<blink::WebGraphicsContext3DProviderWrapper>
+        context_provider_wrapper,
+    const gpu::SyncToken& sync_token,
+    sk_sp<SkImage> skImage,
+    const gpu::Mailbox& mailbox,
+    bool lost_resource) {
+  if (!context_provider_wrapper)
+    return;
+  gpu::gles2::GLES2Interface* gl =
+      context_provider_wrapper->ContextProvider()->ContextGL();
+
   if (sync_token.HasData() && gl)
     gl->WaitSyncTokenCHROMIUM(sync_token.GetConstData());
   GrTexture* texture = skImage->getTexture();
@@ -106,7 +113,7 @@ static void DeleteCHROMIUMImage(
     std::unique_ptr<gfx::GpuMemoryBuffer> gpu_memory_buffer,
     const GLuint& image_id,
     const GLuint& texture_id) {
-  if (!context_provider_wrapper->ContextProvider())
+  if (!context_provider_wrapper)
     return;
   gpu::gles2::GLES2Interface* gl =
       context_provider_wrapper->ContextProvider()->ContextGL();
@@ -1042,10 +1049,10 @@ void Canvas2DLayerBridge::ReleaseFrameResources(
     bool layer_bridge_with_valid_context =
         layer_bridge && !context_or_layer_bridge_lost;
     if (layer_bridge_with_valid_context || !layer_bridge) {
-      ReleaseMailboxImageResource(
-          context_provider_wrapper->ContextProvider()->ContextGL(), sync_token,
-          std::move(released_mailbox_info->image_),
-          released_mailbox_info->mailbox_, lost_resource);
+      ReleaseMailboxImageResource(context_provider_wrapper, sync_token,
+                                  std::move(released_mailbox_info->image_),
+                                  released_mailbox_info->mailbox_,
+                                  lost_resource);
     }
   }
 

third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridgeTest.cpp

@@ -277,6 +277,28 @@ class Canvas2DLayerBridgeTest : public Test {
         bridge->PrepareTextureMailbox(&texture_mailbox, &release_callback));
   }
 
+  void ReleaseCallbackWithNullContextProviderWrapperTest() {
+    viz::TextureMailbox texture_mailbox;
+    std::unique_ptr<viz::SingleReleaseCallback> release_callback;
+
+    {
+      Canvas2DLayerBridgePtr bridge(AdoptRef(new Canvas2DLayerBridge(
+          IntSize(300, 150), 0, kNonOpaque,
+          Canvas2DLayerBridge::kForceAccelerationForTesting,
+          CanvasColorParams())));
+      EXPECT_TRUE(
+          bridge->PrepareTextureMailbox(&texture_mailbox, &release_callback));
+    }
+
+    bool lost_resource = true;
+    gl_.SetIsContextLost(true);
+    // Get a new context provider so that the WeakPtr to the old one is null.
+    // This is the test to make sure that ReleaseMailboxImageResource() handles
+    // null context_provider_wrapper properly.
+    SharedGpuContext::ContextProviderWrapper();
+    release_callback->Run(gpu::SyncToken(), lost_resource);
+  }
+
   void PrepareMailboxAndLoseResourceTest() {
     // Prepare a mailbox, then report the resource as lost.
     // This test passes by not crashing and not triggering assertions.
@@ -367,6 +389,10 @@ TEST_F(Canvas2DLayerBridgeTest, PrepareMailboxAndLoseResource) {
   PrepareMailboxAndLoseResourceTest();
 }
 
+TEST_F(Canvas2DLayerBridgeTest, ReleaseCallbackWithNullContextProviderWrapper) {
+  ReleaseCallbackWithNullContextProviderWrapperTest();
+}
+
 TEST_F(Canvas2DLayerBridgeTest, AccelerationHint) {
   AccelerationHintTest();
 }