Commit 360dee28 authored by krasin's avatar krasin Committed by Commit bot

Fix use-after-free in TextureLayerImplTest.ResourceNotFreedOnGpuRasterToggle.

The callback uses a local variable 'released', but 'released' had
a more narrow scope than the owner of the callback (and it's called
from the destructor, when 'released' is already out of scope)

BUG=649897
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2596593003
Cr-Commit-Position: refs/heads/master@{#439888}
parent 89df64fb
...@@ -150,6 +150,7 @@ TEST(TextureLayerImplTest, OutputIsSecure) { ...@@ -150,6 +150,7 @@ TEST(TextureLayerImplTest, OutputIsSecure) {
TEST(TextureLayerImplTest, ResourceNotFreedOnGpuRasterToggle) { TEST(TextureLayerImplTest, ResourceNotFreedOnGpuRasterToggle) {
LayerTreeSettings settings; LayerTreeSettings settings;
settings.gpu_rasterization_enabled = true; settings.gpu_rasterization_enabled = true;
bool released = false;
LayerTestCommon::LayerImplTest impl(settings); LayerTestCommon::LayerImplTest impl(settings);
impl.host_impl()->AdvanceToNextFrame(base::TimeDelta::FromMilliseconds(1)); impl.host_impl()->AdvanceToNextFrame(base::TimeDelta::FromMilliseconds(1));
...@@ -171,7 +172,6 @@ TEST(TextureLayerImplTest, ResourceNotFreedOnGpuRasterToggle) { ...@@ -171,7 +172,6 @@ TEST(TextureLayerImplTest, ResourceNotFreedOnGpuRasterToggle) {
impl.AddChildToRoot<TextureLayerImpl>(); impl.AddChildToRoot<TextureLayerImpl>();
texture_layer_impl->SetBounds(layer_size); texture_layer_impl->SetBounds(layer_size);
texture_layer_impl->SetDrawsContent(true); texture_layer_impl->SetDrawsContent(true);
bool released = false;
texture_layer_impl->SetTextureMailbox( texture_layer_impl->SetTextureMailbox(
texture_mailbox, texture_mailbox,
SingleReleaseCallbackImpl::Create(base::Bind( SingleReleaseCallbackImpl::Create(base::Bind(
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment