WrappedSkImage: Workaround the use after releasing problem

Bug: 1029066
Change-Id: Ib9379b4b9db880a87b0b66ffa7e6473a3dc05a23
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1953575Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org>
Commit-Queue: Peng Huang <penghuang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#722475}

gpu/command_buffer/service/skia_utils.cc

@@ -132,6 +132,21 @@ void DeleteGrBackendTexture(SharedContextState* context_state,
 #endif
 }
 
+void DeleteSkImage(SharedContextState* context_state, sk_sp<SkImage> sk_image) {
+  DCHECK(sk_image && sk_image->unique());
+  if (!context_state->GrContextIsVulkan())
+    return;
+
+#if BUILDFLAG(ENABLE_VULKAN)
+  auto* fence_helper =
+      context_state->vk_context_provider()->GetDeviceQueue()->GetFenceHelper();
+  fence_helper->EnqueueCleanupTaskForSubmittedWork(base::BindOnce(
+      [](const sk_sp<GrContext>& gr_context, sk_sp<SkImage> sk_image,
+         gpu::VulkanDeviceQueue* device_queue, bool is_lost) {},
+      sk_ref_sp(context_state->gr_context()), std::move(sk_image)));
+#endif
+}
+
 #if BUILDFLAG(ENABLE_VULKAN)
 
 GrVkYcbcrConversionInfo CreateGrVkYcbcrConversionInfo(

gpu/command_buffer/service/skia_utils.h

@@ -67,6 +67,9 @@ GPU_GLES2_EXPORT void DeleteGrBackendTexture(
     SharedContextState* context_state,
     GrBackendTexture* backend_textures);
 
+GPU_GLES2_EXPORT void DeleteSkImage(SharedContextState* context_state,
+                                    sk_sp<SkImage> sk_image);
+
 #if BUILDFLAG(ENABLE_VULKAN)
 GPU_GLES2_EXPORT GrVkYcbcrConversionInfo CreateGrVkYcbcrConversionInfo(
     VkPhysicalDevice physical_device,

gpu/command_buffer/service/wrapped_sk_image.cc

@@ -54,7 +54,7 @@ class WrappedSkImage : public SharedImageBacking {
 
   void Destroy() override {
     promise_texture_.reset();
-    image_.reset();
+    gpu::DeleteSkImage(context_state_, std::move(image_));
   }
 
   bool IsCleared() const override { return cleared_; }
@@ -221,6 +221,7 @@ class WrappedSkImage : public SharedImageBacking {
   SharedContextState* const context_state_;
 
   sk_sp<SkPromiseImageTexture> promise_texture_;
+  // TODO(penghuang): manage texture directly with GrBackendTexture,
   sk_sp<SkImage> image_;
 
   bool cleared_ = false;