Commit 60e34838 authored by kylechar's avatar kylechar Committed by Commit Bot

Speculative fix for RemoveRenderPassResource() crash

SkiaOutputSurfaceImplOnGpu::RemoveRenderPassResource() assumes that
every RenderPassId exists in the |offscreen_surfaces_| map. If drawing
the RenderPass fails before SOSIOG::FinishPaintRenderPass() adds a map
entry, then the iterator in SOSIOG::RemoveRenderPassResource() will
point to offscreen_surfaces_.end(). Calling flat_map::erase() with the
end iterator is an error.

SkiaOutputSurfaceImpl::SubmitPaint() assumes that
SOSIOnGpu::FinishPaintRenderPass() will be successful. However if the
context is lost in FinishPaintRenderPass() it will return early and not
added a map entry. Both SkiaRenderer and SkiaOutputSurfaceImpl will
think there are RenderPass resources to delete leading to a potential
crash.

This is a speculative fix as I'm unable to reproduce it locally.

Bug: 1015613
Change-Id: Icd8f6922926892ccecb973041f5a626e75f78771
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1914298Reviewed-by: default avatarJonathan Backer <backer@chromium.org>
Commit-Queue: kylechar <kylechar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#715057}
parent 753fc264
......@@ -964,9 +964,9 @@ void SkiaOutputSurfaceImplOnGpu::RemoveRenderPassResource(
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
DCHECK(!image_contexts.empty());
for (auto& image_context : image_contexts) {
auto it = offscreen_surfaces_.find(image_context->render_pass_id());
DCHECK(it != offscreen_surfaces_.end());
offscreen_surfaces_.erase(it);
// It's possible that |offscreen_surfaces_| won't contain an entry for the
// render pass if draw failed early.
offscreen_surfaces_.erase(image_context->render_pass_id());
}
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment