canvas2d: Don't access Thread in CanvasResource dtor.

There is no ordering guarentee in the destruction order for objects in
thread local storage. Since Thread and SharedGpuContext are both in
thread local storage and destruction of CanvasResource can be triggered
by SharedGpuContext being destroyed, we shouldn't access Thread in the
CanvasResource dtor since it may have already been destroyed.

R=fserb@chromium.org

Change-Id: Id7efe3eb51fa242382f7446b731f0531c6bd9816
Bug: 1002792
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1799223
Auto-Submit: Khushal <khushalsagar@chromium.org>
Commit-Queue: Fernando Serboncini <fserb@chromium.org>
Reviewed-by: Fernando Serboncini <fserb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#696023}

third_party/blink/renderer/platform/graphics/canvas_resource.cc

@@ -46,11 +46,10 @@ gpu::mojom::blink::MailboxPtr SharedBitmapIdToGpuMailboxPtr(
 CanvasResource::CanvasResource(base::WeakPtr<CanvasResourceProvider> provider,
                                SkFilterQuality filter_quality,
                                const CanvasColorParams& color_params)
-    : provider_(std::move(provider)),
+    : owning_thread_id_(base::PlatformThread::CurrentId()),
+      provider_(std::move(provider)),
       filter_quality_(filter_quality),
-      color_params_(color_params) {
-  thread_of_origin_ = Thread::Current()->ThreadId();
-}
+      color_params_(color_params) {}
 
 CanvasResource::~CanvasResource() {
 #if DCHECK_IS_ON()
@@ -59,7 +58,7 @@ CanvasResource::~CanvasResource() {
 }
 
 void CanvasResource::OnDestroy() {
-  if (thread_of_origin_ != Thread::Current()->ThreadId()) {
+  if (owning_thread_id_ != base::PlatformThread::CurrentId()) {
     // Destroyed on wrong thread. This can happen when the thread of origin was
     // torn down, in which case the GPU context owning any underlying resources
     // no longer exists.
@@ -710,7 +709,6 @@ CanvasResourceSharedImage::CanvasResourceSharedImage(
                     context_provider_wrapper_->ContextProvider()
                         ->GetCapabilities())
               : GL_TEXTURE_2D),
-      owning_thread_id_(base::PlatformThread::CurrentId()),
       owning_thread_task_runner_(Thread::Current()->GetTaskRunner()) {
   if (!context_provider_wrapper_)
     return;
@@ -1301,8 +1299,7 @@ CanvasResourceSwapChain::CanvasResourceSwapChain(
     SkFilterQuality filter_quality)
     : CanvasResource(std::move(provider), filter_quality, color_params),
       context_provider_wrapper_(std::move(context_provider_wrapper)),
-      size_(size),
-      owning_thread_id_(base::PlatformThread::CurrentId()) {
+      size_(size) {
   if (!context_provider_wrapper_)
     return;
 

third_party/blink/renderer/platform/graphics/canvas_resource.h

@@ -144,13 +144,14 @@ class PLATFORM_EXPORT CanvasResource
   CanvasResourceProvider* Provider() { return provider_.get(); }
   base::WeakPtr<CanvasResourceProvider> WeakProvider() { return provider_; }
 
+  const base::PlatformThreadId owning_thread_id_;
+
  private:
   // Sync token that was provided when resource was released
   gpu::SyncToken sync_token_for_release_;
   base::WeakPtr<CanvasResourceProvider> provider_;
   SkFilterQuality filter_quality_;
   CanvasColorParams color_params_;
-  blink::PlatformThreadId thread_of_origin_;
 #if DCHECK_IS_ON()
   bool did_call_on_destroy_ = false;
 #endif
@@ -474,7 +475,6 @@ class PLATFORM_EXPORT CanvasResourceSharedImage final : public CanvasResource {
   const bool is_origin_top_left_;
   const bool is_accelerated_;
   const GLenum texture_target_;
-  const base::PlatformThreadId owning_thread_id_;
   const scoped_refptr<base::SingleThreadTaskRunner> owning_thread_task_runner_;
 
   OwningThreadData owning_thread_data_;
@@ -599,7 +599,6 @@ class PLATFORM_EXPORT CanvasResourceSwapChain final : public CanvasResource {
   const base::WeakPtr<WebGraphicsContext3DProviderWrapper>
       context_provider_wrapper_;
   const IntSize size_;
-  const base::PlatformThreadId owning_thread_id_;
   gpu::Mailbox front_buffer_mailbox_;
   gpu::Mailbox back_buffer_mailbox_;
   GLuint front_buffer_texture_id_ = 0u;