Extend SharedImage life in MailboxVideoFrameConverter.

This CL fixes the MailboxVideoFrameConverter to let ScopedSharedImage be
owned by the unwrapped DMA-buf VideoFrame (a.k.a. origin_frame in the
code). Note that the mailbox VideoFrame sent to the client has a
reference to the wrapping VideoFrame. Therefore, the new ownership model
ensures that the SharedImage lives at least as long as the mailbox
VideoFrame, even if the MailboxVideoFrameConverter dies in the meantime
(this has been observed to happen when pausing a video then switching to
another tab to play another video and then switching back to the
original tab - see referenced bug for more details).

Note that ScopedSharedImage is changed to be mutable. That's because we
need to handle a case in which the visible rectangle of a VideoFrame
changes and the SharedImage needs to be regenerated.

Bug: 1044890
Test: forced the use of VD in krane and went through scenario in bug.
Change-Id: I4ff20b0b5088a7a202efc98747fdb5e7a9e9d5f4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2119153
Commit-Queue: Andres Calderon Jaramillo <andrescj@chromium.org>
Reviewed-by: Chih-Yu Huang <akahuang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#754785}

media/gpu/chromeos/mailbox_video_frame_converter.h

@@ -92,23 +92,30 @@ class MEDIA_GPU_EXPORT MailboxVideoFrameConverter : public VideoFrameConverter {
   // WrapMailboxAndVideoFrameAndOutput().
   void ConvertFrameOnGPUThread(VideoFrame* origin_frame,
                                scoped_refptr<VideoFrame> frame,
-                               gpu::Mailbox mailbox);
+                               ScopedSharedImage* stored_shared_image);
 
-  // Generates a ScopedSharedImage from a DMA-buf backed |video_frame|, and
-  // returns it or nullptr if that could not be done. |video_frame| must be kept
-  // alive for the duration of this method. This method runs on
-  // |gpu_task_runner_|.
-  std::unique_ptr<ScopedSharedImage> GenerateSharedImageOnGPUThread(
-      VideoFrame* video_frame,
-      const gfx::Rect& destination_visible_rect);
+  // Populates a ScopedSharedImage from a DMA-buf backed |video_frame|.
+  // |video_frame| must be kept alive for the duration of this method. This
+  // method runs on |gpu_task_runner_|. Returns true if the SharedImage could be
+  // created successfully; false otherwise (and OnError() is called).
+  bool GenerateSharedImageOnGPUThread(VideoFrame* video_frame,
+                                      const gfx::Rect& destination_visible_rect,
+                                      ScopedSharedImage* shared_image);
 
   // Registers the mapping between a DMA-buf VideoFrame and the SharedImage.
-  // |origin_frame| must be kept alive for the duration of this method.
+  // |origin_frame| must be kept alive for the duration of this method. After
+  // this method returns, |scoped_shared_image| will be owned by |origin_frame|.
+  // This guarantees that the SharedImage lives as long as the associated
+  // DMA-buf even if MailboxVideoFrameConverter dies.
   void RegisterSharedImage(
       VideoFrame* origin_frame,
       std::unique_ptr<ScopedSharedImage> scoped_shared_image);
   // Unregisters the |origin_frame_id| and associated SharedImage.
-  void UnregisterSharedImage(UniqueID origin_frame_id);
+  // |scoped_shared_image| is passed to guarantee that the SharedImage is alive
+  // until after we delete the pointer from |shared_images_|.
+  void UnregisterSharedImage(
+      UniqueID origin_frame_id,
+      std::unique_ptr<ScopedSharedImage> scoped_shared_image);
 
   // Updates the SharedImage associated to |mailbox|. Returns true if the update
   // could be carried out, false otherwise.
@@ -141,9 +148,11 @@ class MEDIA_GPU_EXPORT MailboxVideoFrameConverter : public VideoFrameConverter {
   base::WeakPtr<gpu::GpuChannel> gpu_channel_;
 
   // Mapping from the unique id of the frame to its corresponding SharedImage.
-  // Accessed only on |parent_task_runner_|.
-  base::small_map<std::map<UniqueID, std::unique_ptr<ScopedSharedImage>>>
-      shared_images_;
+  // Accessed only on |parent_task_runner_|. The ScopedSharedImages are owned by
+  // the unwrapped DMA-buf VideoFrames so that they can be used even after
+  // MailboxVideoFrameConverter dies (e.g., there may still be compositing
+  // commands that need the shared images).
+  base::small_map<std::map<UniqueID, ScopedSharedImage*>> shared_images_;
 
   // The queue of input frames and the unique_id of their origin frame.
   // Accessed only on |parent_task_runner_|.