Commit dfaf5f20 authored by Antoine Labour's avatar Antoine Labour Committed by Commit Bot

Fix crash in SharedImageFactory with duplicate mailboxes

Remove use-after-moved-from on the SharedImageBacking.

Bug: 891059
Change-Id: I663e019033145477fbe3719b7441da59e0fedd50
Reviewed-on: https://chromium-review.googlesource.com/c/1292550Reviewed-by: default avatarEric Karl <ericrk@chromium.org>
Commit-Queue: Antoine Labour <piman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#601348}
parent c13e5be6
...@@ -87,7 +87,6 @@ bool SharedImageFactory::CreateSharedImage(const Mailbox& mailbox, ...@@ -87,7 +87,6 @@ bool SharedImageFactory::CreateSharedImage(const Mailbox& mailbox,
if (!shared_image_manager_->Register(std::move(backing))) { if (!shared_image_manager_->Register(std::move(backing))) {
LOG(ERROR) << "CreateSharedImage: Could not register backing with " LOG(ERROR) << "CreateSharedImage: Could not register backing with "
"SharedImageManager."; "SharedImageManager.";
backing->Destroy();
return false; return false;
} }
......
...@@ -83,6 +83,15 @@ TEST_F(SharedImageFactoryTest, DuplicateMailbox) { ...@@ -83,6 +83,15 @@ TEST_F(SharedImageFactoryTest, DuplicateMailbox) {
factory_->CreateSharedImage(mailbox, format, size, color_space, usage)); factory_->CreateSharedImage(mailbox, format, size, color_space, usage));
EXPECT_FALSE( EXPECT_FALSE(
factory_->CreateSharedImage(mailbox, format, size, color_space, usage)); factory_->CreateSharedImage(mailbox, format, size, color_space, usage));
GpuPreferences preferences;
GpuDriverBugWorkarounds workarounds;
workarounds.max_texture_size = INT_MAX - 1;
auto other_factory = std::make_unique<SharedImageFactory>(
preferences, workarounds, GpuFeatureInfo(), nullptr, &mailbox_manager_,
&shared_image_manager_, &image_factory_, nullptr);
EXPECT_FALSE(other_factory->CreateSharedImage(mailbox, format, size,
color_space, usage));
} }
TEST_F(SharedImageFactoryTest, DestroyInexistentMailbox) { TEST_F(SharedImageFactoryTest, DestroyInexistentMailbox) {
......
...@@ -40,8 +40,10 @@ SharedImageManager::~SharedImageManager() { ...@@ -40,8 +40,10 @@ SharedImageManager::~SharedImageManager() {
bool SharedImageManager::Register(std::unique_ptr<SharedImageBacking> backing) { bool SharedImageManager::Register(std::unique_ptr<SharedImageBacking> backing) {
auto found = images_.find(backing->mailbox()); auto found = images_.find(backing->mailbox());
if (found != images_.end()) if (found != images_.end()) {
backing->Destroy();
return false; return false;
}
images_.emplace(std::move(backing), 1 /* ref_count */); images_.emplace(std::move(backing), 1 /* ref_count */);
return true; return true;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment