Fix crash in SharedImageFactory with duplicate mailboxes

Remove use-after-moved-from on the SharedImageBacking.

Bug: 891059
Change-Id: I663e019033145477fbe3719b7441da59e0fedd50
Reviewed-on: https://chromium-review.googlesource.com/c/1292550Reviewed-by: Eric Karl <ericrk@chromium.org>
Commit-Queue: Antoine Labour <piman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#601348}

gpu/command_buffer/service/shared_image_factory.cc

@@ -87,7 +87,6 @@ bool SharedImageFactory::CreateSharedImage(const Mailbox& mailbox,
   if (!shared_image_manager_->Register(std::move(backing))) {
     LOG(ERROR) << "CreateSharedImage: Could not register backing with "
                   "SharedImageManager.";
-    backing->Destroy();
     return false;
   }
 

gpu/command_buffer/service/shared_image_factory_unittest.cc

@@ -83,6 +83,15 @@ TEST_F(SharedImageFactoryTest, DuplicateMailbox) {
       factory_->CreateSharedImage(mailbox, format, size, color_space, usage));
   EXPECT_FALSE(
       factory_->CreateSharedImage(mailbox, format, size, color_space, usage));
+
+  GpuPreferences preferences;
+  GpuDriverBugWorkarounds workarounds;
+  workarounds.max_texture_size = INT_MAX - 1;
+  auto other_factory = std::make_unique<SharedImageFactory>(
+      preferences, workarounds, GpuFeatureInfo(), nullptr, &mailbox_manager_,
+      &shared_image_manager_, &image_factory_, nullptr);
+  EXPECT_FALSE(other_factory->CreateSharedImage(mailbox, format, size,
+                                                color_space, usage));
 }
 
 TEST_F(SharedImageFactoryTest, DestroyInexistentMailbox) {

gpu/command_buffer/service/shared_image_manager.cc

@@ -40,8 +40,10 @@ SharedImageManager::~SharedImageManager() {
 
 bool SharedImageManager::Register(std::unique_ptr<SharedImageBacking> backing) {
   auto found = images_.find(backing->mailbox());
-  if (found != images_.end())
+  if (found != images_.end()) {
+    backing->Destroy();
     return false;
+  }
 
   images_.emplace(std::move(backing), 1 /* ref_count */);
   return true;