Fix case where the Texture class held a reference to a deleted Tile.

bug: 3217947
Change-Id: If75673ece459d6539f1fd990d538347e13d60d68

diff --git a/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.cpp b/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.cpp
index 1a8e686..02168a9 100644 (file)
--- a/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.cpp
+++ b/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.cpp
@@ -112,4 +112,10 @@ bool BackedDoubleBufferedTexture::acquire(BaseTile* owner)
     return false;
 }
 
+void BackedDoubleBufferedTexture::release(BaseTile* owner)
+{
+    if (m_owner == owner)
+        m_owner = 0;
+}
+
 } // namespace WebCore

diff --git a/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.h b/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.h
index 6bbb97a..b07cdd1 100644 (file)
--- a/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.h
+++ b/WebCore/platform/graphics/android/BackedDoubleBufferedTexture.h
@@ -66,6 +66,7 @@ public:
     // allows consumer thread to assign ownership of the texture to the tile. It
     // returns false if ownership cannot be transferred because the tile is busy
     bool acquire(BaseTile* owner);
+    void release(BaseTile* owner);
 
     // private member accessor functions
     BaseTile* owner() { return m_owner; } // only used by the consumer thread

diff --git a/WebCore/platform/graphics/android/BaseTile.cpp b/WebCore/platform/graphics/android/BaseTile.cpp
index 6fd9e89..4bee626 100644 (file)
--- a/WebCore/platform/graphics/android/BaseTile.cpp
+++ b/WebCore/platform/graphics/android/BaseTile.cpp
@@ -84,6 +84,9 @@ BaseTile::BaseTile()
 BaseTile::~BaseTile()
 {
     setUsedLevel(-1);
+    if(m_texture)
+        m_texture->release(this);
+
 #ifdef DEBUG_COUNT
     gBaseTileCount--;
 #endif

diff --git a/WebCore/platform/graphics/android/GLWebViewState.cpp b/WebCore/platform/graphics/android/GLWebViewState.cpp
index 58c7ab5..d0d054f 100644 (file)
--- a/WebCore/platform/graphics/android/GLWebViewState.cpp
+++ b/WebCore/platform/graphics/android/GLWebViewState.cpp
@@ -75,11 +75,12 @@ GLWebViewState::GLWebViewState()
     , m_extra(0)
     , m_navLayer(0)
 {
-    m_tiledPageA = new TiledPage(FIRST_TILED_PAGE_ID, this);
-    m_tiledPageB = new TiledPage(SECOND_TILED_PAGE_ID, this);
     m_viewport.setEmpty();
     m_viewportTileBounds.setEmpty();
     m_preZoomBounds.setEmpty();
+
+    m_tiledPageA = new TiledPage(FIRST_TILED_PAGE_ID, this);
+    m_tiledPageB = new TiledPage(SECOND_TILED_PAGE_ID, this);
 #ifdef DEBUG_COUNT
     gGLWebViewStateCount++;
 #endif