From 92c3acf6b42939215be09fe379bfef07ab703216 Mon Sep 17 00:00:00 2001
From: Derek Sollenberger <djsollen@google.com>
Date: Fri, 25 Mar 2011 10:43:12 -0400
Subject: [PATCH] Fix error where mediaLayer is derefed on UI thread prior to
 being derefed in Webkit.

bug: 4171470
Change-Id: I6afe957b2eccae249afa46baede822c34f8f1a7f
---
 WebCore/platform/graphics/android/DoubleBufferedTexture.cpp | 12 ++++++++++++
 WebCore/platform/graphics/android/DoubleBufferedTexture.h   |  1 +
 WebCore/platform/graphics/android/MediaTexture.cpp          | 12 +++++++-----
 WebCore/platform/graphics/android/SharedTexture.cpp         | 13 +++++++++----
 WebCore/platform/graphics/android/SharedTexture.h           |  1 +
 5 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/WebCore/platform/graphics/android/DoubleBufferedTexture.cpp b/WebCore/platform/graphics/android/DoubleBufferedTexture.cpp
index cf640e846..395bb2b67 100644
--- a/WebCore/platform/graphics/android/DoubleBufferedTexture.cpp
+++ b/WebCore/platform/graphics/android/DoubleBufferedTexture.cpp
@@ -114,6 +114,18 @@ void DoubleBufferedTexture::producerDeleteTextures()
     m_textureB.unlock();
 }
 
+void DoubleBufferedTexture::consumerDeleteTextures()
+{
+    m_textureA.lock();
+    m_textureB.lock();
+    LOGV("Deleting Consumer Textures A/B (%d:%d)", m_textureA.getTargetTextureId(),
+                                                   m_textureB.getTargetTextureId());
+    m_textureA.deleteTargetTexture();
+    m_textureB.deleteTargetTexture();
+    m_textureA.unlock();
+    m_textureB.unlock();
+}
+
 TextureInfo* DoubleBufferedTexture::producerLock()
 {
     SharedTexture* sharedTex = getWriteableTexture();
diff --git a/WebCore/platform/graphics/android/DoubleBufferedTexture.h b/WebCore/platform/graphics/android/DoubleBufferedTexture.h
index 8a9d81e0c..ba56c0eb9 100644
--- a/WebCore/platform/graphics/android/DoubleBufferedTexture.h
+++ b/WebCore/platform/graphics/android/DoubleBufferedTexture.h
@@ -47,6 +47,7 @@ public:
     // consumer thread functions
     TextureInfo* consumerLock();
     void consumerRelease();
+    void consumerDeleteTextures();
 
 protected:
     SharedTexture* getReadableTexture();
diff --git a/WebCore/platform/graphics/android/MediaTexture.cpp b/WebCore/platform/graphics/android/MediaTexture.cpp
index 982106587..14f0c20ba 100644
--- a/WebCore/platform/graphics/android/MediaTexture.cpp
+++ b/WebCore/platform/graphics/android/MediaTexture.cpp
@@ -104,8 +104,9 @@ void MediaTexture::consumerInc()
 /* Decrement the number of objects in the consumer's thread that are holding a
  * reference to this object. When removing the last reference we must delete
  * this object and by extension cleanup all GL objects that are associated with
- * the consumer's thread. At the time of deletion there should be no remaining
- * producer references.
+ * the consumer's thread. At the time of deletion if there is a remaining
+ * producer reference we must cleanup the consumer GL objects in the event that
+ * this texture will not be re-synced with the UI thread.
  */
 void MediaTexture::consumerDec()
 {
@@ -114,9 +115,10 @@ void MediaTexture::consumerDec()
     m_mediaLock.lock();
     m_consumerRefCount--;
     if (m_consumerRefCount == 0) {
-        needsDeleted = true;
-        if (m_producerRefCount != 0) {
-            XLOG("ERROR: We should not delete the consumer before the producer is finished");
+        consumerDeleteTextures();
+        if (m_producerRefCount < 1) {
+            XLOG("WARNING: This texture still exists within webkit.");
+            needsDeleted = true;
         }
     }
     m_mediaLock.unlock();
diff --git a/WebCore/platform/graphics/android/SharedTexture.cpp b/WebCore/platform/graphics/android/SharedTexture.cpp
index 8c703d4c1..495fdd08c 100644
--- a/WebCore/platform/graphics/android/SharedTexture.cpp
+++ b/WebCore/platform/graphics/android/SharedTexture.cpp
@@ -80,10 +80,7 @@ SharedTexture::SharedTexture()
 // source texture and EGLImage is the responsibility of the caller.
 SharedTexture::~SharedTexture()
 {
-    if (m_supportsEGLImage)
-        GLUtils::deleteTexture(&m_targetTexture.m_textureId);
-    else
-        GLUtils::deleteTexture(&m_sourceTexture.m_textureId);
+    deleteTargetTexture();
 }
 
 void SharedTexture::initSourceTexture()
@@ -120,6 +117,14 @@ void SharedTexture::deleteSourceTexture()
     }
 }
 
+void SharedTexture::deleteTargetTexture()
+{
+    if (m_supportsEGLImage)
+        GLUtils::deleteTexture(&m_targetTexture.m_textureId);
+    else
+        GLUtils::deleteTexture(&m_sourceTexture.m_textureId);
+}
+
 TextureInfo* SharedTexture::lockSource()
 {
     m_lock.lock();
diff --git a/WebCore/platform/graphics/android/SharedTexture.h b/WebCore/platform/graphics/android/SharedTexture.h
index 731aa5c0e..37d6091af 100644
--- a/WebCore/platform/graphics/android/SharedTexture.h
+++ b/WebCore/platform/graphics/android/SharedTexture.h
@@ -81,6 +81,7 @@ public:
 
     void initSourceTexture(); // producer thread only
     void deleteSourceTexture(); // producer thread only
+    void deleteTargetTexture(); // consumer thread only
     GLuint getSourceTextureId() { return m_sourceTexture.m_textureId; }
     GLuint getTargetTextureId() { return m_targetTexture.m_textureId; }
     EGLImageKHR getEGLImage() { return m_eglImage; }
-- 
2.11.0