Bug 1284384 - Don't crash if TextureClient::Destroy is called between Lock and Unlock. r=sotaro
authorNicolas Silva <nsilva@mozilla.com>
Tue, 26 Jul 2016 12:56:38 +0200
changeset 331772 a99dade5a9b61bab222daaf033229a237e882659
parent 331763 fa5ba1af68d09baf15b9ac71b05b067997b75477
child 331773 64900003b7cc5cc029f9b77110cf778056851589
push id9858
push userjlund@mozilla.com
push dateMon, 01 Aug 2016 14:37:10 +0000
treeherdermozilla-aurora@203106ef6cb6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssotaro
bugs1284384
milestone50.0a1
Bug 1284384 - Don't crash if TextureClient::Destroy is called between Lock and Unlock. r=sotaro
gfx/layers/client/TextureClient.cpp
--- a/gfx/layers/client/TextureClient.cpp
+++ b/gfx/layers/client/TextureClient.cpp
@@ -355,20 +355,21 @@ DeallocateTextureClient(TextureDeallocPa
     actor->mOwnsTextureData = params.clientDeallocation;
     actor->Destroy(actor->mCompositableForwarder);
     // DestroyTextureData will be called by TextureChild::ActorDestroy
   }
 }
 
 void TextureClient::Destroy(bool aForceSync)
 {
-  if (mActor) {
+  if (mActor && !mIsLocked) {
     mActor->Lock();
   }
 
+  mBorrowedDrawTarget = nullptr;
   mReadLock = nullptr;
 
   CancelWaitFenceHandleOnImageBridge();
   RefPtr<TextureChild> actor = mActor;
   mActor = nullptr;
 
   if (actor && !actor->mDestroyed.compareExchange(false, true)) {
     actor->Unlock();
@@ -514,17 +515,19 @@ TextureClient::Unlock()
 
     mBorrowedDrawTarget = nullptr;
   }
 
   if (mOpenMode & OpenMode::OPEN_WRITE) {
     mUpdated = true;
   }
 
-  mData->Unlock();
+  if (mData) {
+    mData->Unlock();
+  }
   mIsLocked = false;
   mOpenMode = OpenMode::OPEN_NONE;
 
   UnlockActor();
 }
 
 void
 TextureClient::EnableReadLock()