Bug 1416862: Ensure mSnapshot access is always protected by mSnapshotlock. r=mattwoodrow
authorBas Schouten <bschouten@mozilla.com>
Mon, 27 Nov 2017 03:12:09 +0100
changeset 438247 da1a37d969661c427938b7c7ecb8982e8208e8a9
parent 438246 50ad1d2828bf4003836014c21cc9c54992bbfd92
child 438248 1fc555642f58ce066b4e556be82bfd3db3e73a43
push id117
push userfmarier@mozilla.com
push dateTue, 28 Nov 2017 20:17:16 +0000
reviewersmattwoodrow
bugs1416862
milestone59.0a1
Bug 1416862: Ensure mSnapshot access is always protected by mSnapshotlock. r=mattwoodrow MozReview-Commit-ID: 8qkFde46WPQ
gfx/2d/DrawTargetSkia.cpp
--- a/gfx/2d/DrawTargetSkia.cpp
+++ b/gfx/2d/DrawTargetSkia.cpp
@@ -302,16 +302,19 @@ DrawTargetSkia::~DrawTargetSkia()
     mColorSpace = nullptr;
   }
 #endif
 }
 
 already_AddRefed<SourceSurface>
 DrawTargetSkia::Snapshot()
 {
+  // Without this lock, this could cause us to get out a snapshot and race with
+  // Snapshot::~Snapshot() actually destroying itself.
+  MutexAutoLock lock(*mSnapshotLock);
   RefPtr<SourceSurfaceSkia> snapshot = mSnapshot;
   if (mSurface && !snapshot) {
     snapshot = new SourceSurfaceSkia();
     sk_sp<SkImage> image;
     // If the surface is raster, making a snapshot may trigger a pixel copy.
     // Instead, try to directly make a raster image referencing the surface pixels.
     SkPixmap pixmap;
     if (mSurface->peekPixels(&pixmap)) {