tree 79af6b45e8a0c2e70f1a3357f8a0acab960f83b1
parent a4627f23e2ecc8a7eeb1aeab4294404a0b17f144
author kylechar <kylechar@chromium.org> 1548188507 +0000
committer Commit Bot <commit-bot@chromium.org> 1548188507 +0000

Fix race binding LayerTreeFrameSink to client.

ui::Compositor expects that calling LayerTreeFrameSink::BindToClient()
will always be successful. However, BindToClient() can fail if the worker
context provider has encountered a GL error. Even if we check the worker
context provider hasn't encountered an error before passing it to
ui::Compositor, it's possible the error happens after the check but
before BindToClient() is called.

GpuCrash_GPUProcessCrashesExactlyOncePerVisitToAboutGpuCrash is failing
flakily on mac due to this. With OOP-D there are multiple message pipes
between the browser and GPU process which all get notified of the GPU
process crashing. This sets up the perfect conditions for the race to
occur.

Stop checking if the worker context provider has been lost in
BindToCurrentThread(). Instead, ensure that observers will always get
the OnContextLost() call even if AddObserver() was called after context
is lost.

We make OnContextLost() call happens in a new callstack to avoid
re-entrancy. This should be safe because the posted task has a reference
to context provider and we check that the observer is still observing
in the posted task.

Bug: 878258
Change-Id: If0db2fead55f86d86892db7a5dc257154590fe98
Reviewed-on: https://chromium-review.googlesource.com/c/1403323
Reviewed-by: Eric Karl <ericrk@chromium.org>
Reviewed-by: Sunny Sachanandani <sunnyps@chromium.org>
Reviewed-by: danakj <danakj@chromium.org>
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Commit-Queue: kylechar <kylechar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#624899}