[M73 merge] Make TakeFrontBuffer a deferred message

If TakeFrontBuffer is sent as an independent IPC message, it's possible
for it to be sequenced incorrectly with the preceding ReturnFrontBuffer
message if there was no flush in between.

This is a speculative fix for legacy ARC app rendering issues.

TBR=piman@chromium.org

Bug: 937524
Change-Id: I17792ed28e5c97e337c60a9c1f3dc440239c51b9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1517160
Reviewed-by: Antoine Labour <piman@chromium.org>
Commit-Queue: Antoine Labour <piman@chromium.org>
Commit-Queue: Sunny Sachanandani <sunnyps@chromium.org>
Auto-Submit: Sunny Sachanandani <sunnyps@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#640177}(cherry picked from commit 94d2e3578f28e688ae9210df7b4a1b3a2d370a6d)
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1524532
Reviewed-by: Sunny Sachanandani <sunnyps@chromium.org>
Cr-Commit-Position: refs/branch-heads/3683@{#822}
Cr-Branched-From: e51029943e0a38dd794b73caaf6373d5496ae783-refs/heads/master@{#625896}
diff --git a/gpu/ipc/client/command_buffer_proxy_impl.cc b/gpu/ipc/client/command_buffer_proxy_impl.cc
index 57827e5..d1405a8 100644
--- a/gpu/ipc/client/command_buffer_proxy_impl.cc
+++ b/gpu/ipc/client/command_buffer_proxy_impl.cc
@@ -637,7 +637,10 @@
   if (last_state_.error != gpu::error::kNoError)
     return;
 
-  Send(new GpuCommandBufferMsg_TakeFrontBuffer(route_id_, mailbox));
+  // TakeFrontBuffer should be a deferred message so that it's sequenced
+  // correctly with respect to preceding ReturnFrontBuffer messages.
+  last_flush_id_ = channel_->EnqueueDeferredMessage(
+      GpuCommandBufferMsg_TakeFrontBuffer(route_id_, mailbox));
 }
 
 void CommandBufferProxyImpl::ReturnFrontBuffer(const gpu::Mailbox& mailbox,
diff --git a/gpu/ipc/service/gpu_channel.cc b/gpu/ipc/service/gpu_channel.cc
index c966dfe..f061ec17 100644
--- a/gpu/ipc/service/gpu_channel.cc
+++ b/gpu/ipc/service/gpu_channel.cc
@@ -237,6 +237,7 @@
     case GpuCommandBufferMsg_AsyncFlush::ID:
     case GpuCommandBufferMsg_DestroyTransferBuffer::ID:
     case GpuCommandBufferMsg_ReturnFrontBuffer::ID:
+    case GpuCommandBufferMsg_TakeFrontBuffer::ID:
     case GpuChannelMsg_CreateSharedImage::ID:
     case GpuChannelMsg_DestroySharedImage::ID:
       return MessageErrorHandler(message, "Invalid message");