SkSurface copy-on-write can yield stale GPU render targets.

Prepare_rt_for_external_access() grabs the render target and then fires
access notifications.

But the notification handlers may trigger copy-on-write, causing the
returned render target to be stale (pointing at the detached snapshot).

We should grab the render target after firing notifications.

R=reed@google.com,bsalomon@google.com

Review URL: https://codereview.chromium.org/1276713002

1 files changed, 3 insertions, 1 deletions

diff --git a/src/image/SkSurface_Gpu.cpp b/src/image/SkSurface_Gpu.cpp
index dbe82f8c9f..f0719d895a 100644
--- a/src/image/SkSurface_Gpu.cpp
+++ b/src/image/SkSurface_Gpu.cpp
@@ -28,7 +28,6 @@ SkSurface_Gpu::~SkSurface_Gpu() {
 
 static GrRenderTarget* prepare_rt_for_external_access(SkSurface_Gpu* surface,
                                                       SkSurface::BackendHandleAccess access) {
-    GrRenderTarget* rt = surface->getDevice()->accessRenderTarget();
     switch (access) {
         case SkSurface::kFlushRead_BackendHandleAccess:
             break;
@@ -40,6 +39,9 @@ static GrRenderTarget* prepare_rt_for_external_access(SkSurface_Gpu* surface,
             surface->getDevice()->accessBitmap(false).notifyPixelsChanged();
             break;
     }
+
+    // Grab the render target *after* firing notifications, as it may get switched if CoW kicks in.
+    GrRenderTarget* rt = surface->getDevice()->accessRenderTarget();
     rt->prepareForExternalIO();
     return rt;
 }