diff --git a/components/viz/service/display_embedder/skia_output_device_buffer_queue.cc b/components/viz/service/display_embedder/skia_output_device_buffer_queue.cc --- a/components/viz/service/display_embedder/skia_output_device_buffer_queue.cc +++ b/components/viz/service/display_embedder/skia_output_device_buffer_queue.cc @@ -12,6 +12,7 @@ #include "base/functional/bind.h" #include "base/memory/raw_ptr.h" #include "base/notimplemented.h" +#include "base/threading/platform_thread.h" #include "base/time/default_tick_clock.h" #include "build/build_config.h" #include "components/viz/common/quads/compositor_frame_metadata.h" @@ -226,6 +227,18 @@ SkiaOutputDeviceBufferQueue::~SkiaOutputDeviceBufferQueue() { overlay.OnContextLost(); } } + // POC instrumentation (CompositorGpuThread under DrDc): explicitly destroy + // overlays_ first to drop the OverlayAHBImageRepresentation ref on the + // backing under SharedImageManager::lock_, then sleep so a concurrent + // DestroySharedImage on GPU main can take the last backing ref and call + // non-atomic OverlayImage::Release() while ~presenter_ below releases the + // ScopedHardwareBufferFenceSyncImpl ref on this thread. + LOG(ERROR) << "POC: ~SkiaOutputDeviceBufferQueue overlays_.size()=" + << overlays_.size(); + overlays_.clear(); + LOG(ERROR) << "POC: overlays_ cleared, sleeping 200ms before ~presenter_"; + base::PlatformThread::Sleep(base::Milliseconds(200)); + // presenter_ destroyed by member-dtor order after this body returns. } const SkiaOutputDeviceBufferQueue::OverlayData* diff --git a/gpu/command_buffer/service/shared_image/ahardwarebuffer_image_backing_factory.cc b/gpu/command_buffer/service/shared_image/ahardwarebuffer_image_backing_factory.cc --- a/gpu/command_buffer/service/shared_image/ahardwarebuffer_image_backing_factory.cc +++ b/gpu/command_buffer/service/shared_image/ahardwarebuffer_image_backing_factory.cc @@ -111,7 +111,13 @@ class OverlayImage final : public base::RefCounted { scoped_refptr image_; }; - ~OverlayImage() = default; + ~OverlayImage() { + // POC instrumentation: under the race, both threads enter this dtor. + // ASAN reports heap-use-after-free on the second entry; in a release + // build the double-dtor double-releases handle_ and double-closes the + // fence FDs. + LOG(ERROR) << "POC: ~OverlayImage this=" << this; + } base::android::ScopedHardwareBufferHandle handle_;