[M108 Aura Migration][NaCl][PPAPI] Fix crash related to Pepper Var object and ~VarTracker

Fix crash while releasing null Pepper Var object.
Fixed crash in ~VarTracker when VarDictionary is tracked.
Patch ported from M94:
https://review.tizen.org/gerrit/#/c/platform/framework/web/chromium-efl/+/280664/

Change-Id: Ia2a222dfa46ab7998b4f70bcb9656db327fd5d25
Signed-off-by: pengxia <pengxia.shen@samsung.com>

diff --git a/ppapi/shared_impl/var_tracker.cc b/ppapi/shared_impl/var_tracker.cc
index 3100e1d..ba08998 100644 (file)
--- a/ppapi/shared_impl/var_tracker.cc
+++ b/ppapi/shared_impl/var_tracker.cc
@@ -30,7 +30,16 @@ VarTracker::VarTracker(ThreadMode thread_mode) : last_var_id_(0) {
     thread_checker_ = std::make_unique<base::ThreadChecker>();
 }
 
-VarTracker::~VarTracker() {}
+VarTracker::~VarTracker() {
+#if defined(TIZEN_PEPPER_EXTENSIONS)
+  // If VarDictionary is nested in live_vars_ and live_vars_ is being destroyed,
+  // then VarDictionary will call VarTracker::ReleaseVar. This results in
+  // operation on invalid live_vars_ (they are mid-destruction). Secondary map
+  // prevents invalid operations on live_vars_.
+  VarMap vars;
+  std::swap(vars, live_vars_);
+#endif
+}
 
 void VarTracker::CheckThreadingPreconditions() const {
   DCHECK(!thread_checker_ || thread_checker_->CalledOnValidThread());
@@ -113,6 +122,13 @@ bool VarTracker::ReleaseVar(int32_t var_id) {
   info.ref_count--;
 
   if (info.ref_count == 0) {
+#if defined(TIZEN_PEPPER_EXTENSIONS)
+    if (!info.var) {
+      live_vars_.erase(found);
+      return false;
+    }
+#endif
+
     // Hold a reference to the Var until it is erased so that we don't re-enter
     // live_vars_.erase() during deletion.
     // TODO(raymes): Make deletion of Vars iterative instead of recursive.
@@ -140,6 +156,11 @@ bool VarTracker::ReleaseVar(const PP_Var& var) {
 }
 
 int32_t VarTracker::AddVarInternal(Var* var, AddVarRefMode mode) {
+#if defined(TIZEN_PEPPER_EXTENSIONS)
+  if (!var)
+    return 0;
+#endif
+
   // If the plugin manages to create millions of strings.
   if (last_var_id_ == std::numeric_limits<int32_t>::max() >> kPPIdTypeBits)
     return 0;