Browser Plugin: When Guest crashes Embedder crashes in content shell

content/renderer/browser_plugin/browser_plugin.cc

Index: content/renderer/browser_plugin/browser_plugin.cc
diff --git a/content/renderer/browser_plugin/browser_plugin.cc b/content/renderer/browser_plugin/browser_plugin.cc
index ed0f293678b2d13a4c5398ce6640fec90470115a..6a032f0952b67bf0dc73e103a68fe0fba37f9fa4 100644
--- a/content/renderer/browser_plugin/browser_plugin.cc
+++ b/content/renderer/browser_plugin/browser_plugin.cc
@@ -320,6 +320,9 @@ void BrowserPlugin::UpdateRect(
 void BrowserPlugin::GuestCrashed() {
   guest_crashed_ = true;
   container_->invalidate();
+  // We won't paint the contents of the current backing store again so we might
+  // as well toss it out and save memory.
+  backing_store_.reset();
 
   if (!HasListeners(kCrashEventName))
     return;
@@ -529,8 +532,12 @@ void BrowserPlugin::paint(WebCanvas* canvas, const WebRect& rect) {
           GetSadPluginBitmap();
     // TODO(fsamuel): Do we want to paint something other than a sad plugin
     // on crash? See http://www.crbug.com/140266.
-    webkit::PaintSadPlugin(canvas, plugin_rect_, *sad_guest_);
-    return;
+    // content_shell does not have the sad plugin bitmap, so we'll paint black
+    // instead to make it clear that something went wrong.
+    if (sad_guest_) {
+      webkit::PaintSadPlugin(canvas, plugin_rect_, *sad_guest_);
+      return;
+    }
   }
   SkAutoCanvasRestore auto_restore(canvas, true);
   canvas->translate(plugin_rect_.x(), plugin_rect_.y());
@@ -544,9 +551,9 @@ void BrowserPlugin::paint(WebCanvas* canvas, const WebRect& rect) {
   // show a gutter.
   SkPaint paint;
   paint.setStyle(SkPaint::kFill_Style);
-  paint.setColor(SK_ColorWHITE);
+  paint.setColor(guest_crashed_ ? SK_ColorBLACK : SK_ColorWHITE);
   canvas->drawRect(image_data_rect, paint);
-  // Stay at white if we have never set a non-empty src, or we don't yet have a
+  // Stay a solid color if we have never set a non-empty src, or we don't have a
   // backing store.
   if (!backing_store_.get() || !navigate_src_sent_)
     return;