Mac: Fix crash when destroying RWHVMacs that use accelerated drawing.

chrome/browser/renderer_host/render_widget_host_view_mac.mm

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <QuartzCore/QuartzCore.h>
 
 #include "chrome/browser/renderer_host/render_widget_host_view_mac.h"
 
 #include "chrome/browser/chrome_thread.h"
 #include "app/surface/io_surface_support_mac.h"
@@ skipping 152 matching lines @@
 
   // -globalFrameDidChange: can be called recursively, this counts how often it
   // holds the CGL lock.
   int globalFrameDidChangeCGLLockCount_;
 }
 
 - (id)initWithRenderWidgetHostViewMac:(RenderWidgetHostViewMac*)r
                          pluginHandle:(gfx::PluginWindowHandle)pluginHandle;
 - (void)drawView;
 
+// NSViews autorelease subviews when they die. The RWHVMac gets destroyed when
+// RHWVCocoa gets dealloc'd, which means the AcceleratedPluginView child views
+// can be around a little longer than the RWHVMac. This is called when the
+// RWHVMac is about to be deleted (but it's still valid while this method runs).
+- (void)onRenderWidgetHostViewGone;
+
 // This _must_ be atomic, since it's accessed from several threads.
 @property BOOL surfaceWasSwapped;
 
 // This _must_ be atomic, since it's accessed from several threads.
 @property NSSize cachedSize;
 @end
 
 @implementation AcceleratedPluginView
 @synthesize surfaceWasSwapped = surfaceWasSwapped_;
 @synthesize cachedSize = cachedSize_;
@@ skipping 57 matching lines @@
     [glContext_ setValues:&swapInterval forParameter:NSOpenGLCPSwapInterval];
 
     // Set up a display link to do OpenGL rendering on a background thread.
     CVDisplayLinkCreateWithActiveCGDisplays(&displayLink_);
   }
   return self;
 }
 
 - (void)dealloc {
   CVDisplayLinkRelease(displayLink_);
+  if (renderWidgetHostView_)
+    renderWidgetHostView_->DeallocFakePluginWindowHandle(pluginHandle_);
   [[NSNotificationCenter defaultCenter] removeObserver:self];
   [super dealloc];
 }
 
 - (void)drawView {
   // Called on a background thread. Synchronized via the CGL context lock.
   CGLLockContext(cglContext_);
 
   // TODO(thakis): Pixel or view coordinates for size?
   renderWidgetHostView_->DrawAcceleratedSurfaceInstance(
       cglContext_, pluginHandle_, [self cachedSize]);
 
   CGLFlushDrawable(cglContext_);
   CGLUnlockContext(cglContext_);
 }
 
+- (void)onRenderWidgetHostViewGone {
+  CGLLockContext(cglContext_);
+  // Deallocate the plugin handle while we still can.
+  renderWidgetHostView_->DeallocFakePluginWindowHandle(pluginHandle_);
+  renderWidgetHostView_ = NULL;
+  CGLUnlockContext(cglContext_);
+}
+
 - (void)drawRect:(NSRect)rect {
   if (!CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kDisableHolePunching)) {
     const NSRect* dirtyRects;
     int dirtyRectCount;
     [self getRectsBeingDrawn:&dirtyRects count:&dirtyRectCount];
 
     // Punch a hole so that the OpenGL view shows through.
     [[NSColor clearColor] set];
     NSRectFillList(dirtyRects, dirtyRectCount);
@@ skipping 415 matching lines @@
   // message and can kill itself. Alas, on the Mac, views cannot capture events
   // outside of themselves. On Windows, if Destroy is being called on a view,
   // then the event causing the destroy had also cancelled any popups by the
   // time Destroy() was called. On the Mac we have to destroy all the popups
   // ourselves.
 
   if (!is_popup_menu_) {
     // Depth-first destroy all popups. Use ShutdownHost() to enforce
     // deepest-first ordering.
     for (NSView* subview in [cocoa_view_ subviews]) {
-      if (![subview isKindOfClass:[RenderWidgetHostViewCocoa class]])
-        continue;  // Skip accelerated views.
-
-      [static_cast<RenderWidgetHostViewCocoa*>(subview)
-          renderWidgetHostViewMac]->ShutdownHost();
+      if ([subview isKindOfClass:[RenderWidgetHostViewCocoa class]]) {
+        [static_cast<RenderWidgetHostViewCocoa*>(subview)
+            renderWidgetHostViewMac]->ShutdownHost();
+      } else if ([subview isKindOfClass:[AcceleratedPluginView class]]) {
+        [static_cast<AcceleratedPluginView*>(subview)
+            onRenderWidgetHostViewGone];
+      }
     }
 
     // We've been told to destroy.
     [cocoa_view_ retain];
     [cocoa_view_ removeFromSuperview];
     [cocoa_view_ autorelease];
   } else {
     // From the renderer's perspective, the pop-up menu is represented by a
     // RenderWidget. The actual Mac implementation uses a native pop-up menu
     // and doesn't actually make use of the RenderWidgetHostViewCocoa that
@@ skipping 157 matching lines @@
 void RenderWidgetHostViewMac::DestroyFakePluginWindowHandle(
     gfx::PluginWindowHandle window) {
   CHECK(ChromeThread::CurrentlyOn(ChromeThread::UI));
   PluginViewMap::iterator it = plugin_views_.find(window);
   DCHECK(plugin_views_.end() != it);
   if (plugin_views_.end() == it) {
     return;
   }
   [it->second removeFromSuperview];
   plugin_views_.erase(it);
+
+  // The view's dealloc will call DeallocFakePluginWindowHandle(), which will
+  // remove the handle from |plugin_container_manager_|. This code path is
+  // taken if a plugin is removed, but the RWHVMac itself stays alive.
+}
+
+// This is called by AcceleratedPluginView's -dealloc.
+void RenderWidgetHostViewMac::DeallocFakePluginWindowHandle(
+    gfx::PluginWindowHandle window) {
   plugin_container_manager_.DestroyFakePluginWindowHandle(window);
 }
 
 void RenderWidgetHostViewMac::AcceleratedSurfaceSetIOSurface(
     gfx::PluginWindowHandle window,
     int32 width,
     int32 height,
     uint64 io_surface_identifier) {
   CHECK(ChromeThread::CurrentlyOn(ChromeThread::UI));
   plugin_container_manager_.SetSizeAndIOSurface(window,
@@ skipping 107 matching lines @@
   NSUserDefaults* user_defaults = [NSUserDefaults standardUserDefaults];
   [user_defaults addSuiteNamed:@"com.apple.universalaccess"];
   return 1 == [user_defaults integerForKey:@"voiceOverOnOffKey"];
 }
 
 namespace {
 
 // Adjusts an NSRect in Cocoa screen coordinates to have an origin in the upper
 // left of the primary screen (Carbon coordinates), and stuffs it into a
 // gfx::Rect.
-gfx::Rect FlipNSRectToRectScreen(const NSRect rect) {
+gfx::Rect FlipNSRectToRectScreen(const NSRect& rect) {
   gfx::Rect new_rect(NSRectToCGRect(rect));
   if ([[NSScreen screens] count] > 0) {
     new_rect.set_y([[[NSScreen screens] objectAtIndex:0] frame].size.height -
                    new_rect.y() - new_rect.height());
   }
   return new_rect;
 }
 
 // Returns the window that visually contains the given view. This is different
 // from [view window] in the case of tab dragging, where the view's owning
@@ skipping 1428 matching lines @@
   if (!string) return NO;
 
   // If the user is currently using an IME, confirm the IME input,
   // and then insert the text from the service, the same as TextEdit and Safari.
   [self confirmComposition];
   [self insertText:string];
   return YES;
 }
 
 @end