ozone: drm: Fix HardwareDisplayController use-after-free

ui/ozone/platform/drm/gpu/screen_manager_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/ozone/platform/drm/gpu/crtc_controller.h"
 #include "ui/ozone/platform/drm/gpu/drm_buffer.h"
 #include "ui/ozone/platform/drm/gpu/drm_device_manager.h"
 #include "ui/ozone/platform/drm/gpu/drm_window.h"
 #include "ui/ozone/platform/drm/gpu/hardware_display_controller.h"
@@ skipping 356 matching lines @@
   bool window1_has_controller = screen_manager_->GetWindow(1)->GetController();
   bool window2_has_controller = screen_manager_->GetWindow(2)->GetController();
   // Only one of the windows can have a controller.
   EXPECT_TRUE(window1_has_controller ^ window2_has_controller);
 
   for (size_t i = 1; i < kWindowCount + 1; ++i) {
     scoped_ptr<ui::DrmWindow> window = screen_manager_->RemoveWindow(i);
     window->Shutdown();
   }
 }
+
+TEST_F(ScreenManagerTest, ShouldDissociateWindowOnControllerRemoval) {
+  gfx::AcceleratedWidget window_id = 1;
+  ui::DrmDeviceManager device_manager(drm_);
+  scoped_ptr<ui::DrmWindow> window(
+      new ui::DrmWindow(window_id, &device_manager, screen_manager_.get()));
+  window->Initialize();
+  window->OnBoundsChanged(GetPrimaryBounds());
+  screen_manager_->AddWindow(window_id, window.Pass());
+
+  screen_manager_->AddDisplayController(drm_, kPrimaryCrtc, kPrimaryConnector);
+  screen_manager_->ConfigureDisplayController(
+      drm_, kPrimaryCrtc, kPrimaryConnector, GetPrimaryBounds().origin(),
+      kDefaultMode);
+
+  EXPECT_TRUE(screen_manager_->GetWindow(window_id)->GetController());
+
+  screen_manager_->RemoveDisplayController(drm_, kPrimaryCrtc);
+
+  EXPECT_FALSE(screen_manager_->GetWindow(window_id)->GetController());
+
+  window = screen_manager_->RemoveWindow(1);
+  window->Shutdown();
+}