Fix GpuChannelHost destruction races.

content/common/gpu/client/gpu_channel_host.cc

Index: content/common/gpu/client/gpu_channel_host.cc
diff --git a/content/common/gpu/client/gpu_channel_host.cc b/content/common/gpu/client/gpu_channel_host.cc
index ade330d9a9cebc90ec79e7a6ae511083361ca85b..31108b84d4118bd4b390b42c842f87de7e36f71c 100644
--- a/content/common/gpu/client/gpu_channel_host.cc
+++ b/content/common/gpu/client/gpu_channel_host.cc
@@ -52,7 +52,7 @@ void GpuChannelHost::Connect(
 
   channel_->AddFilter(sync_filter_.get());
 
-  channel_filter_ = new MessageFilter(this);
+  channel_filter_ = new MessageFilter(AsWeakPtr(), factory_);
 
   // Install the filter last, because we intercept all leftover
   // messages.
@@ -316,8 +316,11 @@ int32 GpuChannelHost::ReserveTransferBufferId() {
 GpuChannelHost::~GpuChannelHost() {}
 
 
-GpuChannelHost::MessageFilter::MessageFilter(GpuChannelHost* parent)
-    : parent_(parent) {
+GpuChannelHost::MessageFilter::MessageFilter(
+    base::WeakPtr<GpuChannelHost> parent,
+    GpuChannelHostFactory* factory)
+    : parent_(parent),
+      factory_(factory) {
 }
 
 GpuChannelHost::MessageFilter::~MessageFilter() {}
@@ -326,7 +329,7 @@ void GpuChannelHost::MessageFilter::AddRoute(
     int route_id,
     base::WeakPtr<IPC::Listener> listener,
     scoped_refptr<MessageLoopProxy> loop) {
-  DCHECK(parent_->factory_->IsIOThread());
+  DCHECK(factory_->IsIOThread());
   DCHECK(listeners_.find(route_id) == listeners_.end());
   GpuListenerInfo info;
   info.listener = listener;
@@ -335,7 +338,7 @@ void GpuChannelHost::MessageFilter::AddRoute(
 }
 
 void GpuChannelHost::MessageFilter::RemoveRoute(int route_id) {
-  DCHECK(parent_->factory_->IsIOThread());
+  DCHECK(factory_->IsIOThread());
   ListenerMap::iterator it = listeners_.find(route_id);
   if (it != listeners_.end())
     listeners_.erase(it);
@@ -343,14 +346,14 @@ void GpuChannelHost::MessageFilter::RemoveRoute(int route_id) {
 
 bool GpuChannelHost::MessageFilter::OnMessageReceived(
     const IPC::Message& message) {
-  DCHECK(parent_->factory_->IsIOThread());
+  DCHECK(factory_->IsIOThread());
 
   // Never handle sync message replies or we will deadlock here.
   if (message.is_reply())
     return false;
 
   if (message.routing_id() == MSG_ROUTING_CONTROL) {
-    MessageLoop* main_loop = parent_->factory_->GetMainLoop();
+    MessageLoop* main_loop = factory_->GetMainLoop();
     main_loop->PostTask(FROM_HERE,
                         base::Bind(&GpuChannelHost::OnMessageReceived,
                                    parent_,
@@ -374,12 +377,12 @@ bool GpuChannelHost::MessageFilter::OnMessageReceived(
 }
 
 void GpuChannelHost::MessageFilter::OnChannelError() {
-  DCHECK(parent_->factory_->IsIOThread());
+  DCHECK(factory_->IsIOThread());
 
   // Post the task to signal the GpuChannelHost before the proxies. That way, if
   // they themselves post a task to recreate the context, they will not try to
   // re-use this channel host before it has a chance to mark itself lost.
-  MessageLoop* main_loop = parent_->factory_->GetMainLoop();
+  MessageLoop* main_loop = factory_->GetMainLoop();
   main_loop->PostTask(FROM_HERE,
                       base::Bind(&GpuChannelHost::OnChannelError, parent_));
   // Inform all the proxies that an error has occurred. This will be reported