Fixes possible use after free in WebLayerTreeViewImpl

components/html_viewer/web_layer_tree_view_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/html_viewer/web_layer_tree_view_impl.h"
 
 #include "base/thread_task_runner_handle.h"
 #include "cc/blink/web_layer_impl.h"
 #include "cc/layers/layer.h"
 #include "cc/output/begin_frame_args.h"
@@ skipping 54 matching lines @@
     scoped_refptr<cc::ContextProvider> context_provider(
         new mojo::ContextProviderMojo(cb.PassInterface().PassHandle()));
     output_surface_.reset(
         new mojo::OutputSurfaceMojo(this, context_provider,
                                     surface.PassInterface().PassHandle()));
   }
   layer_tree_host_->SetLayerTreeHostClientReady();
 }
 
 WebLayerTreeViewImpl::~WebLayerTreeViewImpl() {
+  // Destroy the LayerTreeHost before anything else as doing so ensures we're
+  // not accessed on the compositor thread (we are the LayerTreeHostClient).
+  layer_tree_host_.reset();
 }
 
 void WebLayerTreeViewImpl::WillBeginMainFrame() {
 }
 
 void WebLayerTreeViewImpl::DidBeginMainFrame() {
 }
 
 void WebLayerTreeViewImpl::BeginMainFrameNotExpectedSoon() {
 }
@@ skipping 159 matching lines @@
       base::Bind(&WebLayerTreeViewImpl::DidCreateSurfaceOnMainThread,
                  main_thread_bound_weak_ptr_,
                  id));
 }
 
 void WebLayerTreeViewImpl::DidCreateSurfaceOnMainThread(cc::SurfaceId id) {
   view_->SetSurfaceId(mojo::SurfaceId::From(id));
 }
 
 }  // namespace html_viewer