Fix gpu command buffer use after free by GrContext

content/browser/android/in_process/context_provider_in_process.h

Index: content/browser/android/in_process/context_provider_in_process.h
diff --git a/content/browser/android/in_process/context_provider_in_process.h b/content/browser/android/in_process/context_provider_in_process.h
index 761caf0c46ac90a2d65ff82a9be7ec88b1300aaf..81726d644393982cfab320bc7c2fe2313631dabe 100644
--- a/content/browser/android/in_process/context_provider_in_process.h
+++ b/content/browser/android/in_process/context_provider_in_process.h
@@ -12,6 +12,7 @@
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_checker.h"
 #include "cc/blink/context_provider_web_context.h"
+#include "skia/ext/refptr.h"
 
 namespace blink { class WebGraphicsContext3D; }
 
@@ -22,6 +23,7 @@ class WebGraphicsContext3DInProcessCommandBufferImpl;
 namespace content {
 
 class GrContextForWebGraphicsContext3D;
+class GrGLInterfaceForWebGraphicsContext3D;
 
 class ContextProviderInProcess
     : NON_EXPORTED_BASE(public cc_blink::ContextProviderWebContext) {
@@ -41,6 +43,8 @@ class ContextProviderInProcess
   // cc_blink::ContextProviderWebContext:
   blink::WebGraphicsContext3D* WebContext3D() override;
 
+  gpu_blink::WebGraphicsContext3DInProcessCommandBufferImpl* WebContext3DImpl();
+
   // cc::ContextProvider:
   bool BindToCurrentThread() override;
   void DetachFromThread() override;
@@ -61,8 +65,7 @@ class ContextProviderInProcess
   base::ThreadChecker main_thread_checker_;
   base::ThreadChecker context_thread_checker_;
 
-  scoped_ptr<gpu_blink::WebGraphicsContext3DInProcessCommandBufferImpl>
-      context3d_;
+  skia::RefPtr<GrGLInterfaceForWebGraphicsContext3D> gr_interface_;
   scoped_ptr<GrContextForWebGraphicsContext3D> gr_context_;
 
   LostContextCallback lost_context_callback_;