Fix gpu command buffer use after free by GrContext

content/common/gpu/client/grcontext_for_webgraphicscontext3d.h

Index: content/common/gpu/client/grcontext_for_webgraphicscontext3d.h
diff --git a/content/common/gpu/client/grcontext_for_webgraphicscontext3d.h b/content/common/gpu/client/grcontext_for_webgraphicscontext3d.h
index 8d0a2ea2a7062b3b5b62050c89c7f68da1977ea0..7597f906a584697034a823f99db592000f72fe25 100644
--- a/content/common/gpu/client/grcontext_for_webgraphicscontext3d.h
+++ b/content/common/gpu/client/grcontext_for_webgraphicscontext3d.h
@@ -6,7 +6,10 @@
 #define CONTENT_COMMON_GPU_CLIENT_GRCONTEXT_FOR_WEBGRAPHICSCONTEXT3D_H_
 
 #include "base/macros.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/threading/thread_checker.h"
 #include "skia/ext/refptr.h"
+#include "third_party/skia/include/gpu/gl/GrGLInterface.h"
 
 class GrContext;
 
@@ -16,13 +19,35 @@ class WebGraphicsContext3DImpl;
 
 namespace content {
 
+// Wrap WebGraphicsContext3DImpl into a GrGLInterface object, which allows
+// the WebGraphicsContext3DImpl to be jointly refcounted (indirectly)
+// by the GrContext and the context provider. This makes it legal for the
+// GrContext to be invoked when it outlives the context provider that created
+// it. By doing this we no longer have to worry about use after free errors
+// caused a lack of consideration for object destruction order.
+class GrGLInterfaceForWebGraphicsContext3D final : public GrGLInterface {
+ public:
+  GrGLInterfaceForWebGraphicsContext3D(
+      scoped_ptr<gpu_blink::WebGraphicsContext3DImpl> context3d);
+  ~GrGLInterfaceForWebGraphicsContext3D() final;
+
+  void BindToCurrentThread();
+
+  gpu_blink::WebGraphicsContext3DImpl* WebContext3D() const {
+    return context3d_.get();
+  }
+ private:
+  base::ThreadChecker context_thread_checker_;
+  scoped_ptr<gpu_blink::WebGraphicsContext3DImpl> context3d_;
+};
+
 // This class binds an offscreen GrContext to an offscreen context3d. The
 // context3d is used by the GrContext so must be valid as long as this class
 // is alive.
 class GrContextForWebGraphicsContext3D {
  public:
   explicit GrContextForWebGraphicsContext3D(
-      gpu_blink::WebGraphicsContext3DImpl* context3d);
+      skia::RefPtr<GrGLInterfaceForWebGraphicsContext3D> context3d);
   virtual ~GrContextForWebGraphicsContext3D();
 
   GrContext* get() { return gr_context_.get(); }