Fix gpu command buffer use after free by GrContext

content/common/gpu/client/context_provider_command_buffer.h

Index: content/common/gpu/client/context_provider_command_buffer.h
diff --git a/content/common/gpu/client/context_provider_command_buffer.h b/content/common/gpu/client/context_provider_command_buffer.h
index 3e67234a7fe7156bbfa09ec46d0fc31d93a9714b..7444f35741b6dcf381412a77e9ecd0e6377e14f3 100644
--- a/content/common/gpu/client/context_provider_command_buffer.h
+++ b/content/common/gpu/client/context_provider_command_buffer.h
@@ -14,10 +14,12 @@
 #include "content/common/content_export.h"
 #include "content/common/gpu/client/command_buffer_metrics.h"
 #include "content/common/gpu/client/webgraphicscontext3d_command_buffer_impl.h"
+#include "skia/ext/refptr.h"
 
 namespace content {
 
 class GrContextForWebGraphicsContext3D;
+class GrGLInterfaceForWebGraphicsContext3D;
 
 // Implementation of cc::ContextProvider that provides a
 // WebGraphicsContext3DCommandBufferImpl context and a GrContext.
@@ -56,12 +58,13 @@ class CONTENT_EXPORT ContextProviderCommandBuffer
   void OnLostContext();
 
  private:
+  WebGraphicsContext3DCommandBufferImpl* WebContext3DNoChecks();
   void InitializeCapabilities();
 
   base::ThreadChecker main_thread_checker_;
   base::ThreadChecker context_thread_checker_;
 
-  scoped_ptr<WebGraphicsContext3DCommandBufferImpl> context3d_;
+  skia::RefPtr<GrGLInterfaceForWebGraphicsContext3D> gr_interface_;
   scoped_ptr<GrContextForWebGraphicsContext3D> gr_context_;
 
   cc::ContextProvider::Capabilities capabilities_;
@@ -73,6 +76,7 @@ class CONTENT_EXPORT ContextProviderCommandBuffer
   base::Lock context_lock_;
 
   class LostContextCallbackProxy;
+  friend class LostContextCallbackProxy;
   scoped_ptr<LostContextCallbackProxy> lost_context_callback_proxy_;
 };