Speculative fix for ui::DisplayLinkMac::StopDisplayLink crashes

ui/accelerated_widget_mac/display_link_mac.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/accelerated_widget_mac/display_link_mac.h"
 
 #include <stdint.h>
 
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 68 matching lines @@
     DPLOG_IF(ERROR, register_error != kCGErrorSuccess)
         << "CGDisplayRegisterReconfigurationCallback: "
         << register_error;
   }
   display_map_.Get().insert(std::make_pair(display_id_, this));
 }
 
 DisplayLinkMac::~DisplayLinkMac() {
   StopDisplayLink();
 
+  // Usually |display_link_| holds the last reference to CVDisplayLinkRef, but
+  // that's not guaranteed, so it might not free all resources after the
+  // destructor completes. Ensure the callback is cleared out regardless to
+  // avoid possible crashes (see http://crbug.com/564780).
+  CVReturn ret =
+      CVDisplayLinkSetOutputCallback(display_link_, nullptr, nullptr);
+  DCHECK_EQ(kCGErrorSuccess, ret);
+
   DisplayMap::iterator found = display_map_.Get().find(display_id_);
   DCHECK(found != display_map_.Get().end());
   DCHECK(found->second == this);
   display_map_.Get().erase(found);
   if (display_map_.Get().empty()) {
     CGError remove_error = CGDisplayRemoveReconfigurationCallback(
         DisplayReconfigurationCallBack, nullptr);
     DPLOG_IF(ERROR, remove_error != kCGErrorSuccess)
         << "CGDisplayRemoveReconfigurationCallback: "
         << remove_error;
@@ skipping 90 matching lines @@
   DisplayLinkMac* display_link_mac = found->second;
   display_link_mac->timebase_and_interval_valid_ = false;
 }
 
 // static
 base::LazyInstance<DisplayLinkMac::DisplayMap>
     DisplayLinkMac::display_map_ = LAZY_INSTANCE_INITIALIZER;
 
 }  // ui