Speculative fix for ui::DisplayLinkMac::StopDisplayLink crashes #take2.

ui/accelerated_widget_mac/display_link_mac.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/accelerated_widget_mac/display_link_mac.h"
 
 #include <stdint.h>
 
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/trace_event/trace_event.h"
 
 namespace base {
 
 template<>
 struct ScopedTypeRefTraits<CVDisplayLinkRef> {
   static CVDisplayLinkRef InvalidValue() { return nullptr; }
   static CVDisplayLinkRef Retain(CVDisplayLinkRef object) {
     return CVDisplayLinkRetain(object);
   }
   static void Release(CVDisplayLinkRef object) {
     CVDisplayLinkRelease(object);
   }
 };
 
 }  // namespace base
 
+namespace {
+
+// Empty callback set during tear down.
+CVReturn VoidDisplayLinkCallback(CVDisplayLinkRef display_link,
+                                 const CVTimeStamp* now,
+                                 const CVTimeStamp* output_time,
+                                 CVOptionFlags flags_in,
+                                 CVOptionFlags* flags_out,
+                                 void* context) {
+  return kCVReturnSuccess;
+}
+
+}  // namespace
+
 namespace ui {
 
 // static
 scoped_refptr<DisplayLinkMac> DisplayLinkMac::GetForDisplay(
     CGDirectDisplayID display_id) {
   if (!display_id)
     return nullptr;
 
   // Return the existing display link for this display, if it exists.
   DisplayMap::iterator found = display_map_.Get().find(display_id);
@@ skipping 41 matching lines @@
     DPLOG_IF(ERROR, register_error != kCGErrorSuccess)
         << "CGDisplayRegisterReconfigurationCallback: "
         << register_error;
   }
   display_map_.Get().insert(std::make_pair(display_id_, this));
 }
 
 DisplayLinkMac::~DisplayLinkMac() {
   StopDisplayLink();
 
+  // Usually |display_link_| holds the last reference to CVDisplayLinkRef, but
+  // that's not guaranteed, so it might not free all resources after the
+  // destructor completes. Ensure the callback is cleared out regardless to
+  // avoid possible crashes (see http://crbug.com/564780).
+  CVReturn ret = CVDisplayLinkSetOutputCallback(
+      display_link_, VoidDisplayLinkCallback, nullptr);
+  DCHECK_EQ(kCGErrorSuccess, ret);
+
   DisplayMap::iterator found = display_map_.Get().find(display_id_);
   DCHECK(found != display_map_.Get().end());
   DCHECK(found->second == this);
   display_map_.Get().erase(found);
   if (display_map_.Get().empty()) {
     CGError remove_error = CGDisplayRemoveReconfigurationCallback(
         DisplayReconfigurationCallBack, nullptr);
     DPLOG_IF(ERROR, remove_error != kCGErrorSuccess)
         << "CGDisplayRemoveReconfigurationCallback: "
         << remove_error;
@@ skipping 90 matching lines @@
   DisplayLinkMac* display_link_mac = found->second;
   display_link_mac->timebase_and_interval_valid_ = false;
 }
 
 // static
 base::LazyInstance<DisplayLinkMac::DisplayMap>
     DisplayLinkMac::display_map_ = LAZY_INSTANCE_INITIALIZER;
 
 }  // ui