Don't allow dirtying layout during paint of a plugin placeholder.

components/plugins/renderer/webview_plugin.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/plugins/renderer/webview_plugin.h"
 
 #include <stddef.h>
 
+#include "base/auto_reset.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/numerics/safe_conversions.h"
 #include "content/public/common/web_preferences.h"
 #include "content/public/renderer/render_view.h"
 #include "gin/converter.h"
 #include "skia/ext/platform_canvas.h"
 #include "third_party/WebKit/public/platform/WebSize.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 #include "third_party/WebKit/public/platform/WebURLRequest.h"
@@ skipping 29 matching lines @@
 using content::WebPreferences;
 
 WebViewPlugin::WebViewPlugin(content::RenderView* render_view,
                              WebViewPlugin::Delegate* delegate,
                              const WebPreferences& preferences)
     : content::RenderViewObserver(render_view),
       delegate_(delegate),
       container_(nullptr),
       web_view_(WebView::create(this)),
       finished_loading_(false),
-      focused_(false) {
+      focused_(false),
+      is_painting_(false) {
   // ApplyWebPreferences before making a WebLocalFrame so that the frame sees a
   // consistent view of our preferences.
   content::RenderView::ApplyWebPreferences(preferences, web_view_);
   WebLocalFrame* web_local_frame =
       WebLocalFrame::create(blink::WebTreeScopeType::Document, this);
   web_frame_ = web_local_frame;
   web_view_->setMainFrame(web_frame_);
   // TODO(dcheng): The main frame widget currently has a special case.
   // Eliminate this once WebView is no longer a WebWidget.
   web_frame_widget_ = WebFrameWidget::create(this, web_view_, web_local_frame);
@@ skipping 96 matching lines @@
 // either the Blink lifecycle or Compositor layer tree host nomenclature.
 void WebViewPlugin::layoutIfNeeded() {
   web_view_->updateAllLifecyclePhases();
 }
 
 void WebViewPlugin::paint(WebCanvas* canvas, const WebRect& rect) {
   gfx::Rect paint_rect = gfx::IntersectRects(rect_, rect);
   if (paint_rect.IsEmpty())
     return;
 
+  base::AutoReset<bool> is_painting(
+        &is_painting_, true);
+
   paint_rect.Offset(-rect_.x(), -rect_.y());
 
   canvas->save();
   canvas->translate(SkIntToScalar(rect_.x()), SkIntToScalar(rect_.y()));
 
   // Apply inverse device scale factor, as the outer webview has already
   // applied it, and the inner webview will apply it again.
   SkScalar inverse_scale =
       SkFloatToScalar(1.0 / container_->deviceScaleFactor());
   canvas->scale(inverse_scale, inverse_scale);
@@ skipping 96 matching lines @@
 void WebViewPlugin::didInvalidateRect(const WebRect& rect) {
   if (container_)
     container_->invalidateRect(rect);
 }
 
 void WebViewPlugin::didChangeCursor(const WebCursorInfo& cursor) {
   current_cursor_ = cursor;
 }
 
 void WebViewPlugin::scheduleAnimation() {
-  if (container_)
+  if (container_) {
+    DCHECK(!is_painting_);

[tommycli, 2016/02/08 23:09:04]

Don't only CHECKs show up in crashes? Not sure, just asking.

[chrishtr, 2016/02/08 23:13:56]

CHECK will crash in production, DCHECK in debug builds. Another option is to
upgrade
to a CHECK...hmm. Updated to be CHECK instead to see if we can get it to crash
on canary.

+    // This should never happen, but adding this code to see if it affects
+    /// crashes observed in crbug.com/545039.
+    if (is_painting_)
+      return;
     container_->setNeedsLayout();
+  }
 }
 
 void WebViewPlugin::didClearWindowObject(WebLocalFrame* frame) {
   if (!delegate_)
     return;
 
   v8::Isolate* isolate = blink::mainThreadIsolate();
   v8::HandleScope handle_scope(isolate);
   v8::Local<v8::Context> context = frame->mainWorldScriptContext();
   DCHECK(!context.IsEmpty());
@@ skipping 15 matching lines @@
   // By default RenderViewObservers are destroyed along with the RenderView.
   // WebViewPlugin has a custom destruction mechanism, so we disable this.
 }
 
 void WebViewPlugin::OnZoomLevelChanged() {
   if (container_) {
     web_view_->setZoomLevel(
       blink::WebView::zoomFactorToZoomLevel(container_->pageZoomFactor()));
   }
 }