Fix crash in PPB_Graphics3D_Impl destructor.

content/renderer/pepper/ppb_graphics_3d_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/ppb_graphics_3d_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/location.h"
 #include "base/single_thread_task_runner.h"
@@ skipping 28 matching lines @@
 namespace content {
 
 PPB_Graphics3D_Impl::PPB_Graphics3D_Impl(PP_Instance instance)
     : PPB_Graphics3D_Shared(instance),
       bound_to_instance_(false),
       commit_pending_(false),
       has_alpha_(false),
       weak_ptr_factory_(this) {}
 
 PPB_Graphics3D_Impl::~PPB_Graphics3D_Impl() {
-  command_buffer_->SetGpuControlClient(nullptr);
+  // Unset the client before the command_buffer_ is destroyed, similar to how
+  // WeakPtrFactory invalidates before it.
+  if (command_buffer_)
+    command_buffer_->SetGpuControlClient(nullptr);
 }
 
 // static
 PP_Resource PPB_Graphics3D_Impl::CreateRaw(
     PP_Instance instance,
     PP_Resource share_context,
     const int32_t* attrib_list,
     gpu::Capabilities* capabilities,
     base::SharedMemoryHandle* shared_state_handle,
     gpu::CommandBufferId* command_buffer_id) {
@@ skipping 270 matching lines @@
       instance->module()->GetPluginInterface(PPP_GRAPHICS_3D_INTERFACE));
   // We have to check *again* that the instance exists, because it could have
   // been deleted during GetPluginInterface(). Even the PluginModule could be
   // deleted, but in that case, the instance should also be gone, so the
   // GetInstance check covers both cases.
   if (ppp_graphics_3d && HostGlobals::Get()->GetInstance(this_pp_instance))
     ppp_graphics_3d->Graphics3DContextLost(this_pp_instance);
 }
 
 }  // namespace content