Pepper: Add a nullptr check.

content/renderer/pepper/pepper_plugin_instance_impl.cc

Index: content/renderer/pepper/pepper_plugin_instance_impl.cc
diff --git a/content/renderer/pepper/pepper_plugin_instance_impl.cc b/content/renderer/pepper/pepper_plugin_instance_impl.cc
index 5b2757e8f5e3aa49b5675bbcf35d3f2a4006e5cb..20f8c57d99b544f336d5d0db9d4bc4c5002d65a9 100644
--- a/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/content/renderer/pepper/pepper_plugin_instance_impl.cc
@@ -823,7 +823,7 @@ void PepperPluginInstanceImpl::FinishedConsumingCommittedTexture(
     return;
   }
 
-  if (removed && !is_committed_texture) {
+  if (removed && !is_committed_texture && bound_graphics_3d_) {

[piman, 2016/05/05 20:25:41]

Actually, this makes me think a little more.
If the plugin binds a Graphics3D, swaps a couple of frames, then binds another
Graphics3D, we will be returning the mailbox to the wrong context (i.e. we won't
find the texture in GLES2DecoderImpl::ReturnFrontBuffer).

Should we bind the release callback to the Graphics3D that gave us the texture?

[erikchen, 2016/05/05 21:13:07]

Yes, we should.

     bound_graphics_3d_->ReturnFrontBuffer(texture_mailbox.mailbox(), sync_token,
                                           is_lost);
   }