Fix heap-use-after-free in cc::SurfaceManager::Destroy

content/browser/renderer_host/offscreen_canvas_surface_impl.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/offscreen_canvas_surface_impl.h"
 
 #include "base/bind_helpers.h"
 #include "cc/surfaces/surface.h"
 #include "cc/surfaces/surface_manager.h"
 #include "content/browser/compositor/surface_utils.h"
 #include "content/public/browser/browser_thread.h"
 
 namespace content {
 
 // static
 void OffscreenCanvasSurfaceImpl::Create(
     mojo::InterfaceRequest<blink::mojom::OffscreenCanvasSurface> request) {
   // |binding_| will take ownership of OffscreenCanvasSurfaceImpl
   new OffscreenCanvasSurfaceImpl(std::move(request));
 }
 
 OffscreenCanvasSurfaceImpl::OffscreenCanvasSurfaceImpl(
     mojo::InterfaceRequest<blink::mojom::OffscreenCanvasSurface> request)
     : id_allocator_(CreateSurfaceIdAllocator()),
       binding_(this, std::move(request)) {}
 
 OffscreenCanvasSurfaceImpl::~OffscreenCanvasSurfaceImpl() {
-  if (surface_factory_) {
-    surface_factory_->DestroyAll();
-  }
 }
 
 void OffscreenCanvasSurfaceImpl::GetSurfaceId(
     const GetSurfaceIdCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   cc::SurfaceId surface_id = id_allocator_->GenerateId();
 
   callback.Run(surface_id);
 }
@@ skipping 31 matching lines @@
     const cc::ReturnedResourceArray& resources) {}
 
 void OffscreenCanvasSurfaceImpl::WillDrawSurface(cc::SurfaceId id,
                                                  const gfx::Rect& damage_rect) {
 }
 
 void OffscreenCanvasSurfaceImpl::SetBeginFrameSource(
     cc::BeginFrameSource* begin_frame_source) {}
 
 }  // namespace content