Fix use-after-free in ~GpuProcessTransportFactory

content/browser/compositor/gpu_process_transport_factory.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_COMPOSITOR_GPU_PROCESS_TRANSPORT_FACTORY_H_
 #define CONTENT_BROWSER_COMPOSITOR_GPU_PROCESS_TRANSPORT_FACTORY_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 90 matching lines @@
 
   void OnLostMainThreadSharedContextInsideCallback();
   void OnLostMainThreadSharedContext();
 
   scoped_refptr<cc::VulkanInProcessContextProvider>
   SharedVulkanContextProvider();
 
   std::unique_ptr<cc::SurfaceManager> surface_manager_;
   uint32_t next_surface_client_id_ = 1u;
 
+#if defined(OS_WIN)
+  // Used by output surface, stored in PerCompositorData.
+  std::unique_ptr<OutputDeviceBacking> software_backing_;
+#endif
+
   // Depends on SurfaceManager.
   typedef std::map<ui::Compositor*, std::unique_ptr<PerCompositorData>>
       PerCompositorDataMap;
   PerCompositorDataMap per_compositor_data_;
 
   scoped_refptr<ContextProviderCommandBuffer> shared_main_thread_contexts_;
   std::unique_ptr<display_compositor::GLHelper> gl_helper_;
   base::ObserverList<ui::ContextFactoryObserver> observer_list_;
   std::unique_ptr<cc::SingleThreadTaskGraphRunner> task_graph_runner_;
   scoped_refptr<ContextProviderCommandBuffer> shared_worker_context_provider_;
 
   bool shared_vulkan_context_provider_initialized_ = false;
   scoped_refptr<cc::VulkanInProcessContextProvider>
       shared_vulkan_context_provider_;
 
   gpu::GpuChannelEstablishFactory* gpu_channel_factory_ = nullptr;
 
-#if defined(OS_WIN)
-  std::unique_ptr<OutputDeviceBacking> software_backing_;
-#endif
   base::WeakPtrFactory<GpuProcessTransportFactory> callback_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(GpuProcessTransportFactory);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_COMPOSITOR_GPU_PROCESS_TRANSPORT_FACTORY_H_