[Merge M54] aw: Fix effective frame source leak after detach

android_webview/browser/hardware_renderer.cc

Index: android_webview/browser/hardware_renderer.cc
diff --git a/android_webview/browser/hardware_renderer.cc b/android_webview/browser/hardware_renderer.cc
index 45b589f163e112670148d8e7f2fb1803f97d31e6..ec671a7e0a61779f2f2cc814497339227721725b 100644
--- a/android_webview/browser/hardware_renderer.cc
+++ b/android_webview/browser/hardware_renderer.cc
@@ -13,6 +13,7 @@
 #include "android_webview/browser/render_thread_manager.h"
 #include "android_webview/browser/surfaces_instance.h"
 #include "android_webview/public/browser/draw_gl.h"
+#include "base/memory/ptr_util.h"
 #include "base/trace_event/trace_event.h"
 #include "cc/output/compositor_frame.h"
 #include "cc/surfaces/surface_factory.h"
@@ -154,6 +155,14 @@ void HardwareRenderer::AllocateSurface() {
 void HardwareRenderer::DestroySurface() {
   DCHECK(!child_id_.is_null());
   DCHECK(surface_factory_);
+
+  // Submit an empty frame to force any existing resources to be returned.
+  cc::CompositorFrame empty_frame;
+  empty_frame.delegated_frame_data =
+      base::WrapUnique(new cc::DelegatedFrameData);
+  surface_factory_->SubmitCompositorFrame(child_id_, std::move(empty_frame),
+                                          cc::SurfaceFactory::DrawCallback());
+
   surfaces_->RemoveChildId(child_id_);
   surface_factory_->Destroy(child_id_);
   child_id_ = cc::SurfaceId();