Make SurfaceFactory lifetime match frame_sink_id_ registration in RWHVChildFrame

content/browser/frame_host/render_widget_host_view_child_frame.cc

Index: content/browser/frame_host/render_widget_host_view_child_frame.cc
diff --git a/content/browser/frame_host/render_widget_host_view_child_frame.cc b/content/browser/frame_host/render_widget_host_view_child_frame.cc
index 09d3d37d53c1d0784b864f1f20bdd7364ea9e411..34e4b33c0da4395a1c069598aa63d941fd9c4f70 100644
--- a/content/browser/frame_host/render_widget_host_view_child_frame.cc
+++ b/content/browser/frame_host/render_widget_host_view_child_frame.cc
@@ -62,7 +62,10 @@ RenderWidgetHostViewChildFrame::RenderWidgetHostViewChildFrame(
       begin_frame_source_(nullptr),
       weak_factory_(this) {
   id_allocator_.reset(new cc::SurfaceIdAllocator());
-  GetSurfaceManager()->RegisterFrameSinkId(frame_sink_id_);
+  auto* manager = GetSurfaceManager();
+  manager->RegisterFrameSinkId(frame_sink_id_);
+  surface_factory_ =
+      base::MakeUnique<cc::SurfaceFactory>(frame_sink_id_, manager, this);
 }
 
 RenderWidgetHostViewChildFrame::~RenderWidgetHostViewChildFrame() {
@@ -148,7 +151,7 @@ bool RenderWidgetHostViewChildFrame::HasFocus() const {
 }
 
 bool RenderWidgetHostViewChildFrame::IsSurfaceAvailableForCopy() const {
-  return surface_factory_ && !local_frame_id_.is_null();
+  return !local_frame_id_.is_null();
 }
 
 void RenderWidgetHostViewChildFrame::Show() {
@@ -383,27 +386,20 @@ void RenderWidgetHostViewChildFrame::OnSwapCompositorFrame(
   float scale_factor = frame.metadata.device_scale_factor;
 
   // Check whether we need to recreate the cc::Surface, which means the child
-  // frame renderer has changed its output surface, or size, or scale factor.
-  if (compositor_frame_sink_id != last_compositor_frame_sink_id_ &&
-      surface_factory_) {
-    surface_factory_->Destroy(local_frame_id_);
-    surface_factory_.reset();
-  }
+  // frame renderer has changed its frame sink, or size, or scale factor.
   if (compositor_frame_sink_id != last_compositor_frame_sink_id_ ||
       frame_size != current_surface_size_ ||
       scale_factor != current_surface_scale_factor_) {
     ClearCompositorSurfaceIfNecessary();
+    // If the renderer changed its frame sink, reset the surface factory to
+    // avoid returning stale resources.
+    if (compositor_frame_sink_id != last_compositor_frame_sink_id_)
+      surface_factory_->Reset();
     last_compositor_frame_sink_id_ = compositor_frame_sink_id;
     current_surface_size_ = frame_size;
     current_surface_scale_factor_ = scale_factor;
   }
 
-  if (!surface_factory_) {
-    cc::SurfaceManager* manager = GetSurfaceManager();
-    surface_factory_ =
-        base::MakeUnique<cc::SurfaceFactory>(frame_sink_id_, manager, this);
-  }
-
   if (local_frame_id_.is_null()) {
     local_frame_id_ = id_allocator_->GenerateId();
     surface_factory_->Create(local_frame_id_);
@@ -730,7 +726,7 @@ RenderWidgetHostViewChildFrame::CreateBrowserAccessibilityManager(
 }
 
 void RenderWidgetHostViewChildFrame::ClearCompositorSurfaceIfNecessary() {
-  if (surface_factory_ && !local_frame_id_.is_null())
+  if (!local_frame_id_.is_null())
     surface_factory_->Destroy(local_frame_id_);
   local_frame_id_ = cc::LocalFrameId();
 }