display compositor: Fix a use-after-free when a frame sink is destroyed.

services/ui/surfaces/display_compositor.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SERVICES_UI_SURFACES_DISPLAY_COMPOSITOR_H_
 #define SERVICES_UI_SURFACES_DISPLAY_COMPOSITOR_H_
 
 #include <stdint.h>
 
 #include <memory>
@@ skipping 81 matching lines @@
   void CreateCompositorFrameSinkInternal(
       const cc::FrameSinkId& frame_sink_id,
       gpu::SurfaceHandle surface_handle,
       std::unique_ptr<cc::Display> display,
       std::unique_ptr<cc::SyntheticBeginFrameSource> begin_frame_source,
       cc::mojom::MojoCompositorFrameSinkRequest request,
       cc::mojom::MojoCompositorFrameSinkPrivateRequest private_request,
       cc::mojom::MojoCompositorFrameSinkClientPtr client,
       cc::mojom::DisplayPrivateRequest display_private_request);
 
+  // It is necessary to pass |frame_sink_id| by value because the id
+  // is owned by the GpuCompositorFrameSink in the map. When the sink is
+  // removed from the map, |frame_sink_id| would also be destroyed if it were a
+  // reference. But the map can continue to iterate and try to use it. Passing
+  // by value avoids this.
+  void DestroyCompositorFrameSink(cc::FrameSinkId frame_sink_id);
+
   // cc::SurfaceObserver implementation.
   void OnSurfaceCreated(const cc::SurfaceInfo& surface_info) override;
   void OnSurfaceDamaged(const cc::SurfaceId& surface_id,
                         bool* changed) override;
 
   // SurfaceManager should be the first object constructed and the last object
   // destroyed in order to ensure that all other objects that depend on it have
   // access to a valid pointer for the entirety of their liftimes.
   cc::SurfaceManager manager_;
 
@@ skipping 13 matching lines @@
 
   cc::mojom::DisplayCompositorClientPtr client_;
   mojo::Binding<cc::mojom::DisplayCompositor> binding_;
 
   DISALLOW_COPY_AND_ASSIGN(DisplayCompositor);
 };
 
 }  // namespace ui
 
 #endif  //  SERVICES_UI_SURFACES_DISPLAY_COMPOSITOR_H_