CHECK that the RendererCompositorFrameSink has been detached

content/renderer/gpu/renderer_compositor_frame_sink.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/gpu/renderer_compositor_frame_sink.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/location.h"
@@ skipping 56 matching lines @@
       frame_swap_message_queue_(swap_frame_message_queue),
       begin_frame_source_(std::move(begin_frame_source)),
       routing_id_(routing_id) {
   DCHECK(compositor_frame_sink_filter_);
   DCHECK(frame_swap_message_queue_);
   DCHECK(message_sender_);
   DCHECK(begin_frame_source_);
   thread_checker_.DetachFromThread();
 }
 
-RendererCompositorFrameSink::~RendererCompositorFrameSink() = default;
+RendererCompositorFrameSink::~RendererCompositorFrameSink() {
+  // TODO(crbug.com/702764): If not detached then IPC messages would crash
+  // after this class is destroyed.
+  CHECK(!bound_);
+}
 
 bool RendererCompositorFrameSink::BindToClient(
     cc::CompositorFrameSinkClient* client) {
   DCHECK(thread_checker_.CalledOnValidThread());
   if (!cc::CompositorFrameSink::BindToClient(client))
     return false;
 
   DCHECK(begin_frame_source_);
   client_->SetBeginFrameSource(begin_frame_source_.get());
 
   compositor_frame_sink_proxy_ = new RendererCompositorFrameSinkProxy(this);
   compositor_frame_sink_filter_handler_ =
       base::Bind(&RendererCompositorFrameSinkProxy::OnMessageReceived,
                  compositor_frame_sink_proxy_);
   compositor_frame_sink_filter_->AddHandlerOnCompositorThread(
       routing_id_, compositor_frame_sink_filter_handler_);
+  bound_ = true;
   return true;
 }
 
 void RendererCompositorFrameSink::DetachFromClient() {
   DCHECK(thread_checker_.CalledOnValidThread());
   client_->SetBeginFrameSource(nullptr);
   // Destroy the begin frame source on the same thread it was bound on.
   // The CompositorFrameSink itself is destroyed on the main thread.
   begin_frame_source_ = nullptr;
   compositor_frame_sink_proxy_->ClearCompositorFrameSink();
   compositor_frame_sink_filter_->RemoveHandlerOnCompositorThread(
       routing_id_, compositor_frame_sink_filter_handler_);
 
   cc::CompositorFrameSink::DetachFromClient();
+  bound_ = false;
 }
 
 void RendererCompositorFrameSink::SubmitCompositorFrame(
     cc::CompositorFrame frame) {
   {
     std::unique_ptr<FrameSwapMessageQueue::SendMessageScope>
         send_message_scope =
             frame_swap_message_queue_->AcquireSendMessageScope();
     std::vector<std::unique_ptr<IPC::Message>> messages;
     std::vector<IPC::Message> messages_to_deliver_with_frame;
@@ skipping 27 matching lines @@
   client_->ReclaimResources(resources);
   if (is_swap_ack)
     client_->DidReceiveCompositorFrameAck();
 }
 
 bool RendererCompositorFrameSink::Send(IPC::Message* message) {
   return message_sender_->Send(message);
 }
 
 }  // namespace content