Index: content/browser/renderer_host/render_widget_host_view_android.cc |
diff --git a/content/browser/renderer_host/render_widget_host_view_android.cc b/content/browser/renderer_host/render_widget_host_view_android.cc |
index 3d5e597188c7408a5d07df7f34927b96ab9a78e0..6c6b0064e1f6deeae4bbbd0a41e2b70768779eea 100644 |
--- a/content/browser/renderer_host/render_widget_host_view_android.cc |
+++ b/content/browser/renderer_host/render_widget_host_view_android.cc |
@@ -1144,6 +1144,14 @@ void RenderWidgetHostViewAndroid::ReclaimResources( |
void RenderWidgetHostViewAndroid::DidCreateNewRendererCompositorFrameSink( |
cc::mojom::MojoCompositorFrameSinkClient* renderer_compositor_frame_sink) { |
+ if (!delegated_frame_host_) { |
+ DCHECK(!using_browser_compositor_); |
+ // We don't expect RendererCompositorFrameSink on Android WebView. |
+ // (crbug.com/721102) |
+ bad_message::ReceivedBadMessage(host_->GetProcess(), |
+ bad_message::RWH_BAD_FRAME_SINK_REQUEST); |
+ return; |
+ } |
delegated_frame_host_->CompositorFrameSinkChanged(); |
renderer_compositor_frame_sink_ = renderer_compositor_frame_sink; |
// Accumulated resources belong to the old RendererCompositorFrameSink and |
@@ -1154,8 +1162,12 @@ void RenderWidgetHostViewAndroid::DidCreateNewRendererCompositorFrameSink( |
void RenderWidgetHostViewAndroid::SubmitCompositorFrame( |
const cc::LocalSurfaceId& local_surface_id, |
cc::CompositorFrame frame) { |
+ if (!delegated_frame_host_) { |
+ DCHECK(!using_browser_compositor_); |
+ return; |
+ } |
+ |
last_scroll_offset_ = frame.metadata.root_scroll_offset; |
- DCHECK(delegated_frame_host_); |
DCHECK(!frame.render_pass_list.empty()); |
cc::RenderPass* root_pass = frame.render_pass_list.back().get(); |