Fix crashes in ui::Compositor on Mac.

content/browser/renderer_host/render_widget_host_view_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_mac.h"
 
 #import <objc/runtime.h>
 #include <OpenGL/gl.h>
 #include <QuartzCore/QuartzCore.h>
 
@@ skipping 540 matching lines @@
 
 RenderWidgetHostViewMac::~RenderWidgetHostViewMac() {
   gfx::Screen::GetScreenFor(cocoa_view_)->RemoveObserver(this);
 
   // This is being called from |cocoa_view_|'s destructor, so invalidate the
   // pointer.
   cocoa_view_ = nil;
 
   UnlockMouse();
 
+  // Ensure that the browser compositor is destroyed in a safe order.
+  ShutdownBrowserCompositor();
+
   // Make sure that the layer doesn't reach into the now-invalid object.
   DestroyCompositedIOSurfaceAndLayer();
   DestroySoftwareLayer();
 
   // We are owned by RenderWidgetHostViewCocoa, so if we go away before the
   // RenderWidgetHost does we need to tell it not to hold a stale pointer to
   // us.
   if (render_widget_host_)
     render_widget_host_->SetView(NULL);
 }
@@ skipping 82 matching lines @@
   delegated_frame_host_->AddedToWindow();
   delegated_frame_host_->WasShown(ui::LatencyInfo());
 }
 
 void RenderWidgetHostViewMac::DestroyBrowserCompositorView() {
   TRACE_EVENT0("browser",
                "RenderWidgetHostViewMac::DestroyBrowserCompositorView");
   if (!browser_compositor_view_)
     return;
 
+  // Marking the DelegatedFrameHost as removed from the window hierarchy is
+  // necessary to remove all connections to its old ui::Compositor.
   delegated_frame_host_->WasHidden();
   delegated_frame_host_->RemovingFromWindow();
   browser_compositor_view_.reset();
 }
 
 void RenderWidgetHostViewMac::EnsureSoftwareLayer() {
   TRACE_EVENT0("browser", "RenderWidgetHostViewMac::EnsureSoftwareLayer");
   if (software_layer_)
     return;
 
@@ skipping 462 matching lines @@
   fullscreen_window_manager_.reset();
   [pepper_fullscreen_window_ close];
 
   // This can be called as part of processing the window's responder
   // chain, for instance |-performKeyEquivalent:|.  In that case the
   // object needs to survive until the stack unwinds.
   pepper_fullscreen_window_.autorelease();
 
   // Delete the delegated frame state, which will reach back into
   // render_widget_host_.
-  DestroyBrowserCompositorView();
-  delegated_frame_host_.reset();
-  root_layer_.reset();
-  browser_compositor_view_placeholder_.reset();
+  ShutdownBrowserCompositor();
 
   // We get this call just before |render_widget_host_| deletes
   // itself.  But we are owned by |cocoa_view_|, which may be retained
   // by some other code.  Examples are WebContentsViewMac's
   // |latent_focus_view_| and TabWindowController's
   // |cachedContentView_|.
   render_widget_host_ = NULL;
 }
 
 // Called from the renderer to tell us what the tooltip text should be. It
@@ skipping 863 matching lines @@
 void RenderWidgetHostViewMac::ReleaseReferencesToSoftwareFrame() {
   DestroySoftwareLayer();
 }
 
 void RenderWidgetHostViewMac::ShutdownHost() {
   weak_factory_.InvalidateWeakPtrs();
   render_widget_host_->Shutdown();
   // Do not touch any members at this point, |this| has been deleted.
 }
 
+void RenderWidgetHostViewMac::ShutdownBrowserCompositor() {
+  DestroyBrowserCompositorView();
+  delegated_frame_host_.reset();
+  root_layer_.reset();
+  browser_compositor_view_placeholder_.reset();
+}
+
 void RenderWidgetHostViewMac::GotAcceleratedFrame() {
   EnsureCompositedIOSurfaceLayer();
   SendVSyncParametersToRenderer();
 
   // Delete software backingstore and layer.
   software_frame_manager_->DiscardCurrentFrame();
   DestroySoftwareLayer();
 }
 
 void RenderWidgetHostViewMac::GotSoftwareFrame() {
@@ skipping 2019 matching lines @@
 
 // "-webkit-app-region: drag | no-drag" is implemented on Mac by excluding
 // regions that are not draggable. (See ControlRegionView in
 // native_app_window_cocoa.mm). This requires the render host view to be
 // draggable by default.
 - (BOOL)mouseDownCanMoveWindow {
   return YES;
 }
 
 @end