Fix crashes in ui::Compositor on Mac.

content/browser/renderer_host/render_widget_host_view_mac.mm

Index: content/browser/renderer_host/render_widget_host_view_mac.mm
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index bc89f8e80f87d2e9eaec9ff9d99a3e31f23ae6b7..ae9b31eb9e31587bed78a21050abb2e7a7e92d33 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -558,6 +558,9 @@ RenderWidgetHostViewMac::~RenderWidgetHostViewMac() {
 
   UnlockMouse();
 
+  // Ensure that the browser compositor is destroyed in a safe order.
+  ShutdownBrowserCompositor();
+
   // Make sure that the layer doesn't reach into the now-invalid object.
   DestroyCompositedIOSurfaceAndLayer();
   DestroySoftwareLayer();
@@ -660,6 +663,8 @@ void RenderWidgetHostViewMac::DestroyBrowserCompositorView() {
   if (!browser_compositor_view_)
     return;
 
+  // Marking the DelegatedFrameHost as removed from the window hierarchy is
+  // necessary to remove all connections to its old ui::Compositor.
   delegated_frame_host_->WasHidden();
   delegated_frame_host_->RemovingFromWindow();
   browser_compositor_view_.reset();
@@ -1142,10 +1147,7 @@ void RenderWidgetHostViewMac::Destroy() {
 
   // Delete the delegated frame state, which will reach back into
   // render_widget_host_.
-  DestroyBrowserCompositorView();
-  delegated_frame_host_.reset();
-  root_layer_.reset();
-  browser_compositor_view_placeholder_.reset();
+  ShutdownBrowserCompositor();
 
   // We get this call just before |render_widget_host_| deletes
   // itself.  But we are owned by |cocoa_view_|, which may be retained
@@ -2029,6 +2031,13 @@ void RenderWidgetHostViewMac::ShutdownHost() {
   // Do not touch any members at this point, |this| has been deleted.
 }
 
+void RenderWidgetHostViewMac::ShutdownBrowserCompositor() {
+  DestroyBrowserCompositorView();
+  delegated_frame_host_.reset();
+  root_layer_.reset();
+  browser_compositor_view_placeholder_.reset();
+}
+
 void RenderWidgetHostViewMac::GotAcceleratedFrame() {
   EnsureCompositedIOSurfaceLayer();
   SendVSyncParametersToRenderer();