Avoid destroying surface before the parent surface stops referencing it.

cc/surfaces/surface_aggregator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/surfaces/surface_aggregator.h"
 
 #include "base/bind.h"
 #include "base/containers/hash_tables.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
@@ skipping 40 matching lines @@
   base::hash_map<RenderPassId, int> id_to_index_map_;
   SurfaceId surface_id_;
   int next_index_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderPassIdAllocator);
 };
 
 static void UnrefHelper(base::WeakPtr<SurfaceFactory> surface_factory,
                         const ReturnedResourceArray& resources,
                         BlockingTaskRunner* main_thread_task_runner) {
-  surface_factory->UnrefResources(resources);
+  if (surface_factory)

[jamesr, 2014/09/12 01:08:55]

whoops

+    surface_factory->UnrefResources(resources);
 }
 
 RenderPassId SurfaceAggregator::RemapPassId(RenderPassId surface_local_pass_id,
                                             SurfaceId surface_id) {
   RenderPassIdAllocator* allocator = render_pass_allocator_map_.get(surface_id);
   if (!allocator) {
     allocator = new RenderPassIdAllocator(surface_id);
     render_pass_allocator_map_.set(surface_id, make_scoped_ptr(allocator));
   }
   allocator->AddKnownPass(surface_local_pass_id);
@@ skipping 289 matching lines @@
       surface->TakeLatencyInfo(&frame->metadata.latency_info);
   }
 
   // TODO(jamesr): Aggregate all resource references into the returned frame's
   // resource list.
 
   return frame.Pass();
 }
 
 }  // namespace cc