Fix SurfaceResourceHolder destruction order

cc/surfaces/surface_factory_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/output/compositor_frame.h"
 #include "cc/output/delegated_frame_data.h"
 #include "cc/surfaces/surface.h"
 #include "cc/surfaces/surface_factory.h"
 #include "cc/surfaces/surface_factory_client.h"
 #include "cc/surfaces/surface_manager.h"
@@ skipping 338 matching lines @@
   {
     SCOPED_TRACE("fourth frame, second unref");
     ResourceProvider::ResourceId expected_returned_ids[] = {12, 13};
     int expected_returned_counts[] = {2, 2};
     CheckReturnedResourcesMatchExpected(expected_returned_ids,
                                         expected_returned_counts,
                                         arraysize(expected_returned_counts));
   }
 }
 
+// Tests shutting down the factory with a surface with outstanding refs still in
+// the map.
+TEST_F(SurfaceFactoryTest, DestroyWithResourceRefs) {
+  SurfaceId id(7);
+  factory_.Create(id, gfx::Size(1, 1));
+
+  scoped_ptr<DelegatedFrameData> frame_data(new DelegatedFrameData);
+  TransferableResource resource;
+  resource.id = 1;
+  resource.mailbox_holder.texture_target = GL_TEXTURE_2D;
+  frame_data->resource_list.push_back(resource);
+  scoped_ptr<CompositorFrame> frame(new CompositorFrame);
+  frame->delegated_frame_data = frame_data.Pass();
+  factory_.SubmitFrame(id, frame.Pass(), base::Closure());
+}
+
 }  // namespace
 }  // namespace cc