aw: Check compositor pointer before use

android_webview/browser/browser_view_renderer.cc

Index: android_webview/browser/browser_view_renderer.cc
diff --git a/android_webview/browser/browser_view_renderer.cc b/android_webview/browser/browser_view_renderer.cc
index 8f21b165d17d91346f9c07a9730ef1caccb8c64f..579fc117cbfd144791b41b39304c81e302d39c2d 100644
--- a/android_webview/browser/browser_view_renderer.cc
+++ b/android_webview/browser/browser_view_renderer.cc
@@ -145,6 +145,9 @@ void BrowserViewRenderer::TrimMemory(const int level, const bool visible) {
     TRIM_MEMORY_BACKGROUND = 40,
   };
 
+  if (!compositor_ || !hardware_enabled_)
+    return;
+
   // Not urgent enough. TRIM_MEMORY_UI_HIDDEN is treated specially because
   // it does not indicate memory pressure, but merely that the app is
   // backgrounded.
@@ -192,6 +195,7 @@ BrowserViewRenderer::CalculateDesiredMemoryPolicy() {
 // well as the tile resource allocation in GlobalTileManager.
 void BrowserViewRenderer::RequestMemoryPolicy(
     SynchronousCompositorMemoryPolicy& new_policy) {
+  DCHECK(compositor_);
   GlobalTileManager* manager = GlobalTileManager::GetInstance();
 
   // The following line will call BrowserViewRenderer::SetMemoryPolicy().
@@ -317,6 +321,7 @@ void BrowserViewRenderer::UpdateParentDrawConstraints() {
 
 void BrowserViewRenderer::ReturnUnusedResource(
     scoped_ptr<cc::CompositorFrame> frame) {
+  DCHECK(compositor_);
   if (!frame.get())
     return;
 
@@ -328,6 +333,7 @@ void BrowserViewRenderer::ReturnUnusedResource(
 }
 
 void BrowserViewRenderer::ReturnResourceFromParent() {
+  DCHECK(compositor_);
   cc::CompositorFrameAck frame_ack;
   shared_renderer_state_->SwapReturnedResources(&frame_ack.resources);
   if (!frame_ack.resources.empty()) {
@@ -456,6 +462,7 @@ void BrowserViewRenderer::OnDetachedFromWindow() {
 }
 
 void BrowserViewRenderer::ReleaseHardware() {
+  DCHECK(compositor_);
   DCHECK(hardware_enabled_);
   ReturnUnusedResource(shared_renderer_state_->PassCompositorFrame());
   ReturnResourceFromParent();
@@ -491,9 +498,10 @@ void BrowserViewRenderer::DidDestroyCompositor(
     content::SynchronousCompositor* compositor) {
   TRACE_EVENT0("android_webview", "BrowserViewRenderer::DidDestroyCompositor");
   DCHECK(compositor_);
-  compositor_ = NULL;
   SynchronousCompositorMemoryPolicy zero_policy;
-  DCHECK(memory_policy_ == zero_policy);
+  RequestMemoryPolicy(zero_policy);
+  compositor_ = NULL;
+  hardware_enabled_ = false;

[boliu, 2014/10/17 22:59:26]

oh god that's so freaking wrong

[hush (inactive), 2014/10/17 23:04:15]

what do you mean? I thought what you did is replacing this line with
"CHECK(!hardware_enabled)" and hit the crash

[boliu, 2014/10/17 23:06:01]

CHECK was to see it actually happens, not the fix.

But this is totally the wrong fix too. I am ashamed..

 }
 
 void BrowserViewRenderer::SetContinuousInvalidate(bool invalidate) {