GPUChannelHost should be cleared before shutting down Blink

content/renderer/render_thread_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_thread_impl.h"
 
 #include <algorithm>
 #include <limits>
 #include <map>
 #include <vector>
@@ skipping 726 matching lines @@
   // EmbeddedWorkerDispatcher. So it must be deleted before deleting
   // RenderThreadImpl.
   embedded_worker_dispatcher_.reset();
 
   // Ramp down IDB before we ramp down WebKit (and V8), since IDB classes might
   // hold pointers to V8 objects (e.g., via pending requests).
   main_thread_indexed_db_dispatcher_.reset();
 
   main_thread_compositor_task_runner_ = NULL;
 
-  if (gpu_channel_.get())
+  gpu_va_context_provider_ = NULL;
+
+  if (gpu_channel_.get()) {
     gpu_channel_->DestroyChannel();
+    gpu_channel_ = NULL;
+  }
 
   // TODO(port)
 #if defined(OS_WIN)
   // Clean up plugin channels before this thread goes away.
   NPChannelBase::CleanupChannels();
 #endif
 
   // Shut down the message loop before shutting down Blink.
   // This prevents a scenario where a pending task in the message loop accesses
   // Blink objects after Blink shuts down.
@@ skipping 1016 matching lines @@
   hidden_widget_count_--;
 
   if (!GetContentClient()->renderer()->RunIdleHandlerWhenWidgetsHidden()) {
     return;
   }
 
   ScheduleIdleHandler(kLongIdleHandlerDelayMs);
 }
 
 }  // namespace content