Fixed some bugs that prevented the GPU plugin from shutting down without crashing.

TEST=trybots
BUG=none

Review URL: http://codereview.chromium.org/529004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@35819 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 17 insertions, 9 deletions

diff --git a/chrome/renderer/webplugin_delegate_pepper.cc b/chrome/renderer/webplugin_delegate_pepper.cc
index 4c32b7b..0686a56 100644
--- a/chrome/renderer/webplugin_delegate_pepper.cc
+++ b/chrome/renderer/webplugin_delegate_pepper.cc
@@ -129,6 +129,15 @@ void WebPluginDelegatePepper::DestroyInstance() {
 
     instance_ = 0;
   }
+
+  // Destroy the nested GPU plugin only after first destroying the underlying
+  // Pepper plugin. This is so the Pepper plugin does not attempt to issue
+  // rendering commands after the GPU plugin has stopped processing them and
+  // responding to them.
+  if (nested_delegate_) {
+    nested_delegate_->PluginDestroyed();
+    nested_delegate_ = NULL;
+  }
 }
 
 void WebPluginDelegatePepper::UpdateGeometry(
@@ -579,10 +588,6 @@ WebPluginDelegatePepper::~WebPluginDelegatePepper() {
 }
 
 void WebPluginDelegatePepper::PluginDestroyed() {
-  if (nested_delegate_) {
-    nested_delegate_->PluginDestroyed();
-    nested_delegate_ = NULL;
-  }
   delete this;
 }
 
diff --git a/gpu/command_buffer/client/gles2_implementation.cc b/gpu/command_buffer/client/gles2_implementation.cc
index f792977..0b1f341 100644
--- a/gpu/command_buffer/client/gles2_implementation.cc
+++ b/gpu/command_buffer/client/gles2_implementation.cc
@@ -40,6 +40,10 @@ GLES2Implementation::GLES2Implementation(
   result_shm_offset_ = transfer_buffer_.GetOffset(result_buffer_);
 }
 
+GLES2Implementation::~GLES2Implementation() {
+  transfer_buffer_.Free(result_buffer_);
+}
+
 void GLES2Implementation::MakeIds(GLsizei n, GLuint* ids) {
   for (GLsizei ii = 0; ii < n; ++ii) {
     ids[ii] = id_allocator_.AllocateID();
diff --git a/gpu/command_buffer/client/gles2_implementation.h b/gpu/command_buffer/client/gles2_implementation.h
index 6415d67..35776704 100644
--- a/gpu/command_buffer/client/gles2_implementation.h
+++ b/gpu/command_buffer/client/gles2_implementation.h
@@ -27,6 +27,8 @@ class GLES2Implementation {
       void* transfer_buffer,
       int32 transfer_buffer_id);
 
+  ~GLES2Implementation();
+
   // The GLES2CmdHelper being used by this GLES2Implementation. You can use
   // this to issue cmds at a lower level for certain kinds of optimization.
   GLES2CmdHelper* helper() const {
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index ade16c6..282fb99 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -1148,8 +1148,7 @@ GLenum GLES2DecoderImpl::GetGLError() {
   // Check the GL error first, then our wrapped error.
   GLenum error = glGetError();
   if (error == GL_NO_ERROR && error_bits_ != 0) {
-    uint32 mask = 1;
-    while (mask) {
+    for (uint32 mask = 1; mask != 0; mask = mask << 1) {
       if ((error_bits_ & mask) != 0) {
         error = GLErrorBitToGLError(mask);
         break;
diff --git a/webkit/tools/pepper_test_plugin/plugin_object.h b/webkit/tools/pepper_test_plugin/plugin_object.h
index 4dcff15..a248f48 100644
--- a/webkit/tools/pepper_test_plugin/plugin_object.h
+++ b/webkit/tools/pepper_test_plugin/plugin_object.h
@@ -59,11 +59,9 @@ class PluginObject {
 
   NPDevice* device2d_;
 
-  // TODO(apatrick): this destruction order causes the plugin to crash on
-  // shutdown.
   scoped_ptr<CommandBufferPepper> command_buffer_;
-  scoped_ptr<gpu::gles2::GLES2Implementation> gles2_implementation_;
   scoped_ptr<gpu::gles2::GLES2CmdHelper> helper_;
+  scoped_ptr<gpu::gles2::GLES2Implementation> gles2_implementation_;
 
   gfx::Size size_;