Fix SurfaceResourceHolder destruction order

cc::Surface instances in the surface map have raw pointers to the
surface holder, so the holder needs to outlive the map.

BUG=417325

Review URL: https://codereview.chromium.org/603703002

Cr-Commit-Position: refs/heads/master@{#296486}

2 files changed, 18 insertions, 2 deletions

diff --git a/cc/surfaces/surface_factory.h b/cc/surfaces/surface_factory.h
index 0a2ece7..2516015 100644
--- a/cc/surfaces/surface_factory.h
+++ b/cc/surfaces/surface_factory.h
@@ -55,11 +55,11 @@ class CC_SURFACES_EXPORT SurfaceFactory
  private:
   SurfaceManager* manager_;
   SurfaceFactoryClient* client_;
+  SurfaceResourceHolder holder_;
+
   typedef base::ScopedPtrHashMap<SurfaceId, Surface> OwningSurfaceMap;
   base::ScopedPtrHashMap<SurfaceId, Surface> surface_map_;
 
-  SurfaceResourceHolder holder_;
-
   DISALLOW_COPY_AND_ASSIGN(SurfaceFactory);
 };
 
diff --git a/cc/surfaces/surface_factory_unittest.cc b/cc/surfaces/surface_factory_unittest.cc
index 0815636..a4aecf8 100644
--- a/cc/surfaces/surface_factory_unittest.cc
+++ b/cc/surfaces/surface_factory_unittest.cc
@@ -356,5 +356,21 @@ TEST_F(SurfaceFactoryTest, ResourceLifetime) {
   }
 }
 
+// Tests shutting down the factory with a surface with outstanding refs still in
+// the map.
+TEST_F(SurfaceFactoryTest, DestroyWithResourceRefs) {
+  SurfaceId id(7);
+  factory_.Create(id, gfx::Size(1, 1));
+
+  scoped_ptr<DelegatedFrameData> frame_data(new DelegatedFrameData);
+  TransferableResource resource;
+  resource.id = 1;
+  resource.mailbox_holder.texture_target = GL_TEXTURE_2D;
+  frame_data->resource_list.push_back(resource);
+  scoped_ptr<CompositorFrame> frame(new CompositorFrame);
+  frame->delegated_frame_data = frame_data.Pass();
+  factory_.SubmitFrame(id, frame.Pass(), base::Closure());
+}
+
 }  // namespace
 }  // namespace cc