Made RenderView keep track of the fake plugin window handles it

allocates for the compositor and accelerated plugins, and clean them
up upon destruction. Guarded against potentially NULL RenderView in
WebGraphicsContext3DCommandBufferImpl's destructor.

Verified by loading http://twitter.com/henrikbennetsen# on Mac OS X,
then repeatedly clicking WebGL demos and closing them and verifying
that there are no renderer crashes.

BUG=58554
TEST=none

Review URL: http://codereview.chromium.org/3808004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@62484 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 31 insertions, 4 deletions

diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 5bf7827..8ab1daa 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -491,6 +491,14 @@ RenderView::~RenderView() {
   // Tell the spellchecker that the document is closed.
   if (has_document_tag_)
     Send(new ViewHostMsg_DocumentWithTagClosed(routing_id_, document_tag_));
+
+  // Destroy all fake plugin window handles on the browser side.
+  while (!fake_plugin_window_handles_.empty()) {
+    // Make sure no NULL plugin window handles were inserted into this list.
+    DCHECK(*fake_plugin_window_handles_.begin());
+    // DestroyFakePluginWindowHandle modifies fake_plugin_window_handles_.
+    DestroyFakePluginWindowHandle(*fake_plugin_window_handles_.begin());
+  }
 #endif
 
   render_thread_->RemoveFilter(audio_message_filter_);
@@ -5786,12 +5794,18 @@ gfx::PluginWindowHandle RenderView::AllocateFakePluginWindowHandle(
   gfx::PluginWindowHandle window = NULL;
   Send(new ViewHostMsg_AllocateFakePluginWindowHandle(
       routing_id(), opaque, root, &window));
+  if (window) {
+    fake_plugin_window_handles_.insert(window);
+  }
   return window;
 }
 
 void RenderView::DestroyFakePluginWindowHandle(gfx::PluginWindowHandle window) {
-  if (window)
+  if (window && fake_plugin_window_handles_.find(window) !=
+      fake_plugin_window_handles_.end()) {
     Send(new ViewHostMsg_DestroyFakePluginWindowHandle(routing_id(), window));
+    fake_plugin_window_handles_.erase(window);
+  }
 }
 
 void RenderView::AcceleratedSurfaceSetIOSurface(gfx::PluginWindowHandle window,
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index 3124c98..95766c1 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -1217,6 +1217,13 @@ class RenderView : public RenderWidget,
   // https://bugs.webkit.org/show_bug.cgi?id=32807.
   base::RepeatingTimer<RenderView> preferred_size_change_timer_;
 
+#if defined(OS_MACOSX)
+  // Track the fake plugin window handles allocated on the browser side for
+  // the accelerated compositor and (currently) accelerated plugins so that
+  // we can discard them when the view goes away.
+  std::set<gfx::PluginWindowHandle> fake_plugin_window_handles_;
+#endif
+
   // Plugins -------------------------------------------------------------------
 
   // Remember the first uninstalled plugin, so that we can ask the plugin
diff --git a/chrome/renderer/webgraphicscontext3d_command_buffer_impl.cc b/chrome/renderer/webgraphicscontext3d_command_buffer_impl.cc
index 2933472..8254c290 100644
--- a/chrome/renderer/webgraphicscontext3d_command_buffer_impl.cc
+++ b/chrome/renderer/webgraphicscontext3d_command_buffer_impl.cc
@@ -38,9 +38,14 @@ WebGraphicsContext3DCommandBufferImpl::
     ~WebGraphicsContext3DCommandBufferImpl() {
 #if defined(OS_MACOSX)
   if (web_view_) {
-    RenderView* renderview = RenderView::FromWebView(web_view_);
     DCHECK(plugin_handle_ != gfx::kNullPluginWindow);
-    renderview->DestroyFakePluginWindowHandle(plugin_handle_);
+    RenderView* renderview = RenderView::FromWebView(web_view_);
+    // The RenderView might already have been freed, but in its
+    // destructor it destroys all fake plugin window handles it
+    // allocated.
+    if (renderview) {
+      renderview->DestroyFakePluginWindowHandle(plugin_handle_);
+    }
     plugin_handle_ = gfx::kNullPluginWindow;
   }
 #endif
@@ -190,7 +195,8 @@ bool WebGraphicsContext3DCommandBufferImpl::isGLES2NPOTStrict() {
   return false;
 }
 
-bool WebGraphicsContext3DCommandBufferImpl::isErrorGeneratedOnOutOfBoundsAccesses() {
+bool WebGraphicsContext3DCommandBufferImpl::
+    isErrorGeneratedOnOutOfBoundsAccesses() {
   return false;
 }