<webview> Destroy compositing helper when guest crashes to avoid returning wrong resources to the new guest renderer.

BUG=315847

Review URL: https://codereview.chromium.org/68893016

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@235197 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 14 insertions, 2 deletions

diff --git a/content/renderer/browser_plugin/browser_plugin.cc b/content/renderer/browser_plugin/browser_plugin.cc
index 4c74e35..943ad3b 100644
--- a/content/renderer/browser_plugin/browser_plugin.cc
+++ b/content/renderer/browser_plugin/browser_plugin.cc
@@ -447,6 +447,14 @@ void BrowserPlugin::OnGuestContentWindowReady(int guest_instance_id,
 void BrowserPlugin::OnGuestGone(int guest_instance_id) {
   guest_crashed_ = true;
 
+  // Turn off compositing so we can display the sad graphic. Changes to
+  // compositing state will show up at a later time after a layout and commit.
+  EnableCompositing(false);
+  if (compositing_helper_) {
+    compositing_helper_->OnContainerDestroy();
+    compositing_helper_ = NULL;
+  }
+
   // Queue up showing the sad graphic to give content embedders an opportunity
   // to fire their listeners and potentially overlay the webview with custom
   // behavior. If the BrowserPlugin is destroyed in the meantime, then the
@@ -745,8 +753,6 @@ void BrowserPlugin::ShowSadGraphic() {
   // NULL so we shouldn't attempt to access it.
   if (container_)
     container_->invalidate();
-  // Turn off compositing so we can display the sad graphic.
-  EnableCompositing(false);
 }
 
 void BrowserPlugin::ParseAttributes() {
diff --git a/content/renderer/browser_plugin/browser_plugin_compositing_helper.cc b/content/renderer/browser_plugin/browser_plugin_compositing_helper.cc
index 483861e..cd12541 100644
--- a/content/renderer/browser_plugin/browser_plugin_compositing_helper.cc
+++ b/content/renderer/browser_plugin/browser_plugin_compositing_helper.cc
@@ -186,6 +186,12 @@ void BrowserPluginCompositingHelper::OnContainerDestroy() {
     container_->setWebLayer(NULL);
   container_ = NULL;
 
+  if (resource_collection_) {
+    resource_collection_->LoseAllResources();
+    resource_collection_ = NULL;
+  }
+  ack_pending_ = false;
+  software_ack_pending_ = false;
   texture_layer_ = NULL;
   delegated_layer_ = NULL;
   background_layer_ = NULL;