Fix crash in taking a screenshot of a closed popup

You can't assume that there's a root layer always during layout, even if
there's a composite and readback.  WebTestProxyBase::CapturePixelsAsync
iterates through popups (which may get closed between that call and
Layout).  If it's closed, then its root layer goes away.

BUG=470817

Review URL: https://codereview.chromium.org/1038133003

Cr-Commit-Position: refs/heads/master@{#322611}

1 files changed, 10 insertions, 5 deletions

diff --git a/content/renderer/gpu/render_widget_compositor.cc b/content/renderer/gpu/render_widget_compositor.cc
index 56e655c..611ed02 100644
--- a/content/renderer/gpu/render_widget_compositor.cc
+++ b/content/renderer/gpu/render_widget_compositor.cc
@@ -705,8 +705,8 @@ void RenderWidgetCompositor::compositeAndReadbackAsync(
       cc::CopyOutputRequest::CreateBitmapRequest(
           base::Bind(&CompositeAndReadbackAsyncCallback, callback));
   // Force a commit to happen. The temporary copy output request will
-  // be installed after layout which will happen as a part of the commit, when
-  // there is guaranteed to be a root layer.
+  // be installed after layout which will happen as a part of the commit, for
+  // widgets that delay the creation of their output surface.
   bool threaded = !!compositor_deps_->GetCompositorImplThreadTaskRunner().get();
   if (!threaded &&
       !layer_tree_host_->settings().single_thread_proxy_scheduler) {
@@ -798,9 +798,14 @@ void RenderWidgetCompositor::Layout() {
   widget_->webwidget()->layout();
 
   if (temporary_copy_output_request_) {
-    DCHECK(layer_tree_host_->root_layer());
-    layer_tree_host_->root_layer()->RequestCopyOfOutput(
-        temporary_copy_output_request_.Pass());
+    // For WebViewImpl, this will always have a root layer.  For other widgets,
+    // the widget may be closed before servicing this request, so ignore it.
+    if (cc::Layer* root_layer = layer_tree_host_->root_layer()) {
+      root_layer->RequestCopyOfOutput(temporary_copy_output_request_.Pass());
+    } else {
+      temporary_copy_output_request_->SendEmptyResult();
+      temporary_copy_output_request_ = nullptr;
+    }
   }
 }