3 files changed, 31 insertions, 4 deletions
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 5bf7827..8ab1daa 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -491,6 +491,14 @@ RenderView::~RenderView() {
   // Tell the spellchecker that the document is closed.
   if (has_document_tag_)
     Send(new ViewHostMsg_DocumentWithTagClosed(routing_id_, document_tag_));
+
+  // Destroy all fake plugin window handles on the browser side.
+  while (!fake_plugin_window_handles_.empty()) {
+    // Make sure no NULL plugin window handles were inserted into this list.
+    DCHECK(*fake_plugin_window_handles_.begin());
+    // DestroyFakePluginWindowHandle modifies fake_plugin_window_handles_.
+    DestroyFakePluginWindowHandle(*fake_plugin_window_handles_.begin());
+  }
 #endif
 
   render_thread_->RemoveFilter(audio_message_filter_);
@@ -5786,12 +5794,18 @@ gfx::PluginWindowHandle RenderView::AllocateFakePluginWindowHandle(
   gfx::PluginWindowHandle window = NULL;
   Send(new ViewHostMsg_AllocateFakePluginWindowHandle(
       routing_id(), opaque, root, &window));
+  if (window) {
+    fake_plugin_window_handles_.insert(window);
+  }
   return window;
 }
 
 void RenderView::DestroyFakePluginWindowHandle(gfx::PluginWindowHandle window) {
-  if (window)
+  if (window && fake_plugin_window_handles_.find(window) !=
+      fake_plugin_window_handles_.end()) {
     Send(new ViewHostMsg_DestroyFakePluginWindowHandle(routing_id(), window));
+    fake_plugin_window_handles_.erase(window);
+  }
 }
 
 void RenderView::AcceleratedSurfaceSetIOSurface(gfx::PluginWindowHandle window,
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index 3124c98..95766c1 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -1217,6 +1217,13 @@ class RenderView : public RenderWidget,
   // https://bugs.webkit.org/show_bug.cgi?id=32807.
   base::RepeatingTimer<RenderView> preferred_size_change_timer_;
 
+#if defined(OS_MACOSX)
+  // Track the fake plugin window handles allocated on the browser side for
+  // the accelerated compositor and (currently) accelerated plugins so that
+  // we can discard them when the view goes away.
+  std::set<gfx::PluginWindowHandle> fake_plugin_window_handles_;
+#endif
+
   // Plugins -------------------------------------------------------------------
 
   // Remember the first uninstalled plugin, so that we can ask the plugin
diff --git a/chrome/renderer/webgraphicscontext3d_command_buffer_impl.cc b/chrome/renderer/webgraphicscontext3d_command_buffer_impl.cc
index 2933472..8254c290 100644
--- a/chrome/renderer/webgraphicscontext3d_command_buffer_impl.cc
+++ b/chrome/renderer/webgraphicscontext3d_command_buffer_impl.cc
@@ -38,9 +38,14 @@ WebGraphicsContext3DCommandBufferImpl::
     ~WebGraphicsContext3DCommandBufferImpl() {
 #if defined(OS_MACOSX)
   if (web_view_) {
-    RenderView* renderview = RenderView::FromWebView(web_view_);
     DCHECK(plugin_handle_ != gfx::kNullPluginWindow);
-    renderview->DestroyFakePluginWindowHandle(plugin_handle_);
+    RenderView* renderview = RenderView::FromWebView(web_view_);
+    // The RenderView might already have been freed, but in its
+    // destructor it destroys all fake plugin window handles it
+    // allocated.
+    if (renderview) {
+      renderview->DestroyFakePluginWindowHandle(plugin_handle_);
+    }
     plugin_handle_ = gfx::kNullPluginWindow;
   }
 #endif
@@ -190,7 +195,8 @@ bool WebGraphicsContext3DCommandBufferImpl::isGLES2NPOTStrict() {
   return false;
 }
 
-bool WebGraphicsContext3DCommandBufferImpl::isErrorGeneratedOnOutOfBoundsAccesses() {
+bool WebGraphicsContext3DCommandBufferImpl::
+    isErrorGeneratedOnOutOfBoundsAccesses() {
   return false;
 }