GitLab

Fixing the first bug triggers the second bug. Second bug:

- WebGPUCommandBufferStub owns, and destroys in order:
 - MemoryTracker
 - parent class CommandBufferStub, which owns:
  - WebGPUDecoderImpl, which owns:
   - DawnDeviceAndWireServer, which owns:
    - SharedImageRepresentations, whose destructors call through
       a raw pointer to SharedImageRepresentationFactory's
       MemoryTypeTracker (this is okay)
       which calls through a raw pointer to WebGPUCommandBufferStub's
       MemoryTracker (not okay).
   - SharedImageRepresentationFactory, which owns:
    - MemoryTypeTracker, which holds
      a raw pointer to WebGPUCommandBufferStub's MemoryTracker
      (which can already be freed, as happens above).

This fix destroys the WebGPUDecoderImpl explicitly, before
destroying the MemoryTracker.

Bug: 852089
Change-Id: Id22126764be3f98db02bbc6b40e8de0f606fd2a2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2163150Reviewed-by: Peng Huang <penghuang@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Kai Ninomiya <kainino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#762134}