aw: Allow RootFrameSink outlive RootFrameSinkProxy

Reference to RootFrameSink is hold from RootFrameSinkProxy and HardwareRendererViz::OnViz.
As they can be destroyed in arbitrary order the assumption that RootFrameSinkProxy always live longer than RootFrameSink is invalid.

This CL fixes the issues about this assumption.

Bug: 805739
Change-Id: Idec2864de31d271651e52687e2821763efbd5fa8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2028657Reviewed-by: Bo <boliu@chromium.org>
Commit-Queue: Vasiliy Telezhnikov <vasilyt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#736552}

android_webview/browser/gfx/root_frame_sink.cc

@@ -69,6 +69,7 @@ void RootFrameSink::OnNeedsBeginFrames(bool needs_begin_frames) {
                        TRACE_EVENT_SCOPE_THREAD, "needs_begin_frames",
                        needs_begin_frames);
   needs_begin_frames_ = needs_begin_frames;
+  if (client_)
     client_->SetNeedsBeginFrames(needs_begin_frames);
 }
 
@@ -111,6 +112,7 @@ void RootFrameSink::SetNeedsDraw(bool needs_draw) {
   // It's possible that client submitted last frame and unsubscribed from
   // BeginFrames, but we haven't draw it yet.
   if (!needs_begin_frames_ && needs_draw) {
+    if (client_)
       client_->Invalidate();
   }
 }
@@ -123,8 +125,13 @@ void RootFrameSink::ReturnResources(
     viz::FrameSinkId frame_sink_id,
     uint32_t layer_tree_frame_sink_id,
     std::vector<viz::ReturnedResource> resources) {
+  if (client_)
     client_->ReturnResources(frame_sink_id, layer_tree_frame_sink_id,
                              std::move(resources));
 }
 
+void RootFrameSink::DettachClient() {
+  client_ = nullptr;
+}
+
 }  // namespace android_webview

android_webview/browser/gfx/root_frame_sink.h

@@ -55,6 +55,7 @@ class RootFrameSink : public base::RefCounted<RootFrameSink>,
   void SetBeginFrameSourcePaused(bool paused);
   void SetNeedsDraw(bool needs_draw);
   bool IsChildSurface(const viz::FrameSinkId& frame_sink_id);
+  void DettachClient();
 
   void ReturnResources(viz::FrameSinkId frame_sink_id,
                        uint32_t layer_tree_frame_sink_id,
@@ -84,7 +85,7 @@ class RootFrameSink : public base::RefCounted<RootFrameSink>,
 
   bool needs_begin_frames_ = false;
   bool needs_draw_ = false;
-  RootFrameSinkClient* const client_;
+  RootFrameSinkClient* client_;
 
   THREAD_CHECKER(thread_checker_);
 

android_webview/browser/gfx/root_frame_sink_proxy.cc

@@ -74,7 +74,7 @@ RootFrameSinkProxy::~RootFrameSinkProxy() {
 
 void RootFrameSinkProxy::DestroyOnViz() {
   DCHECK_CALLED_ON_VALID_THREAD(viz_thread_checker_);
-  DCHECK(without_gpu_->HasOneRef());
+  without_gpu_->DettachClient();
   without_gpu_.reset();
   weak_ptr_factory_on_viz_.InvalidateWeakPtrs();
   root_frame_sink_client_.reset();