media: Destroy ContextProvider on the right thread.

Make sure to retain a ref to the ContextProvider so that it gets
destroyed on the thread it is bound on.

BUG=898842

Change-Id: Iefcab772acb4cf530ff4a3e7c64e9b66e35b3f4e
Reviewed-on: https://chromium-review.googlesource.com/c/1304068Reviewed-by: Antoine Labour <piman@chromium.org>
Commit-Queue: Sadrul Chowdhury <sadrul@chromium.org>
Cr-Commit-Position: refs/heads/master@{#603547}

content/renderer/media/media_factory.cc

@@ -109,7 +109,10 @@ void PostContextProviderToCallback(
     scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
     scoped_refptr<viz::ContextProvider> unwanted_context_provider,
     blink::WebSubmitterConfigurationCallback set_context_provider_callback) {
-  main_task_runner->PostTask(
+  // |unwanted_context_provider| needs to be destroyed on the current thread.
+  // Therefore, post a reply-callback that retains a reference to it, so that it
+  // doesn't get destroyed on the main thread.
+  main_task_runner->PostTaskAndReply(
       FROM_HERE,
       base::BindOnce(
           [](scoped_refptr<viz::ContextProvider> unwanted_context_provider,
@@ -120,8 +123,11 @@ void PostContextProviderToCallback(
             std::move(cb).Run(!rti->IsGpuCompositingDisabled(),
                               std::move(context_provider));
           },
-          std::move(unwanted_context_provider),
-          media::BindToCurrentLoop(std::move(set_context_provider_callback))));
+          unwanted_context_provider,
+          media::BindToCurrentLoop(std::move(set_context_provider_callback))),
+      base::BindOnce(
+          [](scoped_refptr<viz::ContextProvider> unwanted_context_provider) {},
+          unwanted_context_provider));
 }
 
 }  // namespace