Delay GpuCommandBufferStub::AddDestructionObserver until we need it.

In certain failure cases at initialization time (caused by a race) we used to call
AddDestructionObserver before we would make the surface current, causing us to
destroy the surface before OnWillDestroyStub had a chance to be called, so we
wouldn't RemoveDestructionObserver and we'd call into a dead pointer.

This fixes it. By the time MakeCurrent is called, we know we have a ref to the
surface and it won't destroy it until GpuCommandBufferStub::Destroy, after
OnWillDestroyStub is called.

BUG=140502
TEST=attach debugger to renderer, add a breakpoint to CommandBufferProxyImpl::Initialize, right-click and "view page source" (breakpoint should hit), kill new tab, and only then continue breakpoint. Observe no GPU process crash.

Review URL: https://chromiumcodereview.appspot.com/10831169

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@150227 0039d316-1c4b-4281-b951-d872f2087c98

content/common/gpu/image_transport_surface.h

@@ -131,6 +131,7 @@ class ImageTransportHelper : public IPC::Listener {
   void Suspend();
 
   GpuChannelManager* manager() const { return manager_; }
+  GpuCommandBufferStub* stub() const { return stub_.get(); }
 
  private:
   gpu::GpuScheduler* Scheduler();

content/common/gpu/texture_image_transport_surface.cc

@@ -47,8 +47,6 @@ TextureImageTransportSurface::TextureImageTransportSurface(
                                          manager,
                                          stub,
                                          gfx::kNullPluginWindow));
-
-  stub->AddDestructionObserver(this);
 }
 
 TextureImageTransportSurface::~TextureImageTransportSurface() {
@@ -134,9 +132,13 @@ bool TextureImageTransportSurface::OnMakeCurrent(gfx::GLContext* context) {
     GLenum status = glCheckFramebufferStatusEXT(GL_FRAMEBUFFER);
     if (status != GL_FRAMEBUFFER_COMPLETE) {
       DLOG(ERROR) << "Framebuffer incomplete.";
+      glDeleteFramebuffersEXT(1, &fbo_id_);
+      fbo_id_ = 0;
       return false;
     }
 #endif
+    DCHECK(helper_->stub());
+    helper_->stub()->AddDestructionObserver(this);
   }
 
   return true;
@@ -208,6 +210,7 @@ void TextureImageTransportSurface::OnWillDestroyStub(
     ReleaseParentStub();
     helper_->SetPreemptByCounter(NULL);
   } else {
+    DCHECK(stub == helper_->stub());
     stub->RemoveDestructionObserver(this);
 
     // We are losing the stub owning us, this is our last chance to clean up the