Fix logic in GPUSwapChain::Neuter, fix destruction order in decoder

Fixing the first bug triggers the second bug. Second bug:

- WebGPUCommandBufferStub owns, and destroys in order:
 - MemoryTracker
 - parent class CommandBufferStub, which owns:
  - WebGPUDecoderImpl, which owns:
   - DawnDeviceAndWireServer, which owns:
    - SharedImageRepresentations, whose destructors call through
       a raw pointer to SharedImageRepresentationFactory's
       MemoryTypeTracker (this is okay)
       which calls through a raw pointer to WebGPUCommandBufferStub's
       MemoryTracker (not okay).
   - SharedImageRepresentationFactory, which owns:
    - MemoryTypeTracker, which holds
      a raw pointer to WebGPUCommandBufferStub's MemoryTracker
      (which can already be freed, as happens above).

This fix destroys the WebGPUDecoderImpl explicitly, before
destroying the MemoryTracker.

Bug: 852089
Change-Id: Id22126764be3f98db02bbc6b40e8de0f606fd2a2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2163150Reviewed-by: Peng Huang <penghuang@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Kai Ninomiya <kainino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#762134}

gpu/command_buffer/service/webgpu_decoder_impl.cc

@@ -330,7 +330,7 @@ class WebGPUDecoderImpl final : public WebGPUDecoder {
     NOTREACHED();
     return nullptr;
   }
-  void Destroy(bool have_context) override {}
+  void Destroy(bool have_context) override;
   bool MakeCurrent() override { return true; }
   gl::GLContext* GetGLContext() override { return nullptr; }
   gl::GLSurface* GetGLSurface() override {
@@ -614,6 +614,10 @@ WebGPUDecoderImpl::WebGPUDecoderImpl(
 }
 
 WebGPUDecoderImpl::~WebGPUDecoderImpl() {
+  Destroy(false);
+}
+
+void WebGPUDecoderImpl::Destroy(bool have_context) {
   dawn_device_and_wire_servers_.clear();
 }
 

gpu/ipc/service/webgpu_command_buffer_stub.cc

@@ -63,7 +63,12 @@ WebGPUCommandBufferStub::WebGPUCommandBufferStub(
                         stream_id,
                         route_id) {}
 
-WebGPUCommandBufferStub::~WebGPUCommandBufferStub() {}
+WebGPUCommandBufferStub::~WebGPUCommandBufferStub() {
+  // Must run before memory_tracker_ is destroyed.
+  decoder_context()->Destroy(false);
+
+  memory_tracker_ = nullptr;
+}
 
 gpu::ContextResult WebGPUCommandBufferStub::Initialize(
     CommandBufferStub* share_command_buffer_stub,

third_party/blink/renderer/modules/webgpu/gpu_swap_chain.cc

@@ -40,9 +40,7 @@ void GPUSwapChain::Trace(Visitor* visitor) {
 
 void GPUSwapChain::Neuter() {
   texture_ = nullptr;
-
-  DCHECK(swap_buffers_);
-  if (!swap_buffers_) {
+  if (swap_buffers_) {
     swap_buffers_->Neuter();
     swap_buffers_ = nullptr;
   }