Fix viz crash when cleanup79-based

When we cleanup viz, OnConnectionLost will delete frame_sink_manger.
However we can still have messages to create sinks and to invalidate them
later when destroying compositor.

Do not create new frame sink, and do not invalidate them later.

Make possible to bail out in viz process transport factory as
compositor was already deleted.

Task-number: QTBUG-83040
Task-number: QTBUG-79864
Change-Id: Ibf0606368dfd81bc376a06721ada8d13cd8ea417
Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>

3 files changed, 20 insertions, 13 deletions

diff --git a/chromium/components/viz/host/host_frame_sink_manager.cc b/chromium/components/viz/host/host_frame_sink_manager.cc
index 4416414acf0..157902f8d1e 100644
--- a/chromium/components/viz/host/host_frame_sink_manager.cc
+++ b/chromium/components/viz/host/host_frame_sink_manager.cc
@@ -115,8 +115,8 @@ void HostFrameSinkManager::InvalidateFrameSinkId(
     // HostFrameSinkManager has been mutated. |data| might not be a valid
     // reference at this point.
   }
-
-  frame_sink_manager_->InvalidateFrameSinkId(frame_sink_id);
+  if (frame_sink_manager_)
+    frame_sink_manager_->InvalidateFrameSinkId(frame_sink_id);
 }
 
 void HostFrameSinkManager::EnableSynchronizationReporting(
@@ -147,7 +147,7 @@ void HostFrameSinkManager::SetFrameSinkDebugLabel(
 void HostFrameSinkManager::CreateRootCompositorFrameSink(
     mojom::RootCompositorFrameSinkParamsPtr params) {
   // Should only be used with an out-of-process display compositor.
-  DCHECK(frame_sink_manager_remote_);
+  DCHECK(frame_sink_manager_remote_ || !frame_sink_manager_);
 
   FrameSinkId frame_sink_id = params->frame_sink_id;
   FrameSinkData& data = frame_sink_data_map_[frame_sink_id];
@@ -160,10 +160,11 @@ void HostFrameSinkManager::CreateRootCompositorFrameSink(
                                                     base::DoNothing());
   }
 
-  data.is_root = true;
-  data.has_created_compositor_frame_sink = true;
-
-  frame_sink_manager_->CreateRootCompositorFrameSink(std::move(params));
+  if (frame_sink_manager_) {
+     data.is_root = true;
+     data.has_created_compositor_frame_sink = true;
+     frame_sink_manager_->CreateRootCompositorFrameSink(std::move(params));
+  }
   display_hit_test_query_[frame_sink_id] = std::make_unique<HitTestQuery>();
 }
 
@@ -181,11 +182,12 @@ void HostFrameSinkManager::CreateCompositorFrameSink(
                                                     base::DoNothing());
   }
 
-  data.is_root = false;
-  data.has_created_compositor_frame_sink = true;
-
-  frame_sink_manager_->CreateCompositorFrameSink(
+  if (frame_sink_manager_) {
+    data.is_root = false;
+    data.has_created_compositor_frame_sink = true;
+    frame_sink_manager_->CreateCompositorFrameSink(
       frame_sink_id, std::move(receiver), std::move(client));
+  }
 }
 
 void HostFrameSinkManager::OnFrameTokenChanged(const FrameSinkId& frame_sink_id,
diff --git a/chromium/content/browser/compositor/viz_process_transport_factory.cc b/chromium/content/browser/compositor/viz_process_transport_factory.cc
index 22635f8b04f..0e7880c8add 100644
--- a/chromium/content/browser/compositor/viz_process_transport_factory.cc
+++ b/chromium/content/browser/compositor/viz_process_transport_factory.cc
@@ -357,11 +357,15 @@ void VizProcessTransportFactory::OnGpuProcessLost() {
   ConnectHostFrameSinkManager();
 }
 
+void VizProcessTransportFactory::PrepareForShutDown() {
+  shutdown_=true;
+}
+
 void VizProcessTransportFactory::OnEstablishedGpuChannel(
     base::WeakPtr<ui::Compositor> compositor_weak_ptr,
     scoped_refptr<gpu::GpuChannelHost> gpu_channel_host) {
   ui::Compositor* compositor = compositor_weak_ptr.get();
-  if (!compositor)
+  if (!compositor || shutdown_)
     return;
 
   bool gpu_compositing =
diff --git a/chromium/content/browser/compositor/viz_process_transport_factory.h b/chromium/content/browser/compositor/viz_process_transport_factory.h
index 5550113ec21..47fc75378d6 100644
--- a/chromium/content/browser/compositor/viz_process_transport_factory.h
+++ b/chromium/content/browser/compositor/viz_process_transport_factory.h
@@ -57,6 +57,7 @@ class VizProcessTransportFactory : public ui::ContextFactory,
 
   // Connects HostFrameSinkManager to FrameSinkManagerImpl in viz process.
   void ConnectHostFrameSinkManager();
+  void PrepareForShutDown();
 
   // ui::ContextFactory implementation.
   void CreateLayerTreeFrameSink(
@@ -135,7 +136,7 @@ class VizProcessTransportFactory : public ui::ContextFactory,
   ui::HostContextFactoryPrivate context_factory_private_;
 
   base::WeakPtrFactory<VizProcessTransportFactory> weak_ptr_factory_{this};
-
+  bool shutdown_ = false;
   DISALLOW_COPY_AND_ASSIGN(VizProcessTransportFactory);
 };