Dont let messages hit CompositorOutputSurface after it is destroyed.

content/renderer/gpu/compositor_output_surface.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/gpu/compositor_output_surface.h"
 
 #include "base/message_loop_proxy.h"
 #include "content/common/view_messages.h"
 #include "content/renderer/render_thread_impl.h"
 #include "ipc/ipc_forwarding_message_filter.h"
@@ skipping 28 matching lines @@
       software_device_(software_device) {
   DCHECK(output_surface_filter_);
   capabilities_.hasParentCompositor = false;
   DetachFromThread();
 }
 
 CompositorOutputSurface::~CompositorOutputSurface() {
   DCHECK(CalledOnValidThread());
   if (!client_)
     return;
+  output_surface_proxy_->ClearOutputSurface();
   output_surface_filter_->RemoveRoute(routing_id_);
 }
 
 const WebKit::WebCompositorOutputSurface::Capabilities&
     CompositorOutputSurface::capabilities() const {
   DCHECK(CalledOnValidThread());
   return capabilities_;
 }
 
 bool CompositorOutputSurface::bindToClient(
     WebKit::WebCompositorOutputSurfaceClient* client) {
   DCHECK(CalledOnValidThread());
   DCHECK(!client_);
   if (context3D_.get()) {
     if (!context3D_->makeContextCurrent())
       return false;
   }
 
   client_ = client;
 
+  output_surface_proxy_ = new CompositorOutputSurfaceProxy(this);
   output_surface_filter_->AddRoute(
       routing_id_,
-      base::Bind(&CompositorOutputSurface::OnMessageReceived,
-                 base::Unretained(this)));
+      base::Bind(&CompositorOutputSurfaceProxy::OnMessageReceived,
+                 output_surface_proxy_));
 
   return true;
 }
 
 WebGraphicsContext3D* CompositorOutputSurface::context3D() const {
   DCHECK(CalledOnValidThread());
   return context3D_.get();
 }
 
 WebCompositorSoftwareOutputDevice* CompositorOutputSurface::softwareDevice()
@@ skipping 20 matching lines @@
     base::TimeTicks timebase,
     base::TimeDelta interval) {
   DCHECK(CalledOnValidThread());
   DCHECK(client_);
   double monotonicTimebase = timebase.ToInternalValue() /
       static_cast<double>(base::Time::kMicrosecondsPerSecond);
   double intervalInSeconds = interval.ToInternalValue() /
       static_cast<double>(base::Time::kMicrosecondsPerSecond);
   client_->onVSyncParametersChanged(monotonicTimebase, intervalInSeconds);
 }