Fix crash when DecrementCapturerCount() makes a delayed WasHidden() call during WebContentsImpl dest

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
@@ skipping 1004 matching lines @@
 
 const std::string& WebContentsImpl::GetEncoding() const {
   return encoding_;
 }
 
 bool WebContentsImpl::DisplayedInsecureContent() const {
   return displayed_insecure_content_;
 }
 
 void WebContentsImpl::IncrementCapturerCount() {
+  DCHECK(!is_being_destroyed_);
   ++capturer_count_;
   DVLOG(1) << "There are now " << capturer_count_
            << " capturing(s) of WebContentsImpl@" << this;
 
 #if defined(OS_LINUX) && !defined(USE_AURA)
   // Temporary fix for Linux non-Aura capturing. http://crbug.com/174957
   if (capturer_count_ == 1) {
     // Force a WebkitPreferences reload to disable compositing for snapshots.
     RenderViewHost* rvh = GetRenderViewHost();
-    rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
+    if (rvh)
+      rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
   }
 #endif
 }
 
 void WebContentsImpl::DecrementCapturerCount() {
   --capturer_count_;
   DVLOG(1) << "There are now " << capturer_count_
            << " capturing(s) of WebContentsImpl@" << this;
   DCHECK_LE(0, capturer_count_);
 
+  if (is_being_destroyed_)
+    return;
+
 #if defined(OS_LINUX) && !defined(USE_AURA)
   // Temporary fix for Linux non-Aura capturing. http://crbug.com/174957
   if (capturer_count_ == 0) {
     // Force a WebkitPreferences reload to re-enable compositing.
     RenderViewHost* rvh = GetRenderViewHost();
-    rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
+    if (rvh)
+      rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
   }
 #endif
 
   // While capturer_count_ was greater than zero, the WasHidden() calls to RWHV
   // were being prevented.  If there are no more capturers, make the call now.
   if (capturer_count_ == 0 && !should_normally_be_visible_) {
     DVLOG(1) << "Executing delayed WasHidden().";
     WasHidden();
   }
 }
@@ skipping 2438 matching lines @@
 
 BrowserPluginGuest* WebContentsImpl::GetBrowserPluginGuest() const {
   return browser_plugin_guest_.get();
 }
 
 BrowserPluginEmbedder* WebContentsImpl::GetBrowserPluginEmbedder() const {
   return browser_plugin_embedder_.get();
 }
 
 }  // namespace content