Fix crash when DecrementCapturerCount() makes a delayed WasHidden() call during WebContentsImpl dest

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index a9fca86a3ea950210e84e3c563a0349a3f7c6d2a..1220564a20cebd3bec4e469e4e511577b4008121 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -1022,6 +1022,7 @@ bool WebContentsImpl::DisplayedInsecureContent() const {
 }
 
 void WebContentsImpl::IncrementCapturerCount() {
+  DCHECK(!is_being_destroyed_);
   ++capturer_count_;
   DVLOG(1) << "There are now " << capturer_count_
            << " capturing(s) of WebContentsImpl@" << this;
@@ -1031,7 +1032,8 @@ void WebContentsImpl::IncrementCapturerCount() {
   if (capturer_count_ == 1) {
     // Force a WebkitPreferences reload to disable compositing for snapshots.
     RenderViewHost* rvh = GetRenderViewHost();
-    rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
+    if (rvh)
+      rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
   }
 #endif
 }
@@ -1042,12 +1044,16 @@ void WebContentsImpl::DecrementCapturerCount() {
            << " capturing(s) of WebContentsImpl@" << this;
   DCHECK_LE(0, capturer_count_);
 
+  if (is_being_destroyed_)
+    return;
+
 #if defined(OS_LINUX) && !defined(USE_AURA)
   // Temporary fix for Linux non-Aura capturing. http://crbug.com/174957
   if (capturer_count_ == 0) {
     // Force a WebkitPreferences reload to re-enable compositing.
     RenderViewHost* rvh = GetRenderViewHost();
-    rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
+    if (rvh)
+      rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
   }
 #endif