If the WebGL DrawingBuffer is deleted while handling context loss it appears to cause a crash in the CommandBufferProxy (which the drawing buffer owns).

This behavior was seen in context_lost_tests during the GPUProcessCrashesExactlyOncePerVisitToAboutGpuCrash when a change was made to WebGLRenderingContextBase to remove it's reference to drawing_buffer_ during the context loss handler. It yielded the following call stack:

[34099:775:0112/121950.545982:ERROR:gpu_process_transport_factory.cc(1019)] Lost UI shared context.
[34107:775:0112/121950.537115:FATAL:lock_impl_posix.cc(76)] Check failed: rv == 0 (22 vs. 0). Invalid argument
0   Chromium Framework                  0x000000011094483c base::debug::StackTrace::StackTrace(unsigned long) + 28
1   Chromium Framework                  0x0000000110969a12 logging::LogMessage::~LogMessage() + 210
2   Chromium Framework                  0x00000001109e2807 base::internal::LockImpl::Lock() + 231
3   Chromium Framework                  0x000000010dd65d40 gpu::CommandBufferProxyImpl::OnGpuAsyncMessageError(gpu::error::ContextLostReason, gpu::error::Error) + 192
4   Chromium Framework                  0x000000010dd65e05 gpu::CommandBufferProxyImpl::OnChannelError() + 149
5   Chromium Framework                  0x000000010dd6ed07 base::internal::Invoker<base::internal::BindState<void (IPC::Listener::*)(), base::WeakPtr<IPC::Listener> >, void ()>::Run(base::internal::BindStateBase*) + 183
6   Chromium Framework                  0x00000001109451b5 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) + 261
[Snip...]

The cause seems to be that the loss of all references of the DrawingBuffer causes the CommandBufferProxy to be destroyed while it is in the middle of a statement that has an auto lock. When the statement exist the autolock attempts to unlock and references a now deleted lock.

The proposed solution is to hold on to the DrawingBuffer reference in a task fired from the context lost handling code will will keep the DrawingBuffer alive until after the current CommandBufferProxy code has completed, preserving the autolock integrity.