UI service: Avoid nullptr deref on disconnected Gpu interface

Now that we disconnect the Gpu interface on error, we need to test
that it's bound before trying to call into it.

BUG=684540

Review-Url: https://codereview.chromium.org/2655623003
Cr-Commit-Position: refs/heads/master@{#445799}

services/ui/public/cpp/gpu/client_gpu_memory_buffer_manager.cc

@@ -78,6 +78,14 @@ void ClientGpuMemoryBufferManager::AllocateGpuMemoryBufferOnThread(
     gfx::GpuMemoryBufferHandle* handle,
     base::WaitableEvent* wait) {
   DCHECK(thread_.task_runner()->BelongsToCurrentThread());
+
+  if (!gpu_) {
+    // The Gpu interface may have been disconnected, in which case we can't
+    // fulfill the request.
+    wait->Signal();
+    return;
+  }
+
   // |handle| and |wait| are both on the stack, and will be alive until |wait|
   // is signaled. So it is safe for OnGpuMemoryBufferAllocated() to operate on
   // these.
@@ -111,7 +119,9 @@ void ClientGpuMemoryBufferManager::DeletedGpuMemoryBuffer(
                    base::Unretained(this), id, sync_token));
     return;
   }
-  gpu_->DestroyGpuMemoryBuffer(id, sync_token);
+
+  if (gpu_)
+    gpu_->DestroyGpuMemoryBuffer(id, sync_token);
 }
 
 std::unique_ptr<gfx::GpuMemoryBuffer>