Quick fix for memory race inherent to all subclasses of base::Thread.

content/browser/browser_thread_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_thread_impl.h"
 
 #include "base/bind.h"
 #include "base/message_loop.h"
 #include "base/message_loop_proxy.h"
 #include "base/threading/thread_restrictions.h"
@@ skipping 25 matching lines @@
 BrowserThreadImpl::BrowserThreadImpl(BrowserThread::ID identifier)
     : BrowserThread(identifier) {
 }
 
 BrowserThreadImpl::BrowserThreadImpl(BrowserThread::ID identifier,
                                      MessageLoop* message_loop)
     : BrowserThread(identifier, message_loop) {
 }
 
 BrowserThreadImpl::~BrowserThreadImpl() {
+  // Subclasses of base::Thread() (or at least the most-derived
+  // subclass) must call Stop() in their destructor, otherwise the
+  // vtable for the object can change while the thread's message loop
+  // is still running, and it uses the object's vtable (it calls the
+  // virtual method Run).
+  Stop();
 }
 
 // static
 bool BrowserThreadImpl::PostTaskHelper(
     BrowserThread::ID identifier,
     const tracked_objects::Location& from_here,
     Task* task,
     int64 delay_ms,
     bool nestable) {
   DCHECK(identifier >= 0 && identifier < ID_COUNT);
@@ skipping 318 matching lines @@
 }
 
 // static
 scoped_refptr<base::MessageLoopProxy>
 BrowserThread::GetMessageLoopProxyForThread(
     ID identifier) {
   scoped_refptr<base::MessageLoopProxy> proxy(
       new BrowserThreadMessageLoopProxy(identifier));
   return proxy;
 }