Fix GpuChannelHost destruction and races

content/common/gpu/client/gpu_channel_host.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_GPU_CLIENT_GPU_CHANNEL_HOST_H_
 #define CONTENT_COMMON_GPU_CLIENT_GPU_CHANNEL_HOST_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 133 matching lines @@
   scoped_ptr<media::VideoDecodeAccelerator> CreateVideoDecoder(
       int command_buffer_route_id);
 
   // Creates a video encoder in the GPU process.
   scoped_ptr<media::VideoEncodeAccelerator> CreateVideoEncoder(
       int command_buffer_route_id);
 
   // Destroy a command buffer created by this channel.
   void DestroyCommandBuffer(CommandBufferProxyImpl* command_buffer);
 
-  // Destroy this channel.
+  // Destroy this channel. Must be called on the main thread, before
+  // destruction.
   void DestroyChannel();
 
   // Add a route for the current message loop.
   void AddRoute(int route_id, base::WeakPtr<IPC::Listener> listener);
   void RemoveRoute(int route_id);
 
   GpuChannelHostFactory* factory() const { return factory_; }
 
   gpu::GpuMemoryBufferManager* gpu_memory_buffer_manager() const {
     return gpu_memory_buffer_manager_;
@@ skipping 74 matching lines @@
   // Threading notes: all fields are constant during the lifetime of |this|
   // except:
   // - |next_transfer_buffer_id_|, atomic type
   // - |next_image_id_|, atomic type
   // - |next_route_id_|, atomic type
   // - |proxies_|, protected by |context_lock_|
   GpuChannelHostFactory* const factory_;
 
   const gpu::GPUInfo gpu_info_;
 
-  scoped_ptr<IPC::SyncChannel> channel_;
   scoped_refptr<MessageFilter> channel_filter_;
 
   gpu::GpuMemoryBufferManager* gpu_memory_buffer_manager_;
 
   // A filter for sending messages from thread other than the main thread.
   scoped_refptr<IPC::SyncMessageFilter> sync_filter_;
 
   // Transfer buffer IDs are allocated in sequence.
   base::AtomicSequenceNumber next_transfer_buffer_id_;
 
   // Image IDs are allocated in sequence.
   base::AtomicSequenceNumber next_image_id_;
 
   // Route IDs are allocated in sequence.
   base::AtomicSequenceNumber next_route_id_;
 
-  // Protects proxies_.
+  // Protects channel_ and proxies_.
   mutable base::Lock context_lock_;
+  scoped_ptr<IPC::SyncChannel> channel_;
   // Used to look up a proxy from its routing id.
   typedef base::hash_map<int, CommandBufferProxyImpl*> ProxyMap;
   ProxyMap proxies_;
   ProxyFlushInfo flush_info_;
 
   DISALLOW_COPY_AND_ASSIGN(GpuChannelHost);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_COMMON_GPU_CLIENT_GPU_CHANNEL_HOST_H_