Forbid ImageDownloaderImpl from accessing RenderThread instance after message loop shutdown.

content/renderer/image_downloader/image_downloader_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/image_downloader/image_downloader_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/location.h"
@@ skipping 112 matching lines @@
 
 ImageDownloaderImpl::ImageDownloaderImpl(
     RenderFrame* render_frame,
     mojo::InterfaceRequest<content::mojom::ImageDownloader> request)
     : RenderFrameObserver(render_frame), binding_(this, std::move(request)) {
   DCHECK(render_frame);
   RenderThread::Get()->AddObserver(this);
 }
 
 ImageDownloaderImpl::~ImageDownloaderImpl() {
-  RenderThread::Get()->RemoveObserver(this);
+  RenderThread* thread = RenderThread::Get();
+  // As ImageDownloaderImpl is a strong binding with message pipe, the
+  // destructor may run after message loop shutdown, so we need to check whether
+  // RenderThread is null.
+  if (thread)
+    thread->RemoveObserver(this);
 }
 
 // static
 void ImageDownloaderImpl::CreateMojoService(
     RenderFrame* render_frame,
     mojo::InterfaceRequest<content::mojom::ImageDownloader> request) {
   DVLOG(1) << "ImageDownloaderImpl::CreateService";
   DCHECK(render_frame);
 
   new ImageDownloaderImpl(render_frame, std::move(request));
@@ skipping 81 matching lines @@
     const std::vector<gfx::Size>& result_original_image_sizes,
     const DownloadImageCallback& callback) {
   callback.Run(http_status_code, result_images, result_original_image_sizes);
 }
 
 void ImageDownloaderImpl::OnDestruct() {
   delete this;
 }
 
 }  // namespace content