Fix Chrome crashes on calling OnTrayVisibilityChange

ash/common/system/status_area_widget.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ash/common/system/status_area_widget.h"
 
 #include "ash/common/material_design/material_design_controller.h"
 #include "ash/common/shelf/wm_shelf.h"
 #include "ash/common/system/overview/overview_button_tray.h"
 #include "ash/common/system/status_area_widget_delegate.h"
@@ skipping 25 matching lines @@
       overview_button_tray_(nullptr),
       system_tray_(nullptr),
       web_notification_tray_(nullptr),
 #if defined(OS_CHROMEOS)
       logout_button_tray_(nullptr),
       palette_tray_(nullptr),
       virtual_keyboard_tray_(nullptr),
       ime_menu_tray_(nullptr),
 #endif
       login_status_(LoginStatus::NOT_LOGGED_IN),
-      wm_shelf_(wm_shelf) {
+      wm_shelf_(wm_shelf),
+      is_initialized_(false) {
   views::Widget::InitParams params(
       views::Widget::InitParams::TYPE_WINDOW_FRAMELESS);
   params.delegate = status_area_widget_delegate_;
   params.name = "StatusAreaWidget";
   params.opacity = views::Widget::InitParams::TRANSLUCENT_WINDOW;
   status_container->GetRootWindowController()
       ->ConfigureWidgetInitParamsForContainer(
           this, status_container->GetShellWindowId(), &params);
   Init(params);
   set_focus_on_creation(false);
@@ skipping 19 matching lines @@
   system_tray_->InitializeTrayItems(delegate, web_notification_tray_);
   web_notification_tray_->Initialize();
 #if defined(OS_CHROMEOS)
   logout_button_tray_->Initialize();
   virtual_keyboard_tray_->Initialize();
   ime_menu_tray_->Initialize();
 #endif
   overview_button_tray_->Initialize();
   SetShelfAlignment(system_tray_->shelf_alignment());
   UpdateAfterLoginStatusChange(delegate->GetUserLoginStatus());
+  is_initialized_ = true;
 }
 
 void StatusAreaWidget::Shutdown() {
+  is_initialized_ = false;
   system_tray_->Shutdown();
   // Destroy the trays early, causing them to be removed from the view
   // hierarchy. Do not used scoped pointers since we don't want to destroy them
   // in the destructor if Shutdown() is not called (e.g. in tests).
   delete web_notification_tray_;
   web_notification_tray_ = nullptr;
   // Must be destroyed after |web_notification_tray_|.
   delete system_tray_;
   system_tray_ = nullptr;
 #if defined(OS_CHROMEOS)
@@ skipping 42 matching lines @@
     logout_button_tray_->UpdateAfterLoginStatusChange(login_status);
 #endif
   if (overview_button_tray_)
     overview_button_tray_->UpdateAfterLoginStatusChange(login_status);
 }
 
 void StatusAreaWidget::OnTrayVisibilityChanged(TrayBackgroundView* tray) {
   if (!ash::MaterialDesignController::IsShelfMaterial())
     return;
 
+  // OnTrayVisibilityChanged could be called asynchronously by different events,
+  // when a primary display is add to the system, as a result these unexpected
+  // access to uninitialized |tray| lead to Chrome crashes. |is_initialized_| is
+  // added to prevent to access |tray| before its initialization.

[varkha, 2016/12/09 00:59:03]

nit: I think this early return is self-explanatory. If you want to add a comment
I would put something like "StatusAreaWidget may be |Shutdown| but still be
accessed before it gets reinitialized. Avoid accessing uninitialized trays."

[yiyix, 2016/12/09 20:04:53]

True, i kinda of want to give some background about the bug. It is a good
general comment without the knowledge of this specific bug.

+  if (!is_initialized_) {
+    return;
+  }
+
   // No separator is required between |system_tray_| and |overview_button_tray_|
   // and no separator is required for the right most tray item.
   if (tray == overview_button_tray_ || tray == system_tray_) {
     tray->SetSeparatorVisibility(false);
     return;
   }
 #if defined(OS_CHROMEOS)
   // If |logout_button_tray_| is visible, check if |tray| is visible and to
   // the left of |logout_button_tray_|. If it is the case, then no separator
   // is required between |tray| and |logout_button_tray_|. If
@@ skipping 136 matching lines @@
   return false;
 }
 #endif
 
 void StatusAreaWidget::AddOverviewButtonTray() {
   overview_button_tray_ = new OverviewButtonTray(wm_shelf_);
   status_area_widget_delegate_->AddTray(overview_button_tray_);
 }
 
 }  // namespace ash