Fix Chrome crashes on calling OnTrayVisibilityChange

ash/common/system/tray/system_tray_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ash/common/system/tray/system_tray.h"
 
 #include <string>
 #include <vector>
 
 #include "ash/common/accelerators/accelerator_controller.h"
@@ skipping 42 matching lines @@
   ~ModalWidgetDelegate() override {}
 
   ui::ModalType GetModalType() const override { return ui::MODAL_TYPE_SYSTEM; }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ModalWidgetDelegate);
 };
 
 }  // namespace
 
-typedef AshTestBase SystemTrayTest;
+class SystemTrayTest : public AshTestBase {
+ public:
+  SystemTrayTest() {}
+  ~SystemTrayTest() override {}
+
+  void ShutDownLogoutButtonTray(StatusAreaWidget* widget) {

[varkha, 2016/12/13 17:34:54]

nit: I think we usually prefer Shutdown over ShutDown.

+    widget->logout_button_tray_ = nullptr;
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(SystemTrayTest);
+};
 
 // Verifies only the visible default views are recorded in the
 // "Ash.SystemMenu.DefaultView.VisibleItems" histogram.
 TEST_F(SystemTrayTest, OnlyVisibleItemsRecorded) {
   SystemTray* tray = GetPrimarySystemTray();
   ASSERT_TRUE(tray->GetWidget());
 
   TestSystemTrayItem* test_item = new TestSystemTrayItem();
   tray->AddTrayItem(test_item);
 
@@ skipping 583 matching lines @@
   tray->ShowDefaultView(BUBBLE_CREATE_NEW);
   RunAllPendingInMessageLoop();
   EXPECT_LT(0, notification_tray->tray_bubble_height_for_test());
 
   // Hide the default view, ensure the tray bubble height is back to zero.
   ASSERT_TRUE(tray->CloseSystemBubble());
   RunAllPendingInMessageLoop();
 
   EXPECT_EQ(0, notification_tray->tray_bubble_height_for_test());
 }
+
+// Calling OnVisibilityChange on StatusAreaWidget that has been Shutdown, see
+// crbug.com/671293. Test if crash is mitigated.
+TEST_F(SystemTrayTest, SystemTrayInitialization) {
+  StatusAreaWidget* widget = StatusAreaWidgetTestHelper::GetStatusAreaWidget();
+  ShutDownLogoutButtonTray(widget);

[varkha, 2016/12/13 17:34:54]

I am still confused if the bad scenario is a result of a call to visibility
change callback while we are inside StatusAreaWidget::CreateTrayViews() but
haven't initialized the |logout_button_tray_| yet (in which case you are rightly
testing it with resetting a single data member) or alternatively if the scenario
is a result of a race between StatusAreaWidget::CreateTrayViews() and
StatusAreaWidget::IsNextVisibleTrayToLogout() where IsNextVisibleTrayToLogout()
can be called before CreateTrayViews() (in which case I would prefer the test to
just invoke StatusAreaWidget::Shutdown() instead to match the real life
scenario.

+  WebNotificationTray* notification_tray = widget->web_notification_tray();
+  widget->OnTrayVisibilityChanged(notification_tray);
+}
 #endif  // OS_CHROMEOS
 
 }  // namespace test
 }  // namespace ash