Fix Chrome crashes on calling OnTrayVisibilityChange

ash/common/system/status_area_widget.cc

Index: ash/common/system/status_area_widget.cc
diff --git a/ash/common/system/status_area_widget.cc b/ash/common/system/status_area_widget.cc
index 06bdf90c0d2c21eceda997e746f013cf09ae213d..65ccb502f27500f7cfd76ead5aebaedcb09e516b 100644
--- a/ash/common/system/status_area_widget.cc
+++ b/ash/common/system/status_area_widget.cc
@@ -43,7 +43,8 @@ StatusAreaWidget::StatusAreaWidget(WmWindow* status_container,
       ime_menu_tray_(nullptr),
 #endif
       login_status_(LoginStatus::NOT_LOGGED_IN),
-      wm_shelf_(wm_shelf) {
+      wm_shelf_(wm_shelf),
+      is_initialized_(false) {
   views::Widget::InitParams params(
       views::Widget::InitParams::TYPE_WINDOW_FRAMELESS);
   params.delegate = status_area_widget_delegate_;
@@ -83,9 +84,11 @@ void StatusAreaWidget::CreateTrayViews() {
   overview_button_tray_->Initialize();
   SetShelfAlignment(system_tray_->shelf_alignment());
   UpdateAfterLoginStatusChange(delegate->GetUserLoginStatus());
+  is_initialized_ = true;
 }
 
 void StatusAreaWidget::Shutdown() {
+  is_initialized_ = false;
   system_tray_->Shutdown();
   // Destroy the trays early, causing them to be removed from the view
   // hierarchy. Do not used scoped pointers since we don't want to destroy them
@@ -148,6 +151,14 @@ void StatusAreaWidget::OnTrayVisibilityChanged(TrayBackgroundView* tray) {
   if (!ash::MaterialDesignController::IsShelfMaterial())
     return;
 
+  // OnTrayVisibilityChanged could be called asynchronously by different events,
+  // when a primary display is add to the system, as a result these unexpected
+  // access to uninitialized |tray| lead to Chrome crashes. |is_initialized_| is
+  // added to prevent to access |tray| before its initialization.

[varkha, 2016/12/09 00:59:03]

nit: I think this early return is self-explanatory. If you want to add a comment
I would put something like "StatusAreaWidget may be |Shutdown| but still be
accessed before it gets reinitialized. Avoid accessing uninitialized trays."

[yiyix, 2016/12/09 20:04:53]

True, i kinda of want to give some background about the bug. It is a good
general comment without the knowledge of this specific bug.

+  if (!is_initialized_) {
+    return;
+  }
+
   // No separator is required between |system_tray_| and |overview_button_tray_|
   // and no separator is required for the right most tray item.
   if (tray == overview_button_tray_ || tray == system_tray_) {