Fix Chrome crashes on calling OnTrayVisibilityChange

ash/common/system/status_area_widget.cc

Index: ash/common/system/status_area_widget.cc
diff --git a/ash/common/system/status_area_widget.cc b/ash/common/system/status_area_widget.cc
index 06bdf90c0d2c21eceda997e746f013cf09ae213d..e854f7b1b6dd65272c6910d1bb42d1eeeb62bdc2 100644
--- a/ash/common/system/status_area_widget.cc
+++ b/ash/common/system/status_area_widget.cc
@@ -43,7 +43,8 @@ StatusAreaWidget::StatusAreaWidget(WmWindow* status_container,
       ime_menu_tray_(nullptr),
 #endif
       login_status_(LoginStatus::NOT_LOGGED_IN),
-      wm_shelf_(wm_shelf) {
+      wm_shelf_(wm_shelf),
+      is_initialized_(false) {
   views::Widget::InitParams params(
       views::Widget::InitParams::TYPE_WINDOW_FRAMELESS);
   params.delegate = status_area_widget_delegate_;
@@ -83,9 +84,11 @@ void StatusAreaWidget::CreateTrayViews() {
   overview_button_tray_->Initialize();
   SetShelfAlignment(system_tray_->shelf_alignment());
   UpdateAfterLoginStatusChange(delegate->GetUserLoginStatus());
+  is_initialized_ = true;
 }
 
 void StatusAreaWidget::Shutdown() {
+  is_initialized_ = false;
   system_tray_->Shutdown();
   // Destroy the trays early, causing them to be removed from the view
   // hierarchy. Do not used scoped pointers since we don't want to destroy them
@@ -148,6 +151,12 @@ void StatusAreaWidget::OnTrayVisibilityChanged(TrayBackgroundView* tray) {
   if (!ash::MaterialDesignController::IsShelfMaterial())
     return;
 
+  // StatusAreaWidget may be |Shutdown| but still be accessed before it gets

[sadrul, 2016/12/12 19:34:48]

What is accessing this widget after Shutdown() is called? What happens if this
widget is accessed after calling 'Shutdown()'?

[yiyix, 2016/12/13 17:10:38]

We have discussed this problem offline. The main problem this CL is trying to
fix is calling logout_button_tray_->IsVisible() when the |logout_button_tray_|
is still not initialized. After discussion, we agreed that this check should be
inside of the function IsNextVisibleTrayToLogout where the uninitialized tray is
used. Assuming callers would always check the tray's initialization is
unreliable.

+  // reinitialized. Avoid accessing uninitialized trays.
+  if (!is_initialized_) {
+    return;
+  }
+
   // No separator is required between |system_tray_| and |overview_button_tray_|
   // and no separator is required for the right most tray item.
   if (tray == overview_button_tray_ || tray == system_tray_) {