mash: Fix shutdown crashes by tearing down ServiceContext before message loop

chrome/app/mash/mash_runner.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/app/mash/mash_runner.h"
 
 #include <string>
 
 #include "base/at_exit.h"
 #include "base/base_paths.h"
@@ skipping 141 matching lines @@
   base::TaskScheduler::CreateAndSetSimpleTaskScheduler(
       base::SysInfo::NumberOfProcessors());
 
   if (IsChild())
     return RunChild();
 
   return RunMain();
 }
 
 int MashRunner::RunMain() {
+  base::MessageLoop message_loop(base::MessageLoop::TYPE_UI);
+
   base::SequencedWorkerPool::EnableWithRedirectionToTaskSchedulerForProcess();
 
   mojo::edk::Init();
 
   base::Thread ipc_thread("IPC thread");
   ipc_thread.StartWithOptions(
       base::Thread::Options(base::MessageLoop::TYPE_IO, 0));
   mojo::edk::ScopedIPCSupport ipc_support(
       ipc_thread.task_runner(),
       mojo::edk::ScopedIPCSupport::ShutdownPolicy::FAST);
 
   int exit_value = RunServiceManagerInMain();
 
   ipc_thread.Stop();
   base::TaskScheduler::GetInstance()->Shutdown();
   return exit_value;
 }
 
 int MashRunner::RunServiceManagerInMain() {
   // TODO(sky): refactor BackgroundServiceManager so can supply own context, we
   // shouldn't we using context as it has a lot of stuff we don't really want
   // in chrome.
   ServiceProcessLauncherDelegateImpl service_process_launcher_delegate;
   service_manager::BackgroundServiceManager background_service_manager(
       &service_process_launcher_delegate, CreateChromeMashCatalog());
   service_manager::mojom::ServicePtr service;
-  context_.reset(new service_manager::ServiceContext(
+  service_manager::ServiceContext context(
       base::MakeUnique<mash::MashPackagedService>(),
-      service_manager::mojom::ServiceRequest(&service)));
+      service_manager::mojom::ServiceRequest(&service));
   background_service_manager.RegisterService(
       service_manager::Identity(
           kChromeMashServiceName, service_manager::mojom::kRootUserID),
       std::move(service), nullptr);
 
   // Quit the main process if an important child (e.g. window manager) dies.
   // On Chrome OS the OS-level session_manager will restart the main process.
   base::RunLoop run_loop;
   int exit_value = 0;
   background_service_manager.SetInstanceQuitCallback(
       base::Bind(&OnInstanceQuitInMain, &run_loop, &exit_value));
 
   // Ping services that we know we want to launch on startup (UI service,
   // window manager, quick launch app).
-  context_->connector()->Connect(ui::mojom::kServiceName);
-  context_->connector()->Connect(mash::common::GetWindowManagerServiceName());
-  context_->connector()->Connect(mash::quick_launch::mojom::kServiceName);
+  context.connector()->Connect(ui::mojom::kServiceName);
+  context.connector()->Connect(mash::common::GetWindowManagerServiceName());
+  context.connector()->Connect(mash::quick_launch::mojom::kServiceName);
 
   run_loop.Run();
 
-  context_.reset();
+  // |context| must be destroyed before the message loop.
   return exit_value;
 }
 
 int MashRunner::RunChild() {
   service_manager::WaitForDebuggerIfNecessary();
 
   base::i18n::InitializeICU();
   InitializeResources();
   service_manager::RunStandaloneService(
       base::Bind(&MashRunner::StartChildApp, base::Unretained(this)));
   return 0;
 }
 
 void MashRunner::StartChildApp(
     service_manager::mojom::ServiceRequest service_request) {
   // TODO(sad): Normally, this would be a TYPE_DEFAULT message loop. However,
   // TYPE_UI is needed for mojo:ui. But it is not known whether the child app is
   // going to be mojo:ui at this point. So always create a TYPE_UI message loop
   // for now.
   base::MessageLoop message_loop(base::MessageLoop::TYPE_UI);
   base::RunLoop run_loop;
-  context_.reset(new service_manager::ServiceContext(
+  service_manager::ServiceContext context(
       base::MakeUnique<mash::MashPackagedService>(),
-      std::move(service_request)));
+      std::move(service_request));
   // Quit the child process if it loses its connection to service manager.
-  context_->SetConnectionLostClosure(run_loop.QuitClosure());
+  context.SetConnectionLostClosure(run_loop.QuitClosure());
   run_loop.Run();
+  // |context| must be destroyed before |message_loop|.
 }
 
 int MashMain() {
 #if !defined(OFFICIAL_BUILD) && defined(OS_WIN)
   base::RouteStdioToConsole(false);
 #endif
   // TODO(sky): wire this up correctly.
   service_manager::InitializeLogging();
 
 #if defined(OS_LINUX)
   base::AtExitManager exit_manager;
 #endif
 
 #if !defined(OFFICIAL_BUILD)
   // Initialize stack dumping before initializing sandbox to make sure symbol
   // names in all loaded libraries will be cached.
   // NOTE: On Chrome OS, crash reporting for the root process and non-browser
   // service processes is handled by the OS-level crash_reporter.
   base::debug::EnableInProcessStackDumping();
 #endif
 
-  std::unique_ptr<base::MessageLoop> message_loop;
-  if (!IsChild())
-    message_loop.reset(new base::MessageLoop(base::MessageLoop::TYPE_UI));
-
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kTraceToConsole)) {
     base::trace_event::TraceConfig trace_config =
         tracing::GetConfigForTraceToConsole();
     base::trace_event::TraceLog::GetInstance()->SetEnabled(
         trace_config,
         base::trace_event::TraceLog::RECORDING_MODE);
   }
 
   MashRunner mash_runner;
@@ skipping 12 matching lines @@
       command_line->GetSwitchValueASCII(switches::kWaitForDebugger)) {
     return;
   }
 
   // Include the pid as logging may not have been initialized yet (the pid
   // printed out by logging is wrong).
   LOG(WARNING) << "waiting for debugger to attach for service " << service_name
                << " pid=" << base::Process::Current().Pid();
   base::debug::WaitForDebugger(120, true);
 }