[Device Sensors] Fix crash on shutdown

device/sensors/data_fetcher_shared_memory_base.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "device/sensors/data_fetcher_shared_memory_base.h"
 
 #include <stddef.h>
 #include <string.h>
 
 #include "base/bind.h"
@@ skipping 94 matching lines @@
 }
 
 // --- end of PollingThread methods
 
 DataFetcherSharedMemoryBase::DataFetcherSharedMemoryBase()
     : started_consumers_(0) {}
 
 DataFetcherSharedMemoryBase::~DataFetcherSharedMemoryBase() {
   DCHECK_EQ(0u, started_consumers_);
 
-  // make sure polling thread stops asap.
-  if (polling_thread_)
-    polling_thread_->Stop();
+  // By this point the polling thread should have already been stopped (it's not
+  // safe for it to be running in this class's destructor as tasks are posted to
+  // it that call virtual methods of this class).
+  DCHECK(!polling_thread_ || !polling_thread_->IsRunning());
 }
 
 bool DataFetcherSharedMemoryBase::StartFetchingDeviceData(
     ConsumerType consumer_type) {
   if (started_consumers_ & consumer_type)
     return true;
 
   void* buffer = GetSharedMemoryBuffer(consumer_type);
   if (!buffer)
     return false;
@@ skipping 39 matching lines @@
   started_consumers_ ^= consumer_type;
 
   return true;
 }
 
 void DataFetcherSharedMemoryBase::Shutdown() {
   StopFetchingDeviceData(CONSUMER_TYPE_MOTION);
   StopFetchingDeviceData(CONSUMER_TYPE_ORIENTATION);
   StopFetchingDeviceData(CONSUMER_TYPE_ORIENTATION_ABSOLUTE);
   StopFetchingDeviceData(CONSUMER_TYPE_LIGHT);
+
+  // Ensure that the polling thread stops before entering the destructor of the
+  // subclass, as the stopping of the polling thread causes tasks to execute
+  // that call virtual methods of this class, which can cause crashes if they
+  // execute while (or after) the subclass is being torn down.
+  if (polling_thread_)
+    polling_thread_->Stop();
 }
 
 mojo::ScopedSharedBufferHandle
 DataFetcherSharedMemoryBase::GetSharedMemoryHandle(ConsumerType consumer_type) {
   auto it = shared_memory_map_.find(consumer_type);
   DCHECK(it != shared_memory_map_.end());
   return it->second.first->Clone();
 }
 
 bool DataFetcherSharedMemoryBase::InitAndStartPollingThreadIfNecessary() {
@@ skipping 46 matching lines @@
 
 base::MessageLoop* DataFetcherSharedMemoryBase::GetPollingMessageLoop() const {
   return polling_thread_ ? polling_thread_->message_loop() : nullptr;
 }
 
 bool DataFetcherSharedMemoryBase::IsPollingTimerRunningForTesting() const {
   return polling_thread_ ? polling_thread_->IsTimerRunning() : false;
 }
 
 }  // namespace device