Delay deleting profile notification

chrome/browser/notifications/message_center_notification_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/notifications/message_center_notification_manager.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "build/build_config.h"
 #include "chrome/browser/notifications/extension_welcome_notification.h"
 #include "chrome/browser/notifications/extension_welcome_notification_factory.h"
 #include "chrome/browser/notifications/fullscreen_notification_blocker.h"
 #include "chrome/browser/notifications/message_center_settings_controller.h"
 #include "chrome/browser/notifications/notification.h"
 #include "chrome/browser/notifications/profile_notification.h"
 #include "chrome/browser/notifications/screen_lock_notification_blocker.h"
 #include "chrome/browser/profiles/profile.h"
+#include "content/public/browser/browser_thread.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_constants.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/common/extension_set.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "ui/gfx/image/image_skia.h"
 #include "ui/message_center/message_center_style.h"
 #include "ui/message_center/message_center_tray.h"
 #include "ui/message_center/message_center_types.h"
 #include "ui/message_center/notifier_settings.h"
@@ skipping 291 matching lines @@
   DCHECK(profile_notifications_.find(id) == profile_notifications_.end());
   profile_notifications_[id] = std::move(profile_notification);
 }
 
 void MessageCenterNotificationManager::RemoveProfileNotification(
     const std::string& notification_id) {
   auto it = profile_notifications_.find(notification_id);
   if (it == profile_notifications_.end())
     return;
 
-  // Delay destruction of the ProfileNotification until after all the work
-  // removing it from |profile_notifications_| is complete. This must be done
-  // because this ProfileNotification might have the one ScopedKeepAlive object
-  // that was keeping the browser alive, and destroying it would result in a re-
-  // entrant call to this class. Because every method in this class touches
-  // |profile_notifications_|, |profile_notifications_| must always be in a
-  // self-consistent state in moments where re-entrance might happen.
-  // https://crbug.com/649971
-  std::unique_ptr<ProfileNotification> notification = std::move(it->second);
+  // Delay destruction of the ProfileNotification until current task is
+  // completed. This must be done because this ProfileNotification might have
+  // the one ScopedKeepAlive object that was keeping the browser alive, and
+  // destroying it would result in:
+  // a) A reentrant call to this class. Because every method in this class
+  //   touches |profile_notifications_|, |profile_notifications_| must always
+  //   be in a self-consistent state in moments where re-entrance might happen.
+  // b) A crash like https://crbug.com/649971 because it can trigger
+  //    shutdown process while we're still inside the call stack from UI
+  //    framework.
+  content::BrowserThread::DeleteSoon(content::BrowserThread::UI, FROM_HERE,
+                                     it->second.release());
   profile_notifications_.erase(it);
-  // Now that the map modifications are complete, going out of scope will
-  // destroy the notification.
 }
 
 ProfileNotification* MessageCenterNotificationManager::FindProfileNotification(
     const std::string& id) const {
   auto iter = profile_notifications_.find(id);
   if (iter == profile_notifications_.end())
     return nullptr;
 
   return (*iter).second.get();
 }