Pending tasks in a message loop should be deleted before shutting down Blink

content/renderer/render_thread_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_thread_impl.h"
 
 #include <algorithm>
 #include <limits>
 #include <map>
 #include <vector>
@@ skipping 383 matching lines @@
 RenderThreadImpl::RenderThreadImpl()
     : ChildThread(Options(ShouldUseMojoChannel())) {
   Init();
 }
 
 RenderThreadImpl::RenderThreadImpl(const std::string& channel_name)
     : ChildThread(Options(channel_name, ShouldUseMojoChannel())) {
   Init();
 }
 
+RenderThreadImpl::RenderThreadImpl(
+    scoped_ptr<base::MessageLoop> main_message_loop)
+    : ChildThread(Options(ShouldUseMojoChannel())),
+      main_message_loop_(main_message_loop.Pass()) {
+  Init();
+}
+
 void RenderThreadImpl::Init() {
   TRACE_EVENT_BEGIN_ETW("RenderThreadImpl::Init", 0, "");
 
   base::debug::TraceLog::GetInstance()->SetThreadSortIndex(
       base::PlatformThread::CurrentId(),
       kTraceEventRendererMainThreadSortIndex);
 
 #if defined(OS_MACOSX) || defined(OS_ANDROID)
   // On Mac and Android, the select popups are rendered by the browser.
   blink::WebView::setUseExternalPopupMenus(true);
@@ skipping 236 matching lines @@
   // EmbeddedWorkerDispatcher. So it must be deleted before deleting
   // RenderThreadImpl.
   embedded_worker_dispatcher_.reset();
 
   // Ramp down IDB before we ramp down WebKit (and V8), since IDB classes might
   // hold pointers to V8 objects (e.g., via pending requests).
   main_thread_indexed_db_dispatcher_.reset();
 
   main_thread_compositor_task_runner_ = NULL;
 
-  if (webkit_platform_support_)
-    blink::shutdown();
-
-  lazy_tls.Pointer()->Set(NULL);
+  if (gpu_channel_.get())
+    gpu_channel_->DestroyChannel();

[haraken, 2014/10/03 04:28:13]

Just doing 'gpu_channel_ = NULL' was not enough, because it just clears a
scoped_refptr from the RenderThreadImpl object. Another scoped_refptr is held by
ContextProviderCommandBuffer() (and probably by other places as well) and thus
'gpu_channel_ = NULL' does not cause the destruction of GPUChannelHost (the
GPUChannelHost's destructor touches the message loop).

To prevent the GPUChannelHost's destructor from touching the message loop, I
added GPUChannelHost::DestroyChannel and explicitly called it here. The
GPUChannelHost::DestroyChannel flushes the message loop so that the
GPUChannelHost's destructor doesn't need to do anything.

 
   // TODO(port)
 #if defined(OS_WIN)
   // Clean up plugin channels before this thread goes away.
   NPChannelBase::CleanupChannels();
 #endif
+
+  // Shut down the message loop before shutting down Blink.
+  // This prevents a scenario where a pending task in the message loop accesses
+  // Blink objects after Blink shuts down.
+  // This must be at the very end of the shutdown sequence. You must not touch
+  // the message loop after this.
+  main_message_loop_.reset();
+  if (webkit_platform_support_)
+    blink::shutdown();
+
+  lazy_tls.Pointer()->Set(NULL);
 }
 
 bool RenderThreadImpl::Send(IPC::Message* msg) {
   // Certain synchronous messages cannot always be processed synchronously by
   // the browser, e.g., putting up UI and waiting for the user. This could cause
   // a complete hang of Chrome if a windowed plug-in is trying to communicate
   // with the renderer thread since the browser's UI thread could be stuck
   // (within a Windows API call) trying to synchronously communicate with the
   // plug-in.  The remedy is to pump messages on this thread while the browser
   // is processing this request. This creates an opportunity for re-entrancy
@@ skipping 940 matching lines @@
   hidden_widget_count_--;
 
   if (!GetContentClient()->renderer()->RunIdleHandlerWhenWidgetsHidden()) {
     return;
   }
 
   ScheduleIdleHandler(kLongIdleHandlerDelayMs);
 }
 
 }  // namespace content