Pending tasks in a message loop should be deleted before shutting down Blink

content/renderer/render_thread_impl.cc

Index: content/renderer/render_thread_impl.cc
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 3b2ff69cf48366cb6fcdfae4420f3a28611dd66c..61bf88ee52c4c7333d6cf6fa3f5f924a72e2d311 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -401,6 +401,13 @@ RenderThreadImpl::RenderThreadImpl(const std::string& channel_name)
   Init();
 }
 
+RenderThreadImpl::RenderThreadImpl(
+    scoped_ptr<base::MessageLoop> main_message_loop)
+    : ChildThread(Options(ShouldUseMojoChannel())),
+      main_message_loop_(main_message_loop.Pass()) {
+  Init();
+}
+
 void RenderThreadImpl::Init() {
   TRACE_EVENT_BEGIN_ETW("RenderThreadImpl::Init", 0, "");
 
@@ -657,16 +664,25 @@ void RenderThreadImpl::Shutdown() {
 
   main_thread_compositor_task_runner_ = NULL;
 
-  if (webkit_platform_support_)
-    blink::shutdown();
-
-  lazy_tls.Pointer()->Set(NULL);
+  if (gpu_channel_.get())
+    gpu_channel_->DestroyChannel();

[haraken, 2014/10/03 04:28:13]

Just doing 'gpu_channel_ = NULL' was not enough, because it just clears a
scoped_refptr from the RenderThreadImpl object. Another scoped_refptr is held by
ContextProviderCommandBuffer() (and probably by other places as well) and thus
'gpu_channel_ = NULL' does not cause the destruction of GPUChannelHost (the
GPUChannelHost's destructor touches the message loop).

To prevent the GPUChannelHost's destructor from touching the message loop, I
added GPUChannelHost::DestroyChannel and explicitly called it here. The
GPUChannelHost::DestroyChannel flushes the message loop so that the
GPUChannelHost's destructor doesn't need to do anything.

 
   // TODO(port)
 #if defined(OS_WIN)
   // Clean up plugin channels before this thread goes away.
   NPChannelBase::CleanupChannels();
 #endif
+
+  // Shut down the message loop before shutting down Blink.
+  // This prevents a scenario where a pending task in the message loop accesses
+  // Blink objects after Blink shuts down.
+  // This must be at the very end of the shutdown sequence. You must not touch
+  // the message loop after this.
+  main_message_loop_.reset();
+  if (webkit_platform_support_)
+    blink::shutdown();
+
+  lazy_tls.Pointer()->Set(NULL);
 }
 
 bool RenderThreadImpl::Send(IPC::Message* msg) {