ServiceWorker: Fix data race in shutdown sequence

content/renderer/render_thread_impl.cc

Index: content/renderer/render_thread_impl.cc
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 7677ac58692a1cea119687e28f778c2ee8484364..572bd5862abc56c2ab8b4a6a7ccdfe35ce91af77 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -649,11 +649,6 @@ void RenderThreadImpl::Shutdown() {
     input_event_filter_ = NULL;
   }
 
-  // RemoveEmbeddedWorkerRoute may be called while deleting
-  // EmbeddedWorkerDispatcher. So it must be deleted before deleting
-  // RenderThreadImpl.
-  embedded_worker_dispatcher_.reset();
-
   // Ramp down IDB before we ramp down WebKit (and V8), since IDB classes might
   // hold pointers to V8 objects (e.g., via pending requests).
   main_thread_indexed_db_dispatcher_.reset();
@@ -663,6 +658,12 @@ void RenderThreadImpl::Shutdown() {
   if (blink_platform_impl_)
     blink::shutdown();
 
+  // RemoveEmbeddedWorkerRoute may be called while deleting
+  // EmbeddedWorkerDispatcher. So it must be deleted before deleting
+  // RenderThreadImpl. Also, it must be after all workers are terminated, since
+  // this frees up resources used by worker threads.
+  embedded_worker_dispatcher_.reset();

[jamesr, 2014/10/28 04:41:24]

will all workers be deleted and removed from embedder_worker_dispatcher's
workers_ map before this call is made? can we DCHECK that?

[Kunihiko Sakamoto, 2014/10/28 06:41:16]

Unfortunately workers_ is not guaranteed to be empty at this point.
Worker's shutdown code posts a task to remove workers_ entry in main thread but
it may not be handled yet.

+
   lazy_tls.Pointer()->Set(NULL);
 
   // TODO(port)