Merge 144985 - chromeos: Avoid crash on Ctrl-Shift-Q just after logging in.

Hitting Ctrl-Shift-Q just after login can result in
NOTIFICATION_APP_EXITING getting sent before
BaseLoginDisplayHost::OnSessionStart() is called.  A task to
delete the BaseLoginDisplayHost singleton was being posted
in response to both of these events.

BUG=134436,134822
TEST=manual: unable to trigger crash now

Review URL: https://chromiumcodereview.appspot.com/10696039

TBR=derat@chromium.org
Review URL: https://chromiumcodereview.appspot.com/10696057

git-svn-id: svn://svn.chromium.org/chrome/branches/1180/src@144995 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 11 insertions, 1 deletions

diff --git a/chrome/browser/chromeos/login/base_login_display_host.cc b/chrome/browser/chromeos/login/base_login_display_host.cc
index 1d88a1f..79cfb06 100644
--- a/chrome/browser/chromeos/login/base_login_display_host.cc
+++ b/chrome/browser/chromeos/login/base_login_display_host.cc
@@ -130,7 +130,8 @@ LoginDisplayHost* BaseLoginDisplayHost::default_host_ = NULL;
 
 BaseLoginDisplayHost::BaseLoginDisplayHost(const gfx::Rect& background_bounds)
     : background_bounds_(background_bounds),
-      ALLOW_THIS_IN_INITIALIZER_LIST(pointer_factory_(this)) {
+      ALLOW_THIS_IN_INITIALIZER_LIST(pointer_factory_(this)),
+      shutting_down_(false) {
   // We need to listen to APP_EXITING but not APP_TERMINATING because
   // APP_TERMINATING will never be fired as long as this keeps ref-count.
   // APP_EXITING is safe here because there will be no browser instance that
@@ -285,6 +286,10 @@ void BaseLoginDisplayHost::Observe(
 }
 
 void BaseLoginDisplayHost::ShutdownDisplayHost(bool post_quit_task) {
+  if (shutting_down_)
+    return;
+
+  shutting_down_ = true;
   registrar_.RemoveAll();
   MessageLoop::current()->DeleteSoon(FROM_HERE, this);
   if (post_quit_task)
diff --git a/chrome/browser/chromeos/login/base_login_display_host.h b/chrome/browser/chromeos/login/base_login_display_host.h
index a708660..9023b08 100644
--- a/chrome/browser/chromeos/login/base_login_display_host.h
+++ b/chrome/browser/chromeos/login/base_login_display_host.h
@@ -103,6 +103,11 @@ class BaseLoginDisplayHost : public LoginDisplayHost,
   // Client for enterprise auto-enrollment check.
   scoped_ptr<policy::AutoEnrollmentClient> auto_enrollment_client_;
 
+  // Has ShutdownDisplayHost() already been called?  Used to avoid posting our
+  // own deletion to the message loop twice if the user logs out while we're
+  // still in the process of cleaning up after login (http://crbug.com/134463).
+  bool shutting_down_;
+
   DISALLOW_COPY_AND_ASSIGN(BaseLoginDisplayHost);
 };