Fix bug when accessing g_browser_process->broker_services() at shutdown.

BUG=28501
Review URL: http://codereview.chromium.org/435001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@32832 0039d316-1c4b-4281-b951-d872f2087c98

6 files changed, 38 insertions, 22 deletions

diff --git a/chrome/browser/browser_main.cc b/chrome/browser/browser_main.cc
index 53274e2..6ede0da 100644
--- a/chrome/browser/browser_main.cc
+++ b/chrome/browser/browser_main.cc
@@ -356,7 +356,7 @@ int BrowserMain(const MainFunctionParams& parameters) {
   bool is_first_run = FirstRun::IsChromeFirstRun() ||
       parsed_command_line.HasSwitch(switches::kFirstRun);
 
-  scoped_ptr<BrowserProcess> browser_process;
+  scoped_ptr<BrowserProcessImpl> browser_process;
   if (parsed_command_line.HasSwitch(switches::kImport)) {
     // We use different BrowserProcess when importing so no GoogleURLTracker is
     // instantiated (as it makes a URLRequest and we don't have an IO thread,
@@ -633,6 +633,7 @@ int BrowserMain(const MainFunctionParams& parameters) {
   // Note: must be done before FirstRun code is started.
   browser_process->db_thread();
   browser_process->file_thread();
+  browser_process->process_launcher_thread();
   browser_process->io_thread();
 
   // Importing other browser settings is done in a browser-like process
diff --git a/chrome/browser/browser_process_impl.cc b/chrome/browser/browser_process_impl.cc
index 05d4299..80d6d57 100644
--- a/chrome/browser/browser_process_impl.cc
+++ b/chrome/browser/browser_process_impl.cc
@@ -139,6 +139,7 @@ BrowserProcessImpl::BrowserProcessImpl(const CommandLine& command_line)
       created_io_thread_(false),
       created_file_thread_(false),
       created_db_thread_(false),
+      created_process_launcher_thread_(false),
       created_profile_manager_(false),
       created_local_state_(false),
 #if defined(OS_WIN)
@@ -212,6 +213,10 @@ BrowserProcessImpl::~BrowserProcessImpl() {
   // request before going away.
   ResetIOThread();
 
+  // Stop the process launcher thread after the IO thread, in case the IO thread
+  // posted a task to terminate a process on the process launcher thread.
+  process_launcher_thread_.reset();
+
   // Clean up state that lives on the file_thread_ before it goes away.
   if (resource_dispatcher_host_.get()) {
     resource_dispatcher_host()->download_file_manager()->Shutdown();
@@ -383,6 +388,17 @@ void BrowserProcessImpl::CreateDBThread() {
   db_thread_.swap(thread);
 }
 
+void BrowserProcessImpl::CreateProcessLauncherThread() {
+  DCHECK(!created_process_launcher_thread_ && !process_launcher_thread_.get());
+  created_process_launcher_thread_ = true;
+
+  scoped_ptr<base::Thread> thread(
+      new BrowserProcessSubThread(ChromeThread::PROCESS_LAUNCHER));
+  if (!thread->Start())
+    return;
+  process_launcher_thread_.swap(thread);
+}
+
 void BrowserProcessImpl::CreateProfileManager() {
   DCHECK(!created_profile_manager_ && profile_manager_.get() == NULL);
   created_profile_manager_ = true;
diff --git a/chrome/browser/browser_process_impl.h b/chrome/browser/browser_process_impl.h
index ea9efb4..c8bc6d9 100644
--- a/chrome/browser/browser_process_impl.h
+++ b/chrome/browser/browser_process_impl.h
@@ -73,6 +73,13 @@ class BrowserProcessImpl : public BrowserProcess, public NonThreadSafe {
     return db_thread_.get();
   }
 
+  virtual base::Thread* process_launcher_thread() {
+    DCHECK(CalledOnValidThread());
+    if (!created_process_launcher_thread_)
+      CreateProcessLauncherThread();
+    return process_launcher_thread_.get();
+  }
+
 #if defined(OS_LINUX)
   virtual base::Thread* background_x11_thread() {
     DCHECK(CalledOnValidThread());
@@ -105,6 +112,7 @@ class BrowserProcessImpl : public BrowserProcess, public NonThreadSafe {
       return NULL;
     return broker_services_;
   }
+  void InitBrokerServices(sandbox::BrokerServices* broker_services);
 #endif  // defined(OS_WIN)
 
   virtual DebuggerWrapper* debugger_wrapper() {
@@ -215,6 +223,7 @@ class BrowserProcessImpl : public BrowserProcess, public NonThreadSafe {
 
   void CreateFileThread();
   void CreateDBThread();
+  void CreateProcessLauncherThread();
   void CreateTemplateURLModel();
   void CreateProfileManager();
   void CreateWebDataService();
@@ -226,10 +235,6 @@ class BrowserProcessImpl : public BrowserProcess, public NonThreadSafe {
   void CreateGoogleURLTracker();
   void CreateNotificationUIManager();
 
-#if defined(OS_WIN)
-  void InitBrokerServices(sandbox::BrokerServices* broker_services);
-#endif  // defined(OS_WIN)
-
 #if defined(IPC_MESSAGE_LOG_ENABLED)
   void SetIPCLoggingEnabledForChildProcesses(bool enabled);
 #endif
@@ -253,6 +258,9 @@ class BrowserProcessImpl : public BrowserProcess, public NonThreadSafe {
   bool created_db_thread_;
   scoped_ptr<base::Thread> db_thread_;
 
+  bool created_process_launcher_thread_;
+  scoped_ptr<base::Thread> process_launcher_thread_;
+
   bool created_profile_manager_;
   scoped_ptr<ProfileManager> profile_manager_;
 
diff --git a/chrome/browser/child_process_launcher.cc b/chrome/browser/child_process_launcher.cc
index b7933c6..73cc9dc 100644
--- a/chrome/browser/child_process_launcher.cc
+++ b/chrome/browser/child_process_launcher.cc
@@ -5,7 +5,6 @@
 #include "chrome/browser/child_process_launcher.h"
 
 #include "base/command_line.h"
-#include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/scoped_ptr.h"
 #include "base/thread.h"
@@ -28,16 +27,6 @@
 #include "base/global_descriptors_posix.h"
 #endif
 
-namespace {
-
-class LauncherThread : public base::Thread {
- public:
-  LauncherThread() : base::Thread("LauncherThread") { }
-};
-
-static base::LazyInstance<LauncherThread> launcher(base::LINKER_INITIALIZED);
-}
-
 // Having the functionality of ChildProcessLauncher be in an internal
 // ref counted object allows us to automatically terminate the process when the
 // parent class destructs, while still holding on to state that we need.
@@ -64,11 +53,9 @@ class ChildProcessLauncher::Context
     client_ = client;
 
     CHECK(ChromeThread::GetCurrentThreadIdentifier(&client_thread_id_));
-    if (!launcher.Get().message_loop())
-      launcher.Get().Start();
 
-    launcher.Get().message_loop()->PostTask(
-        FROM_HERE,
+    ChromeThread::PostTask(
+        ChromeThread::PROCESS_LAUNCHER, FROM_HERE,
         NewRunnableMethod(
             this,
             &Context::LaunchInternal,
@@ -209,8 +196,8 @@ class ChildProcessLauncher::Context
 
     // On Posix, EnsureProcessTerminated can lead to 2 seconds of sleep!  So
     // don't this on the UI/IO threads.
-    launcher.Get().message_loop()->PostTask(
-        FROM_HERE,
+    ChromeThread::PostTask(
+        ChromeThread::PROCESS_LAUNCHER, FROM_HERE,
         NewRunnableFunction(
             &ChildProcessLauncher::Context::TerminateInternal,
 #if defined(OS_LINUX)
diff --git a/chrome/browser/chrome_thread.cc b/chrome/browser/chrome_thread.cc
index 65e33e7..f279ed3 100644
--- a/chrome/browser/chrome_thread.cc
+++ b/chrome/browser/chrome_thread.cc
@@ -10,6 +10,7 @@ static const char* chrome_thread_names[ChromeThread::ID_COUNT] = {
   "Chrome_DBThread",  // DB
   "Chrome_WebKitThread",  // WEBKIT
   "Chrome_FileThread",  // FILE
+  "Chrome_ProcessLauncherThread",  // PROCESS_LAUNCHER
   "Chrome_IOThread",  // IO
 #if defined(OS_LINUX)
   "Chrome_Background_X11Thread",  // BACKGROUND_X11
diff --git a/chrome/browser/chrome_thread.h b/chrome/browser/chrome_thread.h
index e72e8b4..e890790 100644
--- a/chrome/browser/chrome_thread.h
+++ b/chrome/browser/chrome_thread.h
@@ -48,6 +48,9 @@ class ChromeThread : public base::Thread {
     // This is the thread that interacts with the file system.
     FILE,
 
+    // Used to launch and terminate processes.
+    PROCESS_LAUNCHER,
+
     // This is the thread that processes IPC and network messages.
     IO,