2 files changed, 18 insertions, 3 deletions
diff --git a/remoting/host/video_scheduler.cc b/remoting/host/video_scheduler.cc
index cfc6827..c2a797e 100644
--- a/remoting/host/video_scheduler.cc
+++ b/remoting/host/video_scheduler.cc
@@ -176,9 +176,12 @@ void VideoScheduler::StopOnCaptureThread(const base::Closure& done_task) {
   // |capture_timer_| must be destroyed on the thread on which it is used.
   capture_timer_.reset();
 
-  // Activity on the encode thread will stop implicitly as a result of
-  // captures having stopped.
-  network_task_runner_->PostTask(FROM_HERE, done_task);
+  // Ensure that the encode thread is no longer processing capture data,
+  // otherwise tearing down |capturer_| will crash it.  See crbug.com/163641.
+  // TODO(wez): Make it safe to tear down capturer while buffers remain, and
+  // remove this work-around.
+  capture_task_runner_->PostTask(FROM_HERE,
+      base::Bind(&VideoScheduler::StopOnEncodeThread, this, done_task));
 }
 
 void VideoScheduler::ScheduleNextCapture() {
@@ -302,4 +305,12 @@ void VideoScheduler::EncodedDataAvailableCallback(
                             base::Passed(&packet)));
 }
 
+void VideoScheduler::StopOnEncodeThread(const base::Closure& done_task) {
+  DCHECK(encode_task_runner_->BelongsToCurrentThread());
+
+  // This is posted by StopOnCaptureThread, so we know that by the time we
+  // process it there are no more encode tasks queued.
+  network_task_runner_->PostTask(FROM_HERE, done_task);
+}
+
 }  // namespace remoting
diff --git a/remoting/host/video_scheduler.h b/remoting/host/video_scheduler.h
index 9eafc22..8671530 100644
--- a/remoting/host/video_scheduler.h
+++ b/remoting/host/video_scheduler.h
@@ -155,6 +155,10 @@ class VideoScheduler : public base::RefCountedThreadSafe<VideoScheduler>,
 
   void EncodedDataAvailableCallback(scoped_ptr<VideoPacket> packet);
 
+  // Used to synchronize capture and encode thread teardown, notifying the
+  // network thread when done.
+  void StopOnEncodeThread(const base::Closure& done_task);
+
   // Task runners used by this class.
   scoped_refptr<base::SingleThreadTaskRunner> capture_task_runner_;
   scoped_refptr<base::SingleThreadTaskRunner> encode_task_runner_;