MediaStreamCaptureIndicator: fix crash due to destruction on wrong thread

chrome/browser/media/media_stream_capture_indicator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/media/media_stream_capture_indicator.h"
 
 #include "base/bind.h"
 #include "base/i18n/rtl.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/app/chrome_command_ids.h"
@@ skipping 104 matching lines @@
     const MediaStreamCaptureIndicator::CaptureDeviceTab& tab) {
     return (render_process_id_ == tab.render_process_id &&
             render_view_id_ == tab.render_view_id);
 }
 
 MediaStreamCaptureIndicator::MediaStreamCaptureIndicator()
     : status_icon_(NULL),
       mic_image_(NULL),
       camera_image_(NULL),
       balloon_image_(NULL),
-      ALLOW_THIS_IN_INITIALIZER_LIST(tracker_(this)),
       request_index_(0) {
 }
 
 MediaStreamCaptureIndicator::~MediaStreamCaptureIndicator() {
   // The user is responsible for cleaning up by closing all the opened devices.
   DCHECK(tabs_.empty());
 }
 
 bool MediaStreamCaptureIndicator::IsCommandIdChecked(
     int command_id) const {
@@ skipping 132 matching lines @@
     message_id = IDS_MEDIA_STREAM_STATUS_TRAY_BALLOON_BODY_AUDIO_ONLY;
   else if (!audio && video)
     message_id = IDS_MEDIA_STREAM_STATUS_TRAY_BALLOON_BODY_VIDEO_ONLY;
 
   const extensions::Extension* extension =
       GetExtension(render_process_id, render_view_id);
   if (extension) {
     pending_messages_[request_index_++] =
         l10n_util::GetStringFUTF16(message_id,
                                    UTF8ToUTF16(extension->name()));
-    tracker_.LoadImage(
+    EnsureImageLoadingTracker();
+    tracker_->LoadImage(
         extension,
         extension->GetIconResource(32, ExtensionIconSet::MATCH_BIGGER),
         gfx::Size(32, 32),
         ImageLoadingTracker::CACHE);
     return;
   }
 
   string16 title = l10n_util::GetStringUTF16(IDS_PRODUCT_NAME);
   string16 body = l10n_util::GetStringFUTF16(message_id,
       GetSecurityOrigin(render_process_id, render_view_id));
@@ skipping 11 matching lines @@
   status_icon_->DisplayBalloon(
       !image.IsEmpty() ? *image.ToImageSkia() :
           *ResourceBundle::GetSharedInstance().GetImageSkiaNamed(
               IDR_APP_DEFAULT_ICON),
       string16(),
       message);
 }
 
 void MediaStreamCaptureIndicator::Hide() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+
+  // We have to destroy |tracker_| on the UI thread.
+  tracker_.reset();
+
   if (!status_icon_)
     return;
 
   // If there is no browser process, we should not do anything.
   if (!g_browser_process)
     return;
 
   StatusTray* status_tray = g_browser_process->status_tray();
   if (status_tray != NULL) {
     status_tray->RemoveStatusIcon(status_icon_);
@@ skipping 118 matching lines @@
   // Remove the tab if all the devices have been closed.
   if (iter->audio_ref_count == 0 && iter->video_ref_count == 0)
     tabs_.erase(iter);
 
   if (tabs_.empty())
     Hide();
   else
     UpdateStatusTrayIconContextMenu();
 }
 
+void MediaStreamCaptureIndicator::EnsureImageLoadingTracker() {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  if (tracker_.get())
+    return;
+
+  tracker_.reset(new ImageLoadingTracker(this));
+  pending_messages_.clear();
+  request_index_ = 0;
+}