[scheduler] Fix crash when posting a cross-task and shutting down queue

Fix a crash when queue was readded to RemoveFromIncomingImmediateWorkList
during unregistration process when a different thread tried to post a
task to it, leaving a dangling pointer.

R=alexclarke@chromium.org

Change-Id: Iac8c207699e3a08a4f792f705841bdfa1839b30c
Reviewed-on: https://chromium-review.googlesource.com/1112239
Commit-Queue: Alexander Timin <altimin@chromium.org>
Reviewed-by: Alex Clarke <alexclarke@chromium.org>
Cr-Commit-Position: refs/heads/master@{#571088}

third_party/blink/renderer/platform/scheduler/base/task_queue_manager_impl.cc

@@ -196,12 +196,16 @@ void TaskQueueManagerImpl::UnregisterTaskQueueImpl(
 
   main_thread_only().selector.RemoveQueue(task_queue.get());
 
+  // After UnregisterTaskQueue returns no new tasks can be posted.
+  // It's important to call it first to avoid race condition between removing
+  // the task queue from various lists here and adding it to the same lists
+  // when posting a task.
+  task_queue->UnregisterTaskQueue();
+
   // Remove |task_queue| from the linked list if present.
   // This is O(n).  We assume this will be a relatively infrequent operation.
   RemoveFromIncomingImmediateWorkList(task_queue.get());
 
-  task_queue->UnregisterTaskQueue();
-
   // Add |task_queue| to |main_thread_only().queues_to_delete| so we can prevent
   // it from being freed while any of our structures hold hold a raw pointer to
   // it.