Version: Chromium master revision 3a87aecc (#433059)
OS: Ubuntu 14.04 64-bit

What steps will reproduce the problem?
(1) Delete a Profile object

What is the expected result?
Chromium should not crash.

What happens instead?
PrintingMessageFilter uses std::unique_ptr<BooleanPrefMember, content::BrowserThread::DeleteOnUIThread>. The Profile object (and the PrefService that it owns) may be deleted on the UI thread before the PrefMember object is deleted on the UI thread due to the async execution of DeleteOnUIThread. This results in a heap-use-after-free when the PrefMember is deleted due to it referencing the (already deleted) PrefService.

Please use labels and text to provide additional information.
PrintingMessageFilter should be modified so that it:

(1) Overrides OnDestruct() to delete the PrintingMessageFilter on the UI thread, and;
(2) Does not store the BooleanPrefMember in a std::unique_ptr, and;
(3) Uses KeyedServiceShutdownNotifier to call a ShutdownOnUIThread method when the associated Profile object is deleted. ShutdownOnUIThread then calls PrefMember::Detach().

After these changes it will not matter which is deleted first on the UI thread; the PrintingMessageFilter or the Profile. If the PrintingMessageFilter is deleted first then the PrefMember will be deleted via PrintingMessageFilter destruction. If the Profile is deleted first then PrefMember::Detach() will be called from ShutdownOnUIThread.

See ShutdownNotifierFactory in extensions/browser/extension_message_filter.cc for an example of this design.

Related discussion in https://groups.google.com/a/chromium.org/d/msg/chromium-dev/O1g0786S3ZY/KdCSFwRRBgAJ.