The base::CancelableCallback has very specific requirements on the consumer code that must be followed for the thread safety:

// CancelableCallback objects must be created on, posted to, cancelled on, and
// destroyed on the same thread.
https://cs.chromium.org/chromium/src/base/cancelable_callback.h?l=16

However, these requirements are not covered with any debug checks.

Quick test (introducing ThreadChecker into CancelableCallback and running all tests) shows that there is some code that actually violates these thread safety requirements.