Say you have a base::RefCounted subclass that is internally non-thread-safe (i.e., beyond the reference count itself not being thread safe, the guts of your object are also not thread safe). Such as gfx::Image (see  Issue 600229 ).

So you add a SequenceChecker and call CheckCalledOnValidSequence() in all methods that read and write the internals. This catches bad cases like this:

    void CodeOnUIThread() {
      base::scoped_refptr<MyClass> my_obj(new MyClass(...));
      my_obj.DoSomething();
      PostTaskToFILEThread(base::BindOnce(&CodeOnFILEThread, my_obj));
      my_obj.DoSomethingElse();  // Race with CodeOnFILEThread!
    }

    void CodeOnFILEThread(base::scoped_refptr<MyClass> my_obj) {
      my_obj.DoSomethingOrOther();  // Race with CodeOnUIThread!
    }

But it also catches perfectly safe cases where the object is properly handed off to the other thread, like this:

    void CodeOnUIThread() {
      base::scoped_refptr<MyClass> my_obj(new MyClass(...));
      my_obj.DoSomething();
      PostTaskToFILEThread(base::BindOnce(&CodeOnFILEThread, std::move(my_obj)));
    }

    void CodeOnFILEThread(base::scoped_refptr<MyClass> my_obj) {
      my_obj.DoSomethingOrOther();  // Sole reference holder at this time.
    }

To avoid false positives in the latter case, you have to introduce a method on your object to call SequenceChecker::DetachFromSequence, and call it before a hand-off.

It turns out there's a mechanical rule to determine when to detach from sequence: whenever the reference count drops to 1, detach, and if the reference count is 1, do not attach. Because when the reference count is 1, only one thread can hold a reference to the object. If you follow this rule, you won't catch RAW pointers to the object being passed across threads, but that is obviously bad behaviour; we really just want to catch scoped_refptrs that share an object across threads.

It turns out that base::RefCounted itself already follows this exact rule to automatically trap when the reference count changes. However, the above example DOES NOT change the reference count on the FILE thread so it won't automatically be caught. What we need is a way to expose RefCounted's internal sequence checker to subclasses so that they can manually perform checks in their own methods, and take advantage of the fact that RefCounted automatically detaches when the refcount drops to 1.

NOTE: I tried a more automated approach, DCHECKing the sequence checker whenever get(), operator*() or operator->() is called on a scoped_refptr, but it caused all sorts of trouble including scoped_refptrs to various custom classes that don't inherit from RefCounted, and use of get() from contexts that can't see the full class definition. I think this approach is overkill, so I prefer to just provide a method for manual sequence checking by interested subclasses (and intend to use this in gfx::Image).

Thus I propose a method:

    class RefCountedBase {
     protected:
      bool AccessIsThreadSafe() const {
        return ref_count_ <= 1 || CalledOnValidSequence();
      }
    };

To be used thusly:

    class MyClass {
     public:
      void DoSomething() {
        DCHECK(AccessIsThreadSafe());  // Do this in each method.
        ...
      }
    };