In the CronetEnvironment destructor, we post a task to execute PrepareForDestroyOnNetworkThread to network thread and wait until all network thread tasks are completed. There is a chance that between posting the task and waiting for all tasks to complete, somebody will post another task that relies on CronetEnvironment members being alive. As the result, the PrepareForDestroyOnNetworkThread will complete and invalidate the member variables; and the task that follows will crash.
CronetEnvironment::~CronetEnvironment() {
PostToNetworkThread(
FROM_HERE,
base::Bind(&CronetEnvironment::PrepareForDestroyOnNetworkThread,
base::Unretained(this)));
// Some
if (network_io_thread_) {
// Deleting a thread blocks the current thread and waits until all pending
// tasks are completed.
network_io_thread_.reset(nullptr);
}
}
Comment 1 by bugdroid1@chromium.org
, Sep 8 2017