According to the document,
https://cs.chromium.org/chromium/src/dbus/object_proxy.h?l=123

"As it's called in the origin thread, |callback| can safely reference objects in the origin thread."

However, we have edge cases.
The callback will be sent to DBusThread once, and post back to the original thread.
If "post back" fails for some reason (e.g. on shutdown UI thread is stopped before DBusThread), the callback will be destroyed on DBusThread, including the bound arguments, so not safe enough, unfortunately.
One of the root causes of crbug.com/746463 is this.

We have several options;
1) Destroy callback on the original thread always. In case of failure, leak it. This is the same approach for base::PostTaskAndReply().

2) Let callers (i.e., here callers mean not only chromeos/dbus *Client implementation but also their callers, too) have the responsibility to ensure thread-safeness. I.e., add restriction that all bound arguments must be destroyable on a thread other than the original one.

3) Introduce a layer to handle it around chromeos/dbus. E.g., add a wrapper for ObjectProxy, which lives on UI. Like;

Wrapper::CallMethod(..., callback) {
  int call_id = current_call_id_++;
  callback_map_[call_id] = std::move(callback);
  proxy_->CallMethod(..., base::BindOnce(&OnCallMethod, weak_ptr_factory_.GetWeakptr(), call_id));
}

Wrapper::OnCallMethod(int call_id, ...) {
  auto it = callback_map_.find(call_id);
  If (it == end()) ... error ...;
  auto callback = std::move(it->second);
  callback_map_.erase(it);
  std::move(callback).Run(...);
}

then, let chromeos/dbus clients use it always, so that their callers can safely bind args.

In any case, it's nice to update the ObjectProxy::CallMethod()'s document.
D-Bus experts, WDYT?