The test DownloadTest.DownloadDangerousBlobData when the scoped_refptr<network::SharedURLLoaderFactory> is destroyed (which happens in download::DownloadItemImpl::Start as it is unused).

This is because the method is invoked via a task posted on the UI thread. With NetworkService enabled, then DownloadManagerImpl is the sole owner of that scoped_refptr<> and if DownloadItemImpl does not use it (which happen in the test), then the network::SharedURLLoaderFactory is deallocated on the UI thread.

However, SharedURLLoaderFactory documentation says it should only be used on a single sequence:

  // A SharedURLLoaderFactory instance is supposed to be used on a single
  // sequence. To use it on a different sequence, use Clone() and pass the
  // resulting SharedURLLoaderFactoryInfo instance to the target sequence. On the
  // target sequence, call SharedURLLoaderFactory::Create() to convert the info
  // instance to a new SharedURLLoaderFactory.

So I think the DownloadManagerImpl code is incorrect as it move the object across thread. Instead it should according to the documentation use Clone to get a SharedURLLoaderFactoryInfo and recreate the factory on the other instance. Or maybe the factory should be detached from the current sequence before being passed to the DownloadManagerImpl.