Note that this issue apparently predates https://chromium.googlesource.com/chromium/src/+/a5551160acdfd8e19f0d12f79e7777b3fcb47762 , even though that introduced the ProxyResolvingClientSocketFactory, in that prior to that change, the on-the-fly constructed HttpNetworkSessions still relied on the URLRequestContext's members, and the HttpNetworkSessions created for the individual ProxyResolvingClientSocket's could still outlive the URLRequestContext.

+nasko, who davidben suggested may know about RenderProcessHostImpl and when Profiles and URLRequestContexts are going away.

I'm trying to find where I came across this and am failing, but I recall concluding somewhere that every BrowserMessageFilter had to be assumed to have lifetime infinity. Which makes sense given that it's ref-counted, but yeah. I suspect the answer is it needs to shut itself off in OnChannelClosing or something, but I'm not sure.

Ah, I'd missed when talking with David that individual MessageFilters gets an OnChannelClosing.

I'm not sure who an effective reviewer for RenderProcessHost lifetime expectations will be, but I'll work up a CL that resets the ProxyResolvingClientSocketFactory in the OnChannelClosing, along with updating the methods to handle no RPCSF existing (in the event of delayed IPCs) which can also handle the URLRequestContextGetter returning NULL when trying to create a new PRCSF.

I am working on a CL that migrates P2PSocketDispatcherHost to using NetworkService. P2P won't have direct access to URLRequestContext. Hopefully that will solve this lifetime problem.

I have https://chromium-review.googlesource.com/c/chromium/src/+/1128404 up to address this before then :)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8f2735dcd33dc628808a08d0cbafeeaa0e56421c

commit 8f2735dcd33dc628808a08d0cbafeeaa0e56421c
Author: Ryan Sleevi <rsleevi@chromium.org>
Date: Wed Jul 11 04:57:40 2018

Ensure P2PSocketDispatcherHost gracefully cleans up

During shutdown, the P2PSocketDispatcherHost may still be
holding on to resources referring back to the
URLRequestContext used to create it, but after that
URLRequestContext has already shut down.

Gracefully clean up these resources when the MessageFilter
signals that the channel is closing, so that the correct
shutdown sequence order is observed.

BUG= 860837 

Change-Id: Ie4c2ed24cebc619c40468ca9720d521dfcf1962e
Reviewed-on: https://chromium-review.googlesource.com/1128404
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Reviewed-by: Sergey Ulanov <sergeyu@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#574080}
[modify] https://crrev.com/8f2735dcd33dc628808a08d0cbafeeaa0e56421c/content/browser/renderer_host/p2p/socket_dispatcher_host.cc