Example build:
https://ci.chromium.org/buildbot/chromium.clang/ToTLinuxUBSanVptr/4504

Example error:

../../base/task/sequence_manager/test/lazy_thread_controller_for_test.cc:122:42: runtime error: member call on address 0x224321dcc0c0 which does not point to an object of type 'base::MessageLoop'
0x224321dcc0c0: note: object has invalid vptr
 00 00 00 00  73 3e e9 70 be dd ff ff  73 dd ed 70 be dd ff ff  2e 6f 72 67 2e 63 68 72  6f 6d 69 75
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr


I'm guessing the MessageLoop object has been free'd. There seems to be other code in the class taking that into account, e.g. here:

  // We can't use message_loop_->IsBoundToCurrentThread as |message_loop_|
  // might be deleted.
  if (MessageLoopCurrent::Get()->ToMessageLoopDeprecated() != message_loop_)
    return;


Perhaps doing the same in RestoreDefaultTaskRunner() will fix things.