Access ChromotingHost::clients_ only on network thread.

remoting/host/client_session.cc

Index: remoting/host/client_session.cc
diff --git a/remoting/host/client_session.cc b/remoting/host/client_session.cc
index d59c3a61b75c54b3856b87f4d3061f019b413fe2..9baf6f7d58d2b802054ebbd4194bf4188662d209 100644
--- a/remoting/host/client_session.cc
+++ b/remoting/host/client_session.cc
@@ -101,7 +101,6 @@ void ClientSession::OnConnectionClosed(
   DCHECK_EQ(connection_.get(), connection);
   scoped_refptr<ClientSession> self = this;
   event_handler_->OnSessionClosed(this);
-  Disconnect();
 }
 
 void ClientSession::OnConnectionFailed(
@@ -110,7 +109,6 @@ void ClientSession::OnConnectionFailed(
   // TODO(sergeyu): Log failure reason?
   scoped_refptr<ClientSession> self = this;
   event_handler_->OnSessionClosed(this);
-  Disconnect();
 }
 
 void ClientSession::OnSequenceNumberUpdated(
@@ -120,9 +118,13 @@ void ClientSession::OnSequenceNumberUpdated(
 }
 
 void ClientSession::Disconnect() {
-  connection_->Disconnect();
+  DCHECK(connection_);
   authenticated_ = false;
   RestoreEventState();
+
+  // This triggers OnSessionClosed() and the session may be destroyed
+  // as the result, so this call must be the last in this method.
+  connection_->Disconnect();
 }
 
 void ClientSession::LocalMouseMoved(const SkIPoint& mouse_pos) {