Avoid a race between libusb_submit_transfer and libusb_free_transfer.

device/usb/usb_device_handle_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "device/usb/usb_device_handle_impl.h"
 
 #include <algorithm>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 467 matching lines @@
       reinterpret_cast<Transfer*>(platform_transfer->user_data);
   DCHECK(transfer->platform_transfer_ == platform_transfer);
   transfer->ProcessCompletion();
 }
 
 void UsbDeviceHandleImpl::Transfer::TransferComplete(UsbTransferStatus status,
                                                      size_t bytes_transferred) {
   task_runner_->PostTask(
       FROM_HERE,
       base::Bind(&UsbDeviceHandleImpl::TransferComplete, device_handle_,
-                 base::Owned(this),
+                 base::Unretained(this),
                  base::Bind(callback_, status, buffer_, bytes_transferred)));
 }
 
 scoped_refptr<UsbDevice> UsbDeviceHandleImpl::GetDevice() const {
   return device_;
 }
 
 void UsbDeviceHandleImpl::Close() {
   DCHECK(thread_checker_.CalledOnValidThread());
   if (device_)
@@ skipping 464 matching lines @@
                                            const base::Closure& callback) {
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(ContainsKey(transfers_, transfer)) << "Missing transfer completed";
   transfers_.erase(transfer);
 
   if (transfer->callback_task_runner()->RunsTasksOnCurrentThread()) {
     callback.Run();
   } else {
     transfer->callback_task_runner()->PostTask(FROM_HERE, callback);
   }
+
+  // libusb_free_transfer races with libusb_submit_transfer and only work-
+  // around is to make sure to call them on the same thread.
+  blocking_task_runner_->DeleteSoon(FROM_HERE, transfer);
 }
 
 void UsbDeviceHandleImpl::InternalClose() {
   DCHECK(thread_checker_.CalledOnValidThread());
   if (!device_)
     return;
 
   // Cancel all the transfers.
   for (Transfer* transfer : transfers_) {
     // The callback will be called some time later.
     transfer->Cancel();
   }
 
   // Attempt-release all the interfaces.
   // It will be retained until the transfer cancellation is finished.
   claimed_interfaces_.clear();
 
   // Cannot close device handle here. Need to wait for libusb_cancel_transfer to
   // finish.
   device_ = NULL;
 }
 
 }  // namespace device