Avoid a race between libusb_submit_transfer and libusb_free_transfer.

device/usb/usb_device_handle_impl.cc

Index: device/usb/usb_device_handle_impl.cc
diff --git a/device/usb/usb_device_handle_impl.cc b/device/usb/usb_device_handle_impl.cc
index 921af4f2225f37fc8bda9fdbaf38e5004281745a..bd53ada53288f2645b5207de329d9c69c8bfded7 100644
--- a/device/usb/usb_device_handle_impl.cc
+++ b/device/usb/usb_device_handle_impl.cc
@@ -485,7 +485,7 @@ void UsbDeviceHandleImpl::Transfer::TransferComplete(UsbTransferStatus status,
   task_runner_->PostTask(
       FROM_HERE,
       base::Bind(&UsbDeviceHandleImpl::TransferComplete, device_handle_,
-                 base::Owned(this),
+                 base::Unretained(this),
                  base::Bind(callback_, status, buffer_, bytes_transferred)));
 }
 
@@ -970,6 +970,10 @@ void UsbDeviceHandleImpl::TransferComplete(Transfer* transfer,
   } else {
     transfer->callback_task_runner()->PostTask(FROM_HERE, callback);
   }
+
+  // libusb_free_transfer races with libusb_submit_transfer and only work-
+  // around is to make sure to call them on the same thread.
+  blocking_task_runner_->DeleteSoon(FROM_HERE, transfer);
 }
 
 void UsbDeviceHandleImpl::InternalClose() {