Fix UAF on libusb thread

device/usb/usb_context.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "device/usb/usb_context.h"
 
 #include "base/atomicops.h"
 #include "base/logging.h"
 #include "base/threading/platform_thread.h"
 #include "device/usb/usb_error.h"
@@ skipping 43 matching lines @@
       VLOG(1) << "Failed to handle events: "
               << ConvertPlatformUsbErrorToString(rv);
     }
   }
 
   VLOG(1) << "UsbEventHandler shutting down.";
   delete this;
 }
 
 void UsbContext::UsbEventHandler::Stop() {
+  base::PlatformThreadHandle thread_handle = thread_handle_;
   base::subtle::Release_Store(&running_, 0);
   libusb_interrupt_handle_event(context_);

[Reilly Grant (use Gerrit), 2015/08/10 17:14:08]

context_ could also have been freed if there was another event that woke up the
thread and caused it to observe running_ == 0.

-  base::PlatformThread::Join(thread_handle_);
+  base::PlatformThread::Join(thread_handle);
 }
 
 UsbContext::UsbContext(PlatformUsbContext context) : context_(context) {
   // Ownership of the PlatformUsbContext is passed to the event handler thread.
   event_handler_ = new UsbEventHandler(context_);
 }
 
 UsbContext::~UsbContext() {
   DCHECK(thread_checker_.CalledOnValidThread());
   event_handler_->Stop();
 }
 
 }  // namespace device