Fix use-after-free on Linux at shutdown

net/base/network_change_notifier_linux.cc

Index: net/base/network_change_notifier_linux.cc
diff --git a/net/base/network_change_notifier_linux.cc b/net/base/network_change_notifier_linux.cc
index e1e7de025085d08ad7d60c5e56415c4c5aa0bf4d..44af93c793ecdfa5025f76a09bc79eb127c52f7c 100644
--- a/net/base/network_change_notifier_linux.cc
+++ b/net/base/network_change_notifier_linux.cc
@@ -21,11 +21,11 @@ class NetworkChangeNotifierLinux::Thread : public base::Thread {
   // Plumbing for NetworkChangeNotifier::GetCurrentConnectionType.
   // Safe to call from any thread.
   NetworkChangeNotifier::ConnectionType GetCurrentConnectionType() {
-    return address_tracker_.GetCurrentConnectionType();
+    return address_tracker_->GetCurrentConnectionType();
   }
 
   const internal::AddressTrackerLinux* address_tracker() const {
-    return &address_tracker_;
+    return address_tracker_.get();
   }
 
  protected:
@@ -38,7 +38,7 @@ class NetworkChangeNotifierLinux::Thread : public base::Thread {
   void OnLinkChanged();
   scoped_ptr<DnsConfigService> dns_config_service_;
   // Used to detect online/offline state and IP address changes.
-  internal::AddressTrackerLinux address_tracker_;
+  scoped_ptr<internal::AddressTrackerLinux> address_tracker_;
   NetworkChangeNotifier::ConnectionType last_type_;
 
   DISALLOW_COPY_AND_ASSIGN(Thread);
@@ -47,13 +47,13 @@ class NetworkChangeNotifierLinux::Thread : public base::Thread {
 NetworkChangeNotifierLinux::Thread::Thread(
     const base::hash_set<std::string>& ignored_interfaces)
     : base::Thread("NetworkChangeNotifier"),
-      address_tracker_(
+      address_tracker_(new internal::AddressTrackerLinux(
           base::Bind(&NetworkChangeNotifierLinux::Thread::OnIPAddressChanged,
                      base::Unretained(this)),
           base::Bind(&NetworkChangeNotifierLinux::Thread::OnLinkChanged,
                      base::Unretained(this)),
           base::Bind(base::DoNothing),
-          ignored_interfaces),
+          ignored_interfaces)),
       last_type_(NetworkChangeNotifier::CONNECTION_NONE) {
 }
 
@@ -62,13 +62,14 @@ NetworkChangeNotifierLinux::Thread::~Thread() {
 }
 
 void NetworkChangeNotifierLinux::Thread::Init() {
-  address_tracker_.Init();
+  address_tracker_->Init();
   dns_config_service_ = DnsConfigService::CreateSystemService();
   dns_config_service_->WatchConfig(
       base::Bind(&NetworkChangeNotifier::SetDnsConfig));
 }
 
 void NetworkChangeNotifierLinux::Thread::CleanUp() {
+  address_tracker_.reset();

[pauljensen, 2016/03/18 18:27:49]

Can you add a comment like:
// Delete AddressTrackerLinux before MessageLoop gets deleted as
// AddressTrackerLinux's FileDescriptorWatcher holds a pointer to the
// MessageLoop.

   dns_config_service_.reset();
 }