Proof of concept about BlameContext races on dtor.

base/trace_event/blame_context_unittest.cc

Index: base/trace_event/blame_context_unittest.cc
diff --git a/base/trace_event/blame_context_unittest.cc b/base/trace_event/blame_context_unittest.cc
index 7217d8fb1bb6e305621b0d475b72f1e2e63aa5b3..c139eb95c71855f873b0d0864f13c5be3331b7f1 100644
--- a/base/trace_event/blame_context_unittest.cc
+++ b/base/trace_event/blame_context_unittest.cc
@@ -4,6 +4,8 @@
 
 #include "base/trace_event/blame_context.h"
 
+#include <unistd.h>
+
 #include "base/json/json_writer.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/run_loop.h"
@@ -211,6 +213,42 @@ TEST_F(BlameContextTest, TakeSnapshot) {
   EXPECT_EQ(kExpectedSnapshotJson, snapshot_json);
 }
 
+class TestBlameContextWithSleep : public BlameContext {
+ public:
+  TestBlameContextWithSleep()
+      : BlameContext(kTestBlameContextCategory,
+                     kTestBlameContextName,
+                     kTestBlameContextType,
+                     kTestBlameContextScope,
+                     0,
+                     nullptr), destroyed_(false) {}
+
+ ~TestBlameContextWithSleep() override {
+    destroyed_ = true;
+    usleep(200000);  //anything longer than the PostDelayedTask below.
+ }
+
+ protected:
+  void AsValueInto(trace_event::TracedValue* state) override {
+    CHECK(!destroyed_) << "KABOOM, calling the derived AsValueInto after its "
+                          "dtor. Weird things will happen now.";
+  }
+
+  bool destroyed_;
+};
+
+TEST_F(BlameContextTest, DTOR) {
+  Thread thread("test thread");
+  thread.Start();
+  thread.task_runner()->PostDelayedTask(
+      FROM_HERE,
+      base::Bind(&BlameContextTest::StartTracing, base::Unretained(this)),
+      TimeDelta::FromMicroseconds(100000));
+  std::unique_ptr<TestBlameContextWithSleep> derived(new TestBlameContextWithSleep());
+  derived->Initialize();
+  derived.reset();
+}
+
 }  // namepace
 }  // namespace trace_event
 }  // namespace base