ThreadWatcher: fix use-after-delete bug.

chrome/browser/metrics/thread_watcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/metrics/thread_watcher.h"
 
 #include <math.h>  // ceil
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
@@ skipping 868 matching lines @@
   DCHECK_EQ(thread_id_, base::PlatformThread::CurrentId());
   DCHECK(!startup_watchdog_);
   startup_watchdog_ = new StartupWatchDogThread(duration);
   startup_watchdog_->Arm();
   return;
 }
 
 void StartupTimeBomb::Disarm() {
   DCHECK_EQ(thread_id_, base::PlatformThread::CurrentId());
   if (startup_watchdog_) {
-    startup_watchdog_->Disarm();
-    startup_watchdog_->Cleanup();
-    DeleteStartupWatchdog();
+    base::Watchdog* startup_watchdog = startup_watchdog_;
+    startup_watchdog_ = nullptr;
+
+    startup_watchdog->Disarm();
+    startup_watchdog->Cleanup();
+    DeleteStartupWatchdog(thread_id_, startup_watchdog);
   }
 }
 
-void StartupTimeBomb::DeleteStartupWatchdog() {
-  DCHECK_EQ(thread_id_, base::PlatformThread::CurrentId());
-  if (startup_watchdog_->IsJoinable()) {
+// static
+void StartupTimeBomb::DeleteStartupWatchdog(
+    const base::PlatformThreadId thread_id,

[wzhong, 2016/08/30 23:08:39]

Nit: const is not needed.

+    base::Watchdog* startup_watchdog) {
+  DCHECK_EQ(thread_id, base::PlatformThread::CurrentId());
+  if (startup_watchdog->IsJoinable()) {
     // Allow the watchdog thread to shutdown on UI. Watchdog thread shutdowns
     // very fast.
     base::ThreadRestrictions::ScopedAllowIO allow_io;
-    delete startup_watchdog_;
-    startup_watchdog_ = nullptr;
+    delete startup_watchdog;
     return;
   }
   base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, base::Bind(&StartupTimeBomb::DeleteStartupWatchdog,
-                            base::Unretained(this)),
+      FROM_HERE, base::Bind(&StartupTimeBomb::DeleteStartupWatchdog, thread_id,
+                            base::Unretained(startup_watchdog)),
       base::TimeDelta::FromSeconds(10));
 }
 
 // static
 void StartupTimeBomb::DisarmStartupTimeBomb() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   if (g_startup_timebomb_)
     g_startup_timebomb_->Disarm();
 }
 
@@ skipping 81 matching lines @@
 
 #if defined(OS_WIN)
   // On Windows XP, give twice the time for shutdown.
   if (base::win::GetVersion() <= base::win::VERSION_XP)
     actual_duration *= 2;
 #endif
 
   shutdown_watchdog_ = new ShutdownWatchDogThread(actual_duration);
   shutdown_watchdog_->Arm();
 }