[Synchronization] Fix a crash in WaitableEventWatcher

base/synchronization/waitable_event_watcher.h

Index: base/synchronization/waitable_event_watcher.h
diff --git a/base/synchronization/waitable_event_watcher.h b/base/synchronization/waitable_event_watcher.h
index 4c83e21b289c7e2634a18f954cb635edd31f5357..487fd5e6dadb306d456428adce9b8667cd3c8b0d 100644
--- a/base/synchronization/waitable_event_watcher.h
+++ b/base/synchronization/waitable_event_watcher.h
@@ -7,13 +7,14 @@
 
 #include "base/base_export.h"
 #include "base/macros.h"
-#include "base/sequence_checker.h"
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
 #include "base/win/object_watcher.h"
+#include "base/win/scoped_handle.h"
 #else
 #include "base/callback.h"
+#include "base/sequence_checker.h"
 #include "base/synchronization/waitable_event.h"
 #endif
 
@@ -56,7 +57,8 @@ class WaitableEvent;
 // missing a signal.
 //
 // NOTE: you /are/ allowed to delete the WaitableEvent while still waiting on
-// it with a Watcher. It will act as if the event was never signaled.
+// it with a Watcher. But pay attention: if the event was signaled and deleted
+// right after, the callback may be called with deleted WaitableEvent pointer.
 
 class BASE_EXPORT WaitableEventWatcher
 #if defined(OS_WIN)
@@ -90,7 +92,13 @@ class BASE_EXPORT WaitableEventWatcher
 #if defined(OS_WIN)
   void OnObjectSignaled(HANDLE h) override;
 
+  // Duplicated handle of the event passed to StartWatching().
+  win::ScopedHandle duplicated_event_handle_;
+
+  // A watcher for |duplicated_event_handle_|. The handle MUST outlive
+  // |watcher_|.
   win::ObjectWatcher watcher_;
+
   EventCallback callback_;
   WaitableEvent* event_ = nullptr;
 #else