[Synchronization] Fix a crash in WaitableEventWatcher

base/synchronization/waitable_event_watcher.h

Index: base/synchronization/waitable_event_watcher.h
diff --git a/base/synchronization/waitable_event_watcher.h b/base/synchronization/waitable_event_watcher.h
index 4c83e21b289c7e2634a18f954cb635edd31f5357..e514489dbc1f449a844f78cd6ae38a071d0f498c 100644
--- a/base/synchronization/waitable_event_watcher.h
+++ b/base/synchronization/waitable_event_watcher.h
@@ -7,13 +7,14 @@
 
 #include "base/base_export.h"
 #include "base/macros.h"
-#include "base/sequence_checker.h"
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
 #include "base/win/object_watcher.h"
+#include "base/win/scoped_handle.h"
 #else
 #include "base/callback.h"
+#include "base/sequence_checker.h"
 #include "base/synchronization/waitable_event.h"
 #endif
 
@@ -56,7 +57,8 @@ class WaitableEvent;
 // missing a signal.
 //
 // NOTE: you /are/ allowed to delete the WaitableEvent while still waiting on
-// it with a Watcher. It will act as if the event was never signaled.
+// it with a Watcher. But pay attention: if the event was signaled and deleted
+// right after, the callback may be called with deleted WaitableEvent pointer.
 
 class BASE_EXPORT WaitableEventWatcher
 #if defined(OS_WIN)
@@ -90,7 +92,12 @@ class BASE_EXPORT WaitableEventWatcher
 #if defined(OS_WIN)
   void OnObjectSignaled(HANDLE h) override;
 
+  // Duplicated handle of the event passed to StartWatching().
+  win::ScopedHandle duplicated_event_handle_;
+
+  // A watcher for |duplicated_event_handle_|. It MUST outlive that handle.

[danakj, 2017/05/02 14:46:21]

The order is backwards here, watcher_ is created after, and destroyed before the
handle_ if it appears below it in the class.

[atuchin, 2017/05/03 13:01:58]

The comment was wrong: of course the handle must outlive the watcher.
Thanks!

   win::ObjectWatcher watcher_;
+
   EventCallback callback_;
   WaitableEvent* event_ = nullptr;
 #else