tree 0bac817ec9ff57808602912216b988563f9fb5d1
parent 1ef02db51c16d9dd49338f7f1dc5c1fe4fa15408
author pkalinnikov <pkalinnikov@chromium.org> 1485603624 +0900
committer Qijiang Fan <fqj@google.com> 1591301505 +0900

Do not delete synchronously in OnTaskRunnerDeleter.

Currently OnTaskRunnerDeleter::operator() relies on RunsTasksOnCurrentThread()
method of the TaskRunner. However, the latter has weak guarantees on the
returned value (see the comment to it). It can even always return true.
Therefore, thread-unsafe objects can not be safely deleted  under some
circumstances.

The current implementation also makes such a crashing scenario possible. Suppose
there is an Object living in the SequencedTaskRunner and a Task has been posted
to a TaskRunner to access the Object. After that, the deleter has been invoked
and immediately deleted the Object. After that the Task got to execute in the
TaskRunner, and tries to read from a deleted Object => undefined behavior.

Review-Url: https://codereview.chromium.org/2657283002
Cr-Commit-Position: refs/heads/master@{#446920}


CrOS-Libchrome-Original-Commit: 90cdf584494922804c8d0c81a83bcad271645659