Fix race between Thread ctor/dtor and MessageQueueManager registrations.

webrtc/base/messagequeue.h

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 149 matching lines @@
   int cmsDelay_;  // for debugging
   uint32_t msTrigger_;
   uint32_t num_;
   Message msg_;
 };
 
 class MessageQueue {
  public:
   static const int kForever = -1;
 
-  explicit MessageQueue(SocketServer* ss = NULL);
+  explicit MessageQueue(SocketServer* ss = NULL,
+                        bool add_to_queue_manager = true);
+  // NOTE: ALL SUBCLASSES OF MessageQueue MUST CALL DoDestroy() IN THEIR
+  // DESTRUCTORS! This is required to avoid a data race between the destructor
+  // modifying the vtable, and the MessageQueue being removed from the
+  // MessageQueueManager.
   virtual ~MessageQueue();
 
   SocketServer* socketserver() { return ss_; }
   void set_socketserver(SocketServer* ss);
 
   // Note: The behavior of MessageQueue has changed.  When a MQ is stopped,
   // futher Posts and Sends will fail.  However, any pending Sends and *ready*
   // Posts (as opposed to unexpired delayed Posts) will be delivered before
   // Get (or Peek) returns false.  By guaranteeing delivery of those messages,
   // we eliminate the race condition when an MessageHandler and MessageQueue
@@ skipping 53 matching lines @@
     container_type& container() { return c; }
     void reheap() { make_heap(c.begin(), c.end(), comp); }
   };
 
   void DoDelayPost(int cmsDelay,
                    uint32_t tstamp,
                    MessageHandler* phandler,
                    uint32_t id,
                    MessageData* pdata);
 
+  // Perform cleanup, subclasses must call this from the destructor.
+  void DoDestroy();
+
   // The SocketServer is not owned by MessageQueue.
   SocketServer* ss_;
   // If a server isn't supplied in the constructor, use this one.
   scoped_ptr<SocketServer> default_ss_;
   bool fStop_;
   bool fPeekKeep_;
   Message msgPeek_;
   MessageList msgq_;
   PriorityQueue dmsgq_;
   uint32_t dmsgq_next_num_;
   CriticalSection crit_;
+  bool fDestroyed_;
 
  private:
   RTC_DISALLOW_COPY_AND_ASSIGN(MessageQueue);
 };
 
 }  // namespace rtc
 
 #endif  // WEBRTC_BASE_MESSAGEQUEUE_H_