Fix race between Thread ctor/dtor and MessageQueueManager registrations.

webrtc/base/messagequeue.h

Index: webrtc/base/messagequeue.h
diff --git a/webrtc/base/messagequeue.h b/webrtc/base/messagequeue.h
index 856a6eb4bc89cc1c71c9cb520d3ee2493d92075a..0b5581761ec210094c97d3c535045e4cd5dc22a5 100644
--- a/webrtc/base/messagequeue.h
+++ b/webrtc/base/messagequeue.h
@@ -167,7 +167,12 @@ class MessageQueue {
  public:
   static const int kForever = -1;
 
-  explicit MessageQueue(SocketServer* ss = NULL);
+  explicit MessageQueue(SocketServer* ss = NULL,
+                        bool add_to_queue_manager = true);
+  // NOTE: ALL SUBCLASSES OF MessageQueue MUST CALL DoDestroy() IN THEIR
+  // DESTRUCTORS! This is required to avoid a data race between the destructor
+  // modifying the vtable, and the MessageQueue being removed from the
+  // MessageQueueManager.
   virtual ~MessageQueue();
 
   SocketServer* socketserver() { return ss_; }
@@ -241,6 +246,9 @@ class MessageQueue {
                    uint32_t id,
                    MessageData* pdata);
 
+  // Perform cleanup, subclasses must call this from the destructor.
+  void DoDestroy();
+
   // The SocketServer is not owned by MessageQueue.
   SocketServer* ss_;
   // If a server isn't supplied in the constructor, use this one.
@@ -252,6 +260,7 @@ class MessageQueue {
   PriorityQueue dmsgq_;
   uint32_t dmsgq_next_num_;
   CriticalSection crit_;
+  bool fDestroyed_;
 
  private:
   RTC_DISALLOW_COPY_AND_ASSIGN(MessageQueue);