Fix potential deadlock in TaskQueue's libevent PostTaskAndReply implementation

webrtc/base/task_queue_gcd.cc

 /*
  *  Copyright 2016 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 51 matching lines @@
 // Special case context for holding two tasks, a |first_task| + the task
 // that's owned by the parent struct, TaskContext, that then becomes the
 // second (i.e. 'reply') task.
 struct TaskQueue::PostTaskAndReplyContext : public TaskQueue::TaskContext {
   explicit PostTaskAndReplyContext(QueueContext* first_queue_ctx,
                                    std::unique_ptr<QueuedTask> first_task,
                                    QueueContext* second_queue_ctx,
                                    std::unique_ptr<QueuedTask> second_task)
       : TaskContext(second_queue_ctx, std::move(second_task)),
         first_queue_ctx(first_queue_ctx),
-        first_task(std::move(first_task)) {
+        first_task(std::move(first_task)),
+        reply_queue_(second_queue_ctx->queue->queue_) {
     // Retain the reply queue for as long as this object lives.
     // If we don't, we may have memory leaks and/or failures.
-    dispatch_retain(first_queue_ctx->queue->queue_);
+    dispatch_retain(reply_queue_);
   }
-  ~PostTaskAndReplyContext() override {
-    dispatch_release(first_queue_ctx->queue->queue_);
-  }
+  ~PostTaskAndReplyContext() override { dispatch_release(reply_queue_); }
 
   static void RunTask(void* context) {
     auto* rc = static_cast<PostTaskAndReplyContext*>(context);
     if (rc->first_queue_ctx->is_active) {
       AutoSetCurrentQueuePtr set_current(rc->first_queue_ctx->queue);
       if (!rc->first_task->Run())
         rc->first_task.release();
     }
     // Post the reply task.  This hands the work over to the parent struct.
     // This task will eventually delete |this|.
-    dispatch_async_f(rc->queue_ctx->queue->queue_, rc, &TaskContext::RunTask);
+    dispatch_async_f(rc->reply_queue_, rc, &TaskContext::RunTask);
   }
 
   QueueContext* const first_queue_ctx;
   std::unique_ptr<QueuedTask> first_task;
+  dispatch_queue_t reply_queue_;
 };
 
 TaskQueue::TaskQueue(const char* queue_name)
     : queue_(dispatch_queue_create(queue_name, DISPATCH_QUEUE_SERIAL)),
       context_(new QueueContext(this)) {
   RTC_DCHECK(queue_name);
   RTC_CHECK(queue_);
   dispatch_set_context(queue_, context_);
   // Assign a finalizer that will delete the context when the last reference
   // to the queue is released.  This may run after the TaskQueue object has
@@ skipping 53 matching lines @@
       context_, std::move(task), reply_queue->context_, std::move(reply));
   dispatch_async_f(queue_, context, &PostTaskAndReplyContext::RunTask);
 }
 
 void TaskQueue::PostTaskAndReply(std::unique_ptr<QueuedTask> task,
                                  std::unique_ptr<QueuedTask> reply) {
   return PostTaskAndReply(std::move(task), std::move(reply), Current());
 }
 
 }  // namespace rtc