Bug 221891

ThreadMessageReceiverRefCounted subclasses are accessed in non-thread-safe way The subclasses call Connection::addThreadMessageReceiver() during their construction, passing 'this' as the receiver. The virtual function pointer is not fully constructed during the call time. Connection may start dispatching calls through that pointer immediately after the call. If a message comes during the call, it may be dispatched during the subclass constructor still running, before the virtual function pointer being correctly set up. Accessing virtual function pointer is not thread safe until it is fully constructed. The subclasses call Connection::removeThreadMessageReceiver() during their destruction. Connection may still dispatch calls through the passed in virtual function pointer. The virtual pointer is not as expected anymore at that point, is not thread-safe to read. Upon dispatch, the connection will ref the ThreadMessageReceiver. Since the instance might already be in destructor, this is a ref count increase on a destroyed object.