RemoteAudioSourceProviderManager is accessed in non-thread-safe manner The class calls Connection::addWorkQueueMessageReceiver() during its construction, passing 'this' as the receiver. The virtual function pointer is not fully constructed during the call time. Connection may start dispatching calls to the work queue. The work queue may dispatch the task function through that pointer immediately after the call. If a message comes during the constructor call, it may be dispatched during the constructor still running, before the virtual function pointer being correctly set up. Accessing virtual function pointer is not thread safe until it is fully constructed. The class calls Connection::removeWorkQueueMessageReceiver() during its destruction. Connection may still dispatch calls to the work queue and the work queue through the passed in virtual function pointer. The virtual pointer is not as expected anymore at that point, is not thread-safe to read. Upon dispatch, the connection will ref the WorkQueueMessageReceiver. Since the instance might already be in destructor, this is a ref count increase on a destroyed object.