dawn/wire: Fix dangling pointer on client::Device::DeviceLostEvent

Bug: dawn:2345
Change-Id: Ia25c8af11bbfbafeb69ea44086cb8eeda482eb1a
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/182820
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Austin Eng <enga@chromium.org>
Commit-Queue: Jiawei Shao <jiawei.shao@intel.com>
diff --git a/src/dawn/wire/client/Device.cpp b/src/dawn/wire/client/Device.cpp
index 2ffa77d..0cfe6c8 100644
--- a/src/dawn/wire/client/Device.cpp
+++ b/src/dawn/wire/client/Device.cpp
@@ -179,7 +179,7 @@
         mDevice->Reference();
     }
 
-    ~DeviceLostEvent() override { mDevice->Release(); }
+    ~DeviceLostEvent() override { mDevice.ExtractAsDangling()->Release(); }
 
     EventType GetType() override { return kType; }
 
@@ -199,14 +199,14 @@
             mMessage = "A valid external Instance reference no longer exists.";
         }
 
+        void* userdata = mDevice->mDeviceLostInfo.userdata.ExtractAsDangling();
         if (mDevice->mDeviceLostInfo.oldCallback != nullptr) {
             mDevice->mDeviceLostInfo.oldCallback(mReason, mMessage ? mMessage->c_str() : nullptr,
-                                                 mDevice->mDeviceLostInfo.userdata);
+                                                 userdata);
         } else if (mDevice->mDeviceLostInfo.callback != nullptr) {
             auto device = mReason != WGPUDeviceLostReason_FailedCreation ? ToAPI(mDevice) : nullptr;
             mDevice->mDeviceLostInfo.callback(&device, mReason,
-                                              mMessage ? mMessage->c_str() : nullptr,
-                                              mDevice->mDeviceLostInfo.userdata);
+                                              mMessage ? mMessage->c_str() : nullptr, userdata);
         }
         mDevice->mUncapturedErrorCallbackInfo = kEmptyUncapturedErrorCallbackInfo;
     }
@@ -217,8 +217,7 @@
     std::optional<std::string> mMessage;
 
     // Strong reference to the device so that when we call the callback we can pass the device.
-    // TODO(https://crbug.com/dawn/2345): Investigate `DanglingUntriaged` in dawn/wire.
-    raw_ptr<Device, DanglingUntriaged> mDevice;
+    raw_ptr<Device> mDevice;
 };
 
 Device::Device(const ObjectBaseParams& params,
diff --git a/src/dawn/wire/client/Device.h b/src/dawn/wire/client/Device.h
index 4467c4b..ab07cc70 100644
--- a/src/dawn/wire/client/Device.h
+++ b/src/dawn/wire/client/Device.h
@@ -108,14 +108,12 @@
         std::unique_ptr<TrackedEvent> event = nullptr;
         WGPUDeviceLostCallbackNew callback = nullptr;
         WGPUDeviceLostCallback oldCallback = nullptr;
-        // TODO(https://crbug.com/dawn/2345): Investigate `DanglingUntriaged` in dawn/wire:
-        raw_ptr<void, DanglingUntriaged> userdata = nullptr;
+        raw_ptr<void> userdata = nullptr;
     };
     DeviceLostInfo mDeviceLostInfo;
 
     WGPUUncapturedErrorCallbackInfo mUncapturedErrorCallbackInfo;
     WGPULoggingCallback mLoggingCallback = nullptr;
-    // TODO(https://crbug.com/dawn/2345): Investigate `DanglingUntriaged` in dawn/wire:
     raw_ptr<void> mLoggingUserdata = nullptr;
 
     raw_ptr<Queue> mQueue = nullptr;