fix

src/core/client_channel/client_channel.cc

@@ -620,17 +620,17 @@ void ClientChannel::Orphan() {
   if (GRPC_TRACE_FLAG_ENABLED(grpc_client_channel_trace)) {
     gpr_log(GPR_INFO, "client_channel=%p: shutting down", this);
   }
-  Ref().release();
+  auto self = RefAsSubclass<ClientChannel>();
   work_serializer_->Run(
-      [this]() ABSL_EXCLUSIVE_LOCKS_REQUIRED(*work_serializer_) {
-        DestroyResolverAndLbPolicyLocked();
-        Unref();
+      [self]() ABSL_EXCLUSIVE_LOCKS_REQUIRED(*self->work_serializer_) {
+        self->DestroyResolverAndLbPolicyLocked();
       },
       DEBUG_LOCATION);
   // IncreaseCallCount() introduces a phony call and prevents the idle
   // timer from being reset by other threads.
   idle_state_.IncreaseCallCount();
   idle_activity_.Reset();
+  Unref();
 }
 
 grpc_connectivity_state ClientChannel::CheckConnectivityState(

src/core/lib/surface/channel.h

@@ -54,7 +54,7 @@ namespace grpc_core {
 // Forward declaration to avoid dependency loop.
 class Transport;
 
-class Channel : public RefCounted<Channel>,
+class Channel : public InternallyRefCounted<Channel>,
                 public CppImplOf<Channel, grpc_channel> {
  public:
   struct RegisteredCall {
@@ -68,7 +68,18 @@ class Channel : public RefCounted<Channel>,
     ~RegisteredCall();
   };
 
-  virtual void Orphan() = 0;
+  // Though internally ref counted transports expose their "Ref" method to
+  // create a RefCountedPtr to themselves. The OrphanablePtr owner is the
+  // singleton decision maker on whether the transport should be destroyed or
+  // not.
+  // TODO(ctiller): consider moving to a DualRefCounted model (with the
+  // disadvantage that we would accidentally have many strong owners which is
+  // unnecessary for this type).
+  RefCountedPtr<Channel> Ref() { return InternallyRefCounted<Channel>::Ref(); }
+  template <typename T>
+  RefCountedPtr<T> RefAsSubclass() {
+    return InternallyRefCounted<Channel>::RefAsSubclass<T>();
+  }
 
   virtual bool IsLame() const = 0;