From f2f3edbacd36cddea9868ea5f9935e18a5f05c78 Mon Sep 17 00:00:00 2001
From: Yash Tibrewal <yashkt@google.com>
Date: Mon, 31 Aug 2020 15:33:38 -0700
Subject: [PATCH] Fix use-after-free

---
 src/core/ext/transport/chttp2/transport/chttp2_transport.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ext/transport/chttp2/transport/chttp2_transport.cc b/src/core/ext/transport/chttp2/transport/chttp2_transport.cc
index cb443df57ef..20823c84215 100644
--- a/src/core/ext/transport/chttp2/transport/chttp2_transport.cc
+++ b/src/core/ext/transport/chttp2/transport/chttp2_transport.cc
@@ -2661,8 +2661,8 @@ static void next_bdp_ping_timer_expired_locked(void* tp, grpc_error* error) {
   }
   if (t->flow_control->bdp_estimator()->accumulator() == 0) {
     // Block the bdp ping till we receive more data.
-    GRPC_CHTTP2_UNREF_TRANSPORT(t, "bdp_ping");
     t->bdp_ping_blocked = true;
+    GRPC_CHTTP2_UNREF_TRANSPORT(t, "bdp_ping");
   } else {
     schedule_bdp_ping_locked(t);
   }