Merge pull request #3629 from ctiller/sharply-sea

Fix use-after-free

src/core/iomgr/pollset_posix.c

@@ -477,6 +477,7 @@ static void basic_pollset_maybe_work_and_unlock(grpc_exec_ctx *exec_ctx,
   if (fd) {
     pfd[2].fd = fd->fd;
     pfd[2].revents = 0;
+    GRPC_FD_REF(fd, "basicpoll_begin");
     gpr_mu_unlock(&pollset->mu);
     pfd[2].events =
         (short)grpc_fd_begin_poll(fd, pollset, POLLIN, POLLOUT, &fd_watcher);
@@ -523,6 +524,10 @@ static void basic_pollset_maybe_work_and_unlock(grpc_exec_ctx *exec_ctx,
       }
     }
   }
+
+  if (fd) {
+    GRPC_FD_UNREF(fd, "basicpoll_begin");
+  }
 }
 
 static void basic_pollset_destroy(grpc_pollset *pollset) {