diff --git a/net/disk_cache/simple/simple_backend_impl.cc b/net/disk_cache/simple/simple_backend_impl.cc
index 518105a87fbc3..aaa326cc46b4f 100644
--- a/net/disk_cache/simple/simple_backend_impl.cc
+++ b/net/disk_cache/simple/simple_backend_impl.cc
@@ -913,8 +913,14 @@ void SimpleBackendImpl::DoomEntriesComplete(
     std::unique_ptr<std::vector<uint64_t>> entry_hashes,
     CompletionOnceCallback callback,
     int result) {
-  for (const uint64_t& entry_hash : *entry_hashes)
-    post_doom_waiting_->OnOperationComplete(entry_hash);
+  // OnOperationComplete may synchronously invoke consumer callbacks (via
+  // Run(EntryResult)OperationAndCallback when the retried backend op returns
+  // synchronously), which may delete |this|. Take a local ref to the waiter
+  // table so subsequent iterations don't read a freed |post_doom_waiting_|.
+  scoped_refptr<SimplePostOperationWaiterTable> post_doom = post_doom_waiting_;
+  for (const uint64_t& entry_hash : *entry_hashes) {
+    post_doom->OnOperationComplete(entry_hash);
+  }
   std::move(callback).Run(result);
 }