Speculative fix for crash in DOMUIThumbnailSource.

chrome/browser/dom_ui/chrome_url_data_manager.h

-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_DOM_UI_CHROME_URL_DATA_MANAGER_H_
 #define CHROME_BROWSER_DOM_UI_CHROME_URL_DATA_MANAGER_H_
 #pragma once
 
 #include <map>
 #include <string>
 
 #include "base/task.h"
-#include "base/ref_counted_memory.h"
+#include "base/ref_counted.h"
+#include "chrome/browser/chrome_thread.h"
 
 class DictionaryValue;
 class FilePath;
 class GURL;
 class MessageLoop;
+class RefCountedMemory;
 class URLRequest;
 class URLRequestChromeJob;
 class URLRequestJob;
 
 // To serve dynamic data off of chrome: URLs, implement the
 // ChromeURLDataManager::DataSource interface and register your handler
 // with AddDataSource.
 
 // ChromeURLDataManager lives on the IO thread, so any interfacing with
 // it from the UI thread needs to go through an InvokeLater.
 class ChromeURLDataManager {
  public:
   ChromeURLDataManager();
   ~ChromeURLDataManager();
 
   typedef int RequestID;
 
   // A DataSource is an object that can answer requests for data
-  // asynchronously.  It should live on a thread that outlives the IO thread
-  // (in particular, the UI thread).
-  // An implementation of DataSource should handle calls to StartDataRequest()
-  // by starting its (implementation-specific) asynchronous request for
-  // the data, then call SendResponse() to notify
-  class DataSource : public base::RefCountedThreadSafe<DataSource> {
+  // asynchronously. DataSources are collectively owned with refcounting smart
+  // pointers and should never be deleted on the IO thread, since their calls
+  // are handled almost always on the UI thread and there's a possibility of a
+  // data race.
+  //
+  // An implementation of DataSource should handle calls to
+  // StartDataRequest() by starting its (implementation-specific) asynchronous
+  // request for the data, then call SendResponse() to notify
+  class DataSource
+      : public base::RefCountedThreadSafe<DataSource,
+                                          ChromeThread::DeleteOnUIThread> {
    public:
     // See source_name_ and message_loop_ below for docs on these parameters.
     DataSource(const std::string& source_name,
-               MessageLoop* message_loop)
-        : source_name_(source_name), message_loop_(message_loop) {}
+               MessageLoop* message_loop);
 
     // Sent by the DataManager to request data at |path|.  The source should
     // call SendResponse() when the data is available or if the request could
     // not be satisfied.
     virtual void StartDataRequest(const std::string& path,
                                   bool is_off_the_record,
                                   int request_id) = 0;
 
     // Return the mimetype that should be sent with this response, or empty
     // string to specify no mime type.
@@ skipping 15 matching lines @@
     // contention.
     virtual MessageLoop* MessageLoopForRequestPath(const std::string& path)
         const;
 
     const std::string& source_name() const { return source_name_; }
 
     static void SetFontAndTextDirection(DictionaryValue* localized_strings);
 
    protected:
     friend class base::RefCountedThreadSafe<DataSource>;
+    friend struct ChromeThread::DeleteOnThread<ChromeThread::UI>;
+    friend class DeleteTask<DataSource>;
 
-    virtual ~DataSource() {}
+    virtual ~DataSource();
 
    private:
     // The name of this source.
     // E.g., for favicons, this could be "favicon", which results in paths for
     // specific resources like "favicon/34" getting sent to this source.
     const std::string source_name_;
 
     // The MessageLoop for the thread where this DataSource lives.
     // Used to send messages to the DataSource.
     MessageLoop* message_loop_;
@@ skipping 68 matching lines @@
 DISABLE_RUNNABLE_METHOD_REFCOUNT(ChromeURLDataManager);
 
 // Register our special URL handler under our special URL scheme.
 // Must be done once at startup.
 void RegisterURLRequestChromeJob();
 
 // Undoes the registration done by RegisterURLRequestChromeJob.
 void UnregisterURLRequestChromeJob();
 
 #endif  // CHROME_BROWSER_DOM_UI_CHROME_URL_DATA_MANAGER_H_