Fix for crash when deleting DataSource's in IO thread.

chrome/browser/dom_ui/chrome_url_data_manager.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_DOM_UI_CHROME_URL_DATA_MANAGER_H_
 #define CHROME_BROWSER_DOM_UI_CHROME_URL_DATA_MANAGER_H_
 #pragma once
 
 #include <map>
 #include <string>
 
 #include "base/singleton.h"
 #include "base/task.h"
 #include "base/ref_counted.h"
+#include "chrome/browser/browser_thread.h"
 
 class DictionaryValue;
 class FilePath;
 class GURL;
 class MessageLoop;
 class RefCountedMemory;
 class URLRequestChromeJob;
 
 namespace net {
 class URLRequest;
@@ skipping 10 matching lines @@
  public:
   // Returns the singleton instance.
   static ChromeURLDataManager* GetInstance();
 
   typedef int RequestID;
 
   // A DataSource is an object that can answer requests for data
   // asynchronously. DataSources are collectively owned with refcounting smart
   // pointers and should never be deleted on the IO thread, since their calls
   // are handled almost always on the UI thread and there's a possibility of a
-  // data race.
+  // data race.  The |DeleteOnUIThread| trait is used to enforce this.
   //
   // An implementation of DataSource should handle calls to
   // StartDataRequest() by starting its (implementation-specific) asynchronous
-  // request for the data, then call SendResponse() to notify
-  class DataSource : public base::RefCountedThreadSafe<DataSource> {
+  // request for the data, then call SendResponse() to notify.
+  class DataSource : public base::RefCountedThreadSafe<
+      DataSource, BrowserThread::DeleteOnUIThread> {
    public:
     // See source_name_ and message_loop_ below for docs on these parameters.
     DataSource(const std::string& source_name,
                MessageLoop* message_loop);
 
     // Sent by the DataManager to request data at |path|.  The source should
     // call SendResponse() when the data is available or if the request could
     // not be satisfied.
     virtual void StartDataRequest(const std::string& path,
                                   bool is_off_the_record,
@@ skipping 19 matching lines @@
     // contention.
     virtual MessageLoop* MessageLoopForRequestPath(const std::string& path)
         const;
 
     const std::string& source_name() const { return source_name_; }
 
     static void SetFontAndTextDirection(DictionaryValue* localized_strings);
 
    protected:
     friend class base::RefCountedThreadSafe<DataSource>;
+    friend struct BrowserThread::DeleteOnThread<BrowserThread::UI>;
+    friend class DeleteTask<DataSource>;
 
     virtual ~DataSource();
 
    private:
     // The name of this source.
     // E.g., for favicons, this could be "favicon", which results in paths for
     // specific resources like "favicon/34" getting sent to this source.
     const std::string source_name_;
 
     // The MessageLoop for the thread where this DataSource lives.
@@ skipping 75 matching lines @@
 DISABLE_RUNNABLE_METHOD_REFCOUNT(ChromeURLDataManager);
 
 // Register our special URL handler under our special URL scheme.
 // Must be done once at startup.
 void RegisterURLRequestChromeJob();
 
 // Undoes the registration done by RegisterURLRequestChromeJob.
 void UnregisterURLRequestChromeJob();
 
 #endif  // CHROME_BROWSER_DOM_UI_CHROME_URL_DATA_MANAGER_H_