AppCaches which belong to hosted apps are not protected from deletion

webkit/appcache/appcache_service.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/appcache/appcache_service.h"
 
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/stl_util-inl.h"
 #include "webkit/appcache/appcache_backend_impl.h"
@@ skipping 255 matching lines @@
   CallCallback(collection ? net::OK : net::ERR_FAILED);
   delete this;
 }
 
 
 // AppCacheService -------
 
 AppCacheService::AppCacheService(quota::QuotaManagerProxy* quota_manager_proxy)
     : appcache_policy_(NULL), quota_client_(NULL),
       quota_manager_proxy_(quota_manager_proxy),
-      request_context_(NULL)  {
+      request_context_(NULL), clear_local_state_on_exit_(false)  {
   if (quota_manager_proxy_) {
     quota_client_ = new AppCacheQuotaClient(this);
     quota_manager_proxy_->RegisterClient(quota_client_);
   }
 }
 
 AppCacheService::~AppCacheService() {
   DCHECK(backends_.empty());
   std::for_each(pending_helpers_.begin(),
                 pending_helpers_.end(),
                 std::mem_fun(&AsyncHelper::Cancel));
   STLDeleteElements(&pending_helpers_);
   if (quota_client_)
     quota_client_->NotifyAppCacheDestroyed();
+
+  // Destroy storage_ first; ~AppCacheStorageImpl accesses other data members
+  // (special_storage_policy_).
+  storage_.reset();
 }
 
 void AppCacheService::Initialize(const FilePath& cache_directory,
                                  base::MessageLoopProxy* cache_thread) {
   DCHECK(!storage_.get());
   AppCacheStorageImpl* storage = new AppCacheStorageImpl(this);
   storage->Initialize(cache_directory, cache_thread);
   storage_.reset(storage);
 }
 
@@ skipping 35 matching lines @@
   backends_.insert(
       BackendMap::value_type(backend_impl->process_id(), backend_impl));
 }
 
 void AppCacheService::UnregisterBackend(
     AppCacheBackendImpl* backend_impl) {
   backends_.erase(backend_impl->process_id());
 }
 
 }  // namespace appcache