Pepper quota fix: fire callbacks asynchronously to avoid crash in write callback chain

webkit/plugins/ppapi/quota_file_io.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef WEBKIT_PLUGINS_PPAPI_QUOTA_FILE_IO_H_
 #define WEBKIT_PLUGINS_PPAPI_QUOTA_FILE_IO_H_
 
 #include <deque>
 
 #include "base/file_util_proxy.h"
@@ skipping 59 matching lines @@
   void DidQueryForQuotaCheck();
 
   // The plugin instance that owns this (via PPB_FileIO_Impl).
   PluginInstance* instance_;
 
   // The file information associated to this instance.
   base::PlatformFile file_;
   GURL file_url_;
   quota::StorageType storage_type_;
 
-  // Operations waiting for a quota check to finish.
+  // Pending operations that are waiting quota checks and pending
+  // callbacks that are to be fired after the operation;
+  // we use two separate queues for them so that we can safely dequeue the
+  // pending callbacks while enqueueing new operations. (This could
+  // happen when callbacks are dispatched synchronously due to error etc.)
   std::deque<PendingOperationBase*> pending_operations_;
+  std::deque<PendingOperationBase*> pending_callbacks_;
 
   // Valid only while there're pending quota checks.
   int64_t cached_file_size_;
   int64_t cached_available_space_;
 
   // Quota-related queries and errors occured during inflight quota checks.
   int outstanding_quota_queries_;
   int outstanding_errors_;
 
   // For parallel writes bookkeeping.
   int64_t max_written_offset_;
   int inflight_operations_;
 
   base::ScopedCallbackFactory<QuotaFileIO> callback_factory_;
   DISALLOW_COPY_AND_ASSIGN(QuotaFileIO);
 };
 
 }  // namespace ppapi
 }  // namespace webkit
 
 #endif  // WEBKIT_PLUGINS_PPAPI_QUOTA_FILE_IO_H_