Pepper quota fix: fire callbacks asynchronously to avoid crash in write callback chain

webkit/plugins/ppapi/quota_file_io.h

Index: webkit/plugins/ppapi/quota_file_io.h
diff --git a/webkit/plugins/ppapi/quota_file_io.h b/webkit/plugins/ppapi/quota_file_io.h
index ec090a443f53c80964dd37479c39e8dcfc9d44c7..bbd1b36cac52301dce0f5158d96cdf3f4146f86c 100644
--- a/webkit/plugins/ppapi/quota_file_io.h
+++ b/webkit/plugins/ppapi/quota_file_io.h
@@ -77,8 +77,13 @@ class QuotaFileIO {
   GURL file_url_;
   quota::StorageType storage_type_;
 
-  // Operations waiting for a quota check to finish.
+  // Pending operations that are waiting quota checks and pending
+  // callbacks that are to be fired after the operation;
+  // we use two separate queues for them so that we can safely dequeue the
+  // pending callbacks while enqueueing new operations. (This could
+  // happen when callbacks are dispatched synchronously due to error etc.)
   std::deque<PendingOperationBase*> pending_operations_;
+  std::deque<PendingOperationBase*> pending_callbacks_;
 
   // Valid only while there're pending quota checks.
   int64_t cached_file_size_;