Pepper quota fix: fire callbacks asynchronously to avoid crash in write callback chain

webkit/plugins/ppapi/quota_file_io.cc

Index: webkit/plugins/ppapi/quota_file_io.cc
diff --git a/webkit/plugins/ppapi/quota_file_io.cc b/webkit/plugins/ppapi/quota_file_io.cc
index 2a618a55fd7627ca805e0fc52dd250d4e18df8bb..01aaf29ac4862aa7a6fc2b9aa5f837a9c1c9ecc8 100644
--- a/webkit/plugins/ppapi/quota_file_io.cc
+++ b/webkit/plugins/ppapi/quota_file_io.cc
@@ -107,6 +107,13 @@ class QuotaFileIO::WriteOperation : public PendingOperationBase {
 
   bool finished() const { return finished_; }
 
+  void RunCallbackSoon() {
+    base::MessageLoopProxy::CreateForCurrentThread()->PostTask(
+        FROM_HERE, runnable_factory_.NewRunnableMethod(
+            &WriteOperation::RunCallback));
+  }
+
+ private:
   void RunCallback() {
     DCHECK(callback_.get());
     callback_->Run(status_, bytes_written_);
@@ -114,7 +121,6 @@ class QuotaFileIO::WriteOperation : public PendingOperationBase {
     delete this;
   }
 
- private:
   void DidFinish(PlatformFileError status, int bytes_written) {
     finished_ = true;
     status_ = status;
@@ -144,6 +150,7 @@ class QuotaFileIO::SetLengthOperation : public PendingOperationBase {
                      StatusCallback* callback)
       : PendingOperationBase(quota_io, is_will_operation),
         length_(length),
+        status_(base::PLATFORM_FILE_OK),
         callback_(callback),
         callback_factory_(ALLOW_THIS_IN_INITIALIZER_LIST(this)),
         runnable_factory_(ALLOW_THIS_IN_INITIALIZER_LIST(this)) {}
@@ -158,8 +165,7 @@ class QuotaFileIO::SetLengthOperation : public PendingOperationBase {
     if (is_will_operation_) {
       base::MessageLoopProxy::CreateForCurrentThread()->PostTask(
           FROM_HERE, runnable_factory_.NewRunnableMethod(
-              &SetLengthOperation::DidFinish,
-              base::PLATFORM_FILE_OK));
+              &SetLengthOperation::DidFinish, base::PLATFORM_FILE_OK));
       return;
     }
     if (!base::FileUtilProxy::Truncate(
@@ -180,13 +186,21 @@ class QuotaFileIO::SetLengthOperation : public PendingOperationBase {
  private:
   void DidFinish(PlatformFileError status) {
     quota_io_->DidSetLength(status, length_);
+    status_ = status;
+    base::MessageLoopProxy::CreateForCurrentThread()->PostTask(
+        FROM_HERE, runnable_factory_.NewRunnableMethod(
+            &SetLengthOperation::RunCallback));
+  }
+
+  void RunCallback() {
     DCHECK(callback_.get());
-    callback_->Run(status);
+    callback_->Run(status_);
     callback_.reset();
     delete this;
   }
 
   int64_t length_;
+  PlatformFileError status_;
   scoped_ptr<StatusCallback> callback_;
   base::ScopedCallbackFactory<QuotaFileIO::SetLengthOperation>
       callback_factory_;
@@ -339,8 +353,8 @@ void QuotaFileIO::DidWrite(WriteOperation* op,
         pending_operations_.front());
     if (!op->finished())
       break;
-    op->RunCallback();
     pending_operations_.pop_front();
+    op->RunCallbackSoon();
   }
   // If we have no more pending writes, notify the browser that we did
   // update the file.