Fix race in PluginDataRemoverImpl going away while it's still being used on the IO thread...

content/browser/plugin_data_remover_impl.cc

Index: content/browser/plugin_data_remover_impl.cc
===================================================================
--- content/browser/plugin_data_remover_impl.cc	(revision 110846)
+++ content/browser/plugin_data_remover_impl.cc	(working copy)
@@ -54,75 +54,84 @@
 
 }
 
-PluginDataRemoverImpl::PluginDataRemoverImpl(
+PluginDataRemoverImpl::Context::Context(
+    const std::string& mime_type,
+    base::Time begin_time,
     const content::ResourceContext& resource_context)
-    : mime_type_(kFlashMimeType),
-      is_starting_process_(false),
+    : event_(new base::WaitableEvent(true, false)),
+      begin_time_(begin_time),
       is_removing_(false),
-      context_(resource_context),
-      event_(new base::WaitableEvent(true, false)),
-      channel_(NULL),
-      ALLOW_THIS_IN_INITIALIZER_LIST(weak_factory_(this)) {
+      resource_context_(resource_context),
+      channel_(NULL) {
+  // Balanced in OnChannelOpened or OnError. Exactly one them will eventually be
+  // called, so we need to keep this object around until then.
+  AddRef();
+  remove_start_time_ = base::Time::Now();
+  BrowserThread::PostTask(
+      BrowserThread::IO,
+      FROM_HERE,
+      base::Bind(&Context::Init, this, mime_type));
+
+  BrowserThread::PostDelayedTask(
+      BrowserThread::IO,
+      FROM_HERE,
+      base::Bind(&Context::OnTimeout, this),
+      kRemovalTimeoutMs);
 }
 
-PluginDataRemoverImpl::~PluginDataRemoverImpl() {
-  if (is_starting_process_)
-    PluginService::GetInstance()->CancelOpenChannelToNpapiPlugin(this);
-  DCHECK(!is_removing_);
+PluginDataRemoverImpl::Context::~Context() {
   if (channel_)
     BrowserThread::DeleteSoon(BrowserThread::IO, FROM_HERE, channel_);
 }
 
-base::WaitableEvent* PluginDataRemoverImpl::StartRemoving(
-    base::Time begin_time) {
-  DCHECK(!is_removing_);
-  remove_start_time_ = base::Time::Now();
-  begin_time_ = begin_time;
-
-  is_starting_process_ = true;
+void PluginDataRemoverImpl::Context::Init(const std::string& mime_type) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   is_removing_ = true;
   PluginService::GetInstance()->OpenChannelToNpapiPlugin(
-      0, 0, GURL(), GURL(), mime_type_, this);
-
-  BrowserThread::PostDelayedTask(
-      BrowserThread::IO,
-      FROM_HERE,
-      base::Bind(&PluginDataRemoverImpl::OnTimeout, weak_factory_.GetWeakPtr()),
-      kRemovalTimeoutMs);
-
-  return event_.get();
+      0, 0, GURL(), GURL(), mime_type, this);
 }
 
-int PluginDataRemoverImpl::ID() {
+int PluginDataRemoverImpl::Context::ID() {
   // Generate a unique identifier for this PluginProcessHostClient.
   return ChildProcessInfo::GenerateChildProcessUniqueId();
 }
 
-bool PluginDataRemoverImpl::OffTheRecord() {
+bool PluginDataRemoverImpl::Context::OffTheRecord() {
   return false;
 }
 
-const content::ResourceContext& PluginDataRemoverImpl::GetResourceContext() {
-  return context_;
+const content::ResourceContext&
+    PluginDataRemoverImpl::Context::GetResourceContext() {
+  return resource_context_;
 }
 
-void PluginDataRemoverImpl::SetPluginInfo(
+void PluginDataRemoverImpl::Context::SetPluginInfo(
     const webkit::WebPluginInfo& info) {
 }
 
-void PluginDataRemoverImpl::OnFoundPluginProcessHost(
+void PluginDataRemoverImpl::Context::OnFoundPluginProcessHost(
     PluginProcessHost* host) {
 }
 
-void PluginDataRemoverImpl::OnSentPluginChannelRequest() {
+void PluginDataRemoverImpl::Context::OnSentPluginChannelRequest() {
 }
 
-void PluginDataRemoverImpl::OnChannelOpened(const IPC::ChannelHandle& handle) {
-  is_starting_process_ = false;
+void PluginDataRemoverImpl::Context::OnChannelOpened(
+    const IPC::ChannelHandle& handle) {
   ConnectToChannel(handle);
+  // Balancing the AddRef call.
+  Release();
 }
 
-void PluginDataRemoverImpl::ConnectToChannel(const IPC::ChannelHandle& handle) {
+void PluginDataRemoverImpl::Context::OnError() {
+  LOG(DFATAL) << "Couldn't open plugin channel";
+  SignalDone();
+  // Balancing the AddRef call.
+  Release();
+}
+
+void PluginDataRemoverImpl::Context::ConnectToChannel(
+    const IPC::ChannelHandle& handle) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
   // If we timed out, don't bother connecting.
@@ -146,25 +155,21 @@
   }
 }
 
-void PluginDataRemoverImpl::OnError() {
-  LOG(DFATAL) << "Couldn't open plugin channel";
-  SignalDone();
-}
-
-void PluginDataRemoverImpl::OnClearSiteDataResult(bool success) {
+void PluginDataRemoverImpl::Context::OnClearSiteDataResult(bool success) {
   LOG_IF(ERROR, !success) << "ClearSiteData returned error";
   UMA_HISTOGRAM_TIMES("ClearPluginData.time",
                       base::Time::Now() - remove_start_time_);
   SignalDone();
 }
 
-void PluginDataRemoverImpl::OnTimeout() {
+void PluginDataRemoverImpl::Context::OnTimeout() {
   LOG_IF(ERROR, is_removing_) << "Timed out";
   SignalDone();
 }
 
-bool PluginDataRemoverImpl::OnMessageReceived(const IPC::Message& msg) {
-  IPC_BEGIN_MESSAGE_MAP(PluginDataRemoverImpl, msg)
+bool PluginDataRemoverImpl::Context::OnMessageReceived(
+    const IPC::Message& msg) {
+  IPC_BEGIN_MESSAGE_MAP(Context, msg)
     IPC_MESSAGE_HANDLER(PluginHostMsg_ClearSiteDataResult,
                         OnClearSiteDataResult)
     IPC_MESSAGE_UNHANDLED_ERROR()
@@ -173,18 +178,34 @@
   return true;
 }
 
-void PluginDataRemoverImpl::OnChannelError() {
-  is_starting_process_ = false;
+void PluginDataRemoverImpl::Context::OnChannelError() {
   if (is_removing_) {
     NOTREACHED() << "Channel error";
     SignalDone();
   }
 }
 
-void PluginDataRemoverImpl::SignalDone() {
+void PluginDataRemoverImpl::Context::SignalDone() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   if (!is_removing_)
     return;
   is_removing_ = false;
   event_->Signal();
 }
+
+
+PluginDataRemoverImpl::PluginDataRemoverImpl(
+    const content::ResourceContext& resource_context)
+    : mime_type_(kFlashMimeType),
+      resource_context_(resource_context) {
+}
+
+PluginDataRemoverImpl::~PluginDataRemoverImpl() {
+}
+
+base::WaitableEvent* PluginDataRemoverImpl::StartRemoving(
+    base::Time begin_time) {
+  DCHECK(!context_.get());
+  context_ = new Context(mime_type_, begin_time, resource_context_);
+  return context_->event();
+}