base::RefCounted now DCHECKs when referenced from multiple threads.

components/nacl/loader/nacl_ipc_adapter.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nacl_ipc_adapter.h"
 
 #include <limits.h>
 #include <string.h>
 
 #include "base/basictypes.h"
@@ skipping 214 matching lines @@
 
   NaClDesc* desc() { return desc_; }
 
  private:
   NaClDesc* desc_;
   DISALLOW_COPY_AND_ASSIGN(NaClDescWrapper);
 };
 
 }  // namespace
 
+// TODO(mgiuca): Avoid using UnsafeRefCounted. http://crbug.com/469952.
 class NaClIPCAdapter::RewrittenMessage
-    : public base::RefCounted<RewrittenMessage> {
+    : public base::UnsafeRefCounted<RewrittenMessage> {
  public:
   RewrittenMessage();
 
   bool is_consumed() const { return data_read_cursor_ == data_len_; }
 
   void SetData(const NaClIPCAdapter::NaClMessageHeader& header,
                const void* payload, size_t payload_length);
 
   int Read(NaClImcTypedMsgHdr* msg);
 
   void AddDescriptor(NaClDescWrapper* desc) { descs_.push_back(desc); }
 
   size_t desc_count() const { return descs_.size(); }
 
  private:
-  friend class base::RefCounted<RewrittenMessage>;
+  friend class base::UnsafeRefCounted<RewrittenMessage>;
   ~RewrittenMessage() {}
 
   scoped_ptr<char[]> data_;
   size_t data_len_;
 
   // Offset into data where the next read will happen. This will be equal to
   // data_len_ when all data has been consumed.
   size_t data_read_cursor_;
 
   // Wrapped descriptors for transfer to untrusted code.
@@ skipping 544 matching lines @@
   header.flags = msg.flags();
   header.num_fds = static_cast<uint16>(rewritten_msg->desc_count());
 
   rewritten_msg->SetData(header, msg.payload(), msg.payload_size());
   locked_data_.to_be_received_.push(rewritten_msg);
 }
 
 int TranslatePepperFileReadWriteOpenFlagsForTesting(int32_t pp_open_flags) {
   return TranslatePepperFileReadWriteOpenFlags(pp_open_flags);
 }