Fix two race conditions in ImageDecoder.

chrome/browser/image_decoder.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_IMAGE_DECODER_H_
 #define CHROME_BROWSER_IMAGE_DECODER_H_
 
 #include <map>
 #include <string>
 #include <vector>
@@ skipping 55 matching lines @@
   static void Start(ImageRequest* image_request,
                     const std::string& image_data);
 
   // Starts asynchronous image decoding. Once finished, the callback will be
   // posted back to image_request's |task_runner_|.
   static void StartWithOptions(ImageRequest* image_request,
                                const std::string& image_data,
                                ImageCodec image_codec,
                                bool shrink_to_fit);
 
-  // Removes all instances of image_request from |image_request_id_map_|,
+  // Removes all instances of image_request from |job_id_map_|,
   // ensuring callbacks are not made to the image_request after it is destroyed.
+  // May be called from any thread.
+  // NOTE: This may block if called from a different thread than the
+  // ImageRequest's task runner.
   static void Cancel(ImageRequest* image_request);
 
  private:
+  // Container for a single decode request. Used to ensure the ImageRequest's
+  // functions are called on the correct task runner, and only when the
+  // ImageRequest still exists.
+  class Job;
+
   friend struct base::DefaultLazyInstanceTraits<ImageDecoder>;
 
   ImageDecoder();
   // It's a reference counted object, so destructor is private.
   ~ImageDecoder() override;
 
   // Sends a request to the sandboxed process to decode the image. Starts
   // batch mode if necessary. If the utility process fails to start,
   // an OnDecodeImageFailed task is posted to image_request's |task_runner_|.
-  void DecodeImageInSandbox(ImageRequest* image_request,
+  void DecodeImageInSandbox(int request_id,
                             const std::vector<unsigned char>& image_data,
                             ImageCodec image_codec,
                             bool shrink_to_fit);
 
+  void StartWithOptionsImpl(ImageRequest* image_request,
+                            const std::string& image_data,
+                            ImageCodec image_codec,
+                            bool shrink_to_fit);
   void CancelImpl(ImageRequest* image_request);
 
-  using RequestMap = std::map<int, ImageRequest*>;
+  using JobMap = std::map<int, scoped_refptr<Job>>;
 
   // Starts UtilityProcessHost in batch mode and starts |batch_mode_timer_|.
   // If the utility process fails to start, the method resets
   // |utility_process_host_| and returns.
   void StartBatchMode();
 
   // Stops batch mode if no requests have come in since
   // kBatchModeTimeoutSeconds.
   void StopBatchMode();
 
   // Overidden from UtilityProcessHostClient.
   bool OnMessageReceived(const IPC::Message& message) override;
 
   // IPC message handlers.
   void OnDecodeImageSucceeded(const SkBitmap& decoded_image, int request_id);
   void OnDecodeImageFailed(int request_id);
 
+  // Removes the job from the map of requests.
+  void RemoveJob(const scoped_refptr<Job>& job);
+
   // id to use for the next Start request that comes in.
   int image_request_id_counter_;
 
-  // Map of request id's to ImageRequests.
-  RequestMap image_request_id_map_;
+  // Map of request id's to Jobs.
+  JobMap job_id_map_;
 
-  // Protects |image_request_id_map_| and |image_request_id_counter_|.
+  // Protects |job_id_map_| and |image_request_id_counter_|.
   base::Lock map_lock_;
 
   // The UtilityProcessHost requests are sent to.
   base::WeakPtr<content::UtilityProcessHost> utility_process_host_;
 
   // Calls StopBatchMode after kBatchModeTimeoutSeconds have elapsed.
   base::RepeatingTimer<ImageDecoder> batch_mode_timer_;
 
   // The time Start was last called.
   base::TimeTicks last_request_;
 
   DISALLOW_COPY_AND_ASSIGN(ImageDecoder);
 };
 
 #endif  // CHROME_BROWSER_IMAGE_DECODER_H_