Fix two race conditions in ImageDecoder.

chrome/browser/image_decoder.h

Index: chrome/browser/image_decoder.h
diff --git a/chrome/browser/image_decoder.h b/chrome/browser/image_decoder.h
index 438622c442d48a9b2bc5b125b11a8d299faccbd1..f43fff6d5033c31b967b48a592a6c94df7d4211f 100644
--- a/chrome/browser/image_decoder.h
+++ b/chrome/browser/image_decoder.h
@@ -75,9 +75,13 @@ class ImageDecoder : public content::UtilityProcessHostClient {
 
   // Removes all instances of image_request from |image_request_id_map_|,
   // ensuring callbacks are not made to the image_request after it is destroyed.
+  // May be called from any thread.
+  // NOTE: This may block if called from a different thread than the
+  // ImageRequest's task runner.
   static void Cancel(ImageRequest* image_request);
 
  private:
+  class Job;

[Theresa, 2015/04/13 18:19:30]

Write a short description of what this class is used for.

[Anand Mistry (off Chromium), 2015/04/14 00:52:13]

Done.

   friend struct base::DefaultLazyInstanceTraits<ImageDecoder>;
 
   ImageDecoder();
@@ -87,14 +91,18 @@ class ImageDecoder : public content::UtilityProcessHostClient {
   // Sends a request to the sandboxed process to decode the image. Starts
   // batch mode if necessary. If the utility process fails to start,
   // an OnDecodeImageFailed task is posted to image_request's |task_runner_|.
-  void DecodeImageInSandbox(ImageRequest* image_request,
+  void DecodeImageInSandbox(int request_id,
                             const std::vector<unsigned char>& image_data,
                             ImageCodec image_codec,
                             bool shrink_to_fit);
 
+  void StartWithOptionsImpl(ImageRequest* image_request,
+                            const std::string& image_data,
+                            ImageCodec image_codec,
+                            bool shrink_to_fit);
   void CancelImpl(ImageRequest* image_request);
 
-  using RequestMap = std::map<int, ImageRequest*>;
+  using RequestMap = std::map<int, scoped_refptr<Job>>;

[Theresa, 2015/04/13 18:19:30]

JobMap?

[Anand Mistry (off Chromium), 2015/04/14 00:52:13]

Done.

 
   // Starts UtilityProcessHost in batch mode and starts |batch_mode_timer_|.
   // If the utility process fails to start, the method resets
@@ -112,6 +120,9 @@ class ImageDecoder : public content::UtilityProcessHostClient {
   void OnDecodeImageSucceeded(const SkBitmap& decoded_image, int request_id);
   void OnDecodeImageFailed(int request_id);
 
+  // Removes the job from the map of requests.
+  void RemoveJob(const scoped_refptr<Job>& job);
+
   // id to use for the next Start request that comes in.
   int image_request_id_counter_;