Fix two race conditions in ImageDecoder.

chrome/browser/image_decoder.h

Index: chrome/browser/image_decoder.h
diff --git a/chrome/browser/image_decoder.h b/chrome/browser/image_decoder.h
index 438622c442d48a9b2bc5b125b11a8d299faccbd1..fa27ecd7e6c6b2490bec9b983f88bd67de0d9cb6 100644
--- a/chrome/browser/image_decoder.h
+++ b/chrome/browser/image_decoder.h
@@ -73,11 +73,19 @@ class ImageDecoder : public content::UtilityProcessHostClient {
                                ImageCodec image_codec,
                                bool shrink_to_fit);
 
-  // Removes all instances of image_request from |image_request_id_map_|,
+  // Removes all instances of image_request from |job_id_map_|,
   // ensuring callbacks are not made to the image_request after it is destroyed.
+  // May be called from any thread.
+  // NOTE: This may block if called from a different thread than the
+  // ImageRequest's task runner.
   static void Cancel(ImageRequest* image_request);
 
  private:
+  // Container for a single decode request. Used to ensure the ImageRequest's
+  // functions are called on the correct task runner, and only when the
+  // ImageRequest still exists.
+  class Job;
+
   friend struct base::DefaultLazyInstanceTraits<ImageDecoder>;
 
   ImageDecoder();
@@ -87,14 +95,18 @@ class ImageDecoder : public content::UtilityProcessHostClient {
   // Sends a request to the sandboxed process to decode the image. Starts
   // batch mode if necessary. If the utility process fails to start,
   // an OnDecodeImageFailed task is posted to image_request's |task_runner_|.
-  void DecodeImageInSandbox(ImageRequest* image_request,
+  void DecodeImageInSandbox(int request_id,
                             const std::vector<unsigned char>& image_data,
                             ImageCodec image_codec,
                             bool shrink_to_fit);
 
+  void StartWithOptionsImpl(ImageRequest* image_request,
+                            const std::string& image_data,
+                            ImageCodec image_codec,
+                            bool shrink_to_fit);
   void CancelImpl(ImageRequest* image_request);
 
-  using RequestMap = std::map<int, ImageRequest*>;
+  using JobMap = std::map<int, scoped_refptr<Job>>;
 
   // Starts UtilityProcessHost in batch mode and starts |batch_mode_timer_|.
   // If the utility process fails to start, the method resets
@@ -112,13 +124,16 @@ class ImageDecoder : public content::UtilityProcessHostClient {
   void OnDecodeImageSucceeded(const SkBitmap& decoded_image, int request_id);
   void OnDecodeImageFailed(int request_id);
 
+  // Removes the job from the map of requests.
+  void RemoveJob(const scoped_refptr<Job>& job);
+
   // id to use for the next Start request that comes in.
   int image_request_id_counter_;
 
-  // Map of request id's to ImageRequests.
-  RequestMap image_request_id_map_;
+  // Map of request id's to Jobs.
+  JobMap job_id_map_;
 
-  // Protects |image_request_id_map_| and |image_request_id_counter_|.
+  // Protects |job_id_map_| and |image_request_id_counter_|.
   base::Lock map_lock_;
 
   // The UtilityProcessHost requests are sent to.