Fix two races in DirectoryWatcherInotify:

base/directory_watcher_inotify.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/directory_watcher.h"
 
 #include <errno.h>
 #include <string.h>
 #include <sys/inotify.h>
 #include <sys/ioctl.h>
@@ skipping 313 matching lines @@
     return (inotify_rm_watch(inotify_fd_, watch) == 0);
   }
 
   return true;
 }
 
 void InotifyReader::OnInotifyEvent(const inotify_event* event) {
   if (event->mask & IN_IGNORED)
     return;
 
-  WatcherSet watchers_to_notify;
-  FilePath changed_path;
+  // In case you want to limit the scope of this lock, it's not sufficient
+  // to just copy things under the lock, and then run the notifications
+  // without holding the lock. DirectoryWatcherImpl's dtor removes its watches,
+  // and to do that obtains the lock. After it finishes removing watches,
+  // it's destroyed. So, if you copy under the lock and notify without the lock,
+  // it's possible you'll copy the DirectoryWatcherImpl which is being
+  // destroyed, then it will destroy itself, and then you'll try to notify it.
+  AutoLock auto_lock(lock_);
 
-  {
-    AutoLock auto_lock(lock_);
-    changed_path = paths_[event->wd];
-    watchers_to_notify.insert(watchers_[event->wd].begin(),
-                              watchers_[event->wd].end());
-  }
-
-  for (WatcherSet::iterator watcher = watchers_to_notify.begin();
-       watcher != watchers_to_notify.end();
+  for (WatcherSet::iterator watcher = watchers_[event->wd].begin();
+       watcher != watchers_[event->wd].end();
        ++watcher) {
     (*watcher)->OnInotifyEvent(event);
   }
 }
 
 DirectoryWatcherImpl::DirectoryWatcherImpl()
     : watch_(InotifyReader::kInvalidWatch),
       recursive_setup_finished_(false, false) {
 }
 
@@ skipping 75 matching lines @@
                                  DirectoryWatcher::Delegate* delegate,
                                  MessageLoop* backend_loop, bool recursive) {
 
   // Can only watch one path.
   DCHECK(watch_ == InotifyReader::kInvalidWatch);
 
   ino_t inode;
   if (!file_util::GetInode(path, &inode))
     return false;
 
-  InotifyReader::Watch watch =
-      Singleton<InotifyReader>::get()->AddWatch(path, this);
-  if (watch == InotifyReader::kInvalidWatch)
-    return false;
-
   delegate_ = delegate;
   recursive_ = recursive;
   root_path_ = path;
-  watch_ = watch;
   loop_ = MessageLoop::current();
+  watch_ = Singleton<InotifyReader>::get()->AddWatch(path, this);
+  if (watch_ == InotifyReader::kInvalidWatch)
+    return false;
 
   {
     AutoLock auto_lock(lock_);
     inodes_watched_.insert(inode);
     watches_.insert(watch_);
   }
 
   if (recursive_) {
     Task* subtree_task = new RegisterSubtreeWatchesTask(this, root_path_);
     if (backend_loop) {
       backend_loop->PostTask(FROM_HERE, subtree_task);
     } else {
       subtree_task->Run();
       delete subtree_task;
     }
   }
 
   return true;
 }
 
 }  // namespace
 
 DirectoryWatcher::DirectoryWatcher() {
   impl_ = new DirectoryWatcherImpl();
 }
-