Fix data race problem in createImageBitmap(Blob)

third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp

 /*
  * Copyright (c) 2013, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 205 matching lines @@
 
 void ImageBitmapFactories::ImageBitmapLoader::decodeImageOnDecoderThread(WebTaskRunner* taskRunner)
 {
     ASSERT(!isMainThread());
     RefPtr<SharedBuffer> sharedBuffer = SharedBuffer::create((char*)m_loader.arrayBufferResult()->data(), static_cast<size_t>(m_loader.arrayBufferResult()->byteLength()));
 
     ImageDecoder::AlphaOption alphaOp = ImageDecoder::AlphaPremultiplied;
     if (m_options.premultiplyAlpha() == "none")
         alphaOp = ImageDecoder::AlphaNotPremultiplied;
     OwnPtr<ImageDecoder> decoder(ImageDecoder::create(*sharedBuffer, alphaOp, ImageDecoder::GammaAndColorProfileApplied));
-    if (decoder)
+    RefPtr<SkImage> frame;
+    if (decoder) {
         decoder->setData(sharedBuffer.get(), true);
-    taskRunner->postTask(BLINK_FROM_HERE, threadSafeBind(&ImageBitmapFactories::ImageBitmapLoader::resolvePromiseOnOriginalThread, AllowCrossThreadAccess(this), decoder.release()));
+        frame = ImageBitmap::getSkImageFromDecoder(decoder.release());
+    }
+    taskRunner->postTask(BLINK_FROM_HERE, threadSafeBind(&ImageBitmapFactories::ImageBitmapLoader::resolvePromiseOnOriginalThread, AllowCrossThreadAccess(this), frame.release()));
 }
 
-void ImageBitmapFactories::ImageBitmapLoader::resolvePromiseOnOriginalThread(PassOwnPtr<ImageDecoder> decoder)
+void ImageBitmapFactories::ImageBitmapLoader::resolvePromiseOnOriginalThread(PassRefPtr<SkImage> frame)
 {
-    if (!decoder) {
+    if (!frame) {
         rejectPromise();
         return;
     }
-    RefPtr<SkImage> frame = ImageBitmap::getSkImageFromDecoder(decoder);
     ASSERT(!frame || (frame->width() && frame->height()));
     if (!frame) {
         rejectPromise();
         return;
     }
 
     RefPtr<StaticBitmapImage> image = StaticBitmapImage::create(frame);
     image->setOriginClean(true);
     if (!m_cropRect.width() && !m_cropRect.height()) {
         // No cropping variant was called.
@@ skipping 10 matching lines @@
     m_factory->didFinishLoading(this);
 }
 
 DEFINE_TRACE(ImageBitmapFactories::ImageBitmapLoader)
 {
     visitor->trace(m_factory);
     visitor->trace(m_resolver);
 }
 
 } // namespace blink