Add safe blob-over-IPC transfer from browser->renderer for IDB.

content/browser/indexed_db/indexed_db_dispatcher_host.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_DISPATCHER_HOST_H_
 #define CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_DISPATCHER_HOST_H_
 
 #include <map>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/id_map.h"
 #include "base/memory/ref_counted.h"
 #include "content/public/browser/browser_message_filter.h"
 #include "url/gurl.h"
+#include "webkit/browser/blob/blob_data_handle.h"
 
 struct IndexedDBDatabaseMetadata;
 struct IndexedDBHostMsg_DatabaseCount_Params;
 struct IndexedDBHostMsg_DatabaseCreateIndex_Params;
 struct IndexedDBHostMsg_DatabaseCreateObjectStore_Params;
 struct IndexedDBHostMsg_DatabaseCreateTransaction_Params;
 struct IndexedDBHostMsg_DatabaseDeleteRange_Params;
 struct IndexedDBHostMsg_DatabaseGet_Params;
 struct IndexedDBHostMsg_DatabaseOpenCursor_Params;
 struct IndexedDBHostMsg_DatabasePut_Params;
@@ skipping 47 matching lines @@
   // These are called to map a 32-bit front-end (renderer-specific) transaction
   // id to and from a back-end ("host") transaction id that encodes the process
   // id in the high 32 bits. The mapping is host-specific and ids are validated.
   int64 HostTransactionId(int64 transaction_id);
   int64 RendererTransactionId(int64 host_transaction_id);
 
   // These are called to decode a host transaction ID, for diagnostic purposes.
   static uint32 TransactionIdToRendererTransactionId(int64 host_transaction_id);
   static uint32 TransactionIdToProcessId(int64 host_transaction_id);
 
+  void HoldBlobDataHandle(

[jsbell, 2014/03/14 21:32:54]

FYI to other readers: it looks like we need to mirror this holding/acking
pattern for SharedWorker, ServiceWorker, MessagePort and other places that pass
Blob refs over IPC. http://crbug.com/351753

We don't know what that'll look like yet, but we may want to factor out a blob
handler service for the browsing context, or some such. Shouldn't hold up this
patch, though.

+      const std::string& uuid,
+      scoped_ptr<webkit_blob::BlobDataHandle>& blob_data_handle);
+  void DropBlobDataHandle(const std::string& uuid);
+
  private:
   // Friends to enable OnDestruct() delegation.
   friend class BrowserThread;
   friend class base::DeleteHelper<IndexedDBDispatcherHost>;
 
   virtual ~IndexedDBDispatcherHost();
 
   // Message processing. Most of the work is delegated to the dispatcher hosts
   // below.
   void OnIDBFactoryGetDatabaseNames(
       const IndexedDBHostMsg_FactoryGetDatabaseNames_Params& p);
   void OnIDBFactoryOpen(const IndexedDBHostMsg_FactoryOpen_Params& p);
 
   void OnIDBFactoryDeleteDatabase(
       const IndexedDBHostMsg_FactoryDeleteDatabase_Params& p);
 
+  void OnAckReceivedBlobs(const std::vector<std::string>& uuids);
+
   void ResetDispatcherHosts();
 
   // IDMap for RefCounted types
   template <typename RefCountedType>
   class RefIDMap {
    private:
     typedef int32 KeyType;
 
    public:
     RefIDMap() {}
@@ skipping 114 matching lines @@
                          int used_prefetches,
                          int unused_prefetches);
     void OnDestroyed(int32 ipc_cursor_id);
 
     IndexedDBDispatcherHost* parent_;
     RefIDMap<IndexedDBCursor> map_;
   };
 
   scoped_refptr<IndexedDBContextImpl> indexed_db_context_;
 
+  typedef std::map<std::string, webkit_blob::BlobDataHandle*> BlobDataHandleMap;
+  BlobDataHandleMap blob_data_handle_map_;
+
   // Only access on IndexedDB thread.
   scoped_ptr<DatabaseDispatcherHost> database_dispatcher_host_;
   scoped_ptr<CursorDispatcherHost> cursor_dispatcher_host_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(IndexedDBDispatcherHost);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_DISPATCHER_HOST_H_