Add safe blob-over-IPC transfer from browser->renderer for IDB.

content/browser/indexed_db/indexed_db_dispatcher_host.h

Index: content/browser/indexed_db/indexed_db_dispatcher_host.h
diff --git a/content/browser/indexed_db/indexed_db_dispatcher_host.h b/content/browser/indexed_db/indexed_db_dispatcher_host.h
index bcbbfba029b1c2bf7b15fad8d61f6f9de1c58cb5..9c99dc51d26904268d21fa81c610aec32837d2c4 100644
--- a/content/browser/indexed_db/indexed_db_dispatcher_host.h
+++ b/content/browser/indexed_db/indexed_db_dispatcher_host.h
@@ -13,6 +13,7 @@
 #include "base/memory/ref_counted.h"
 #include "content/public/browser/browser_message_filter.h"
 #include "url/gurl.h"
+#include "webkit/browser/blob/blob_data_handle.h"
 
 struct IndexedDBDatabaseMetadata;
 struct IndexedDBHostMsg_DatabaseCount_Params;
@@ -80,6 +81,11 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
   static uint32 TransactionIdToRendererTransactionId(int64 host_transaction_id);
   static uint32 TransactionIdToProcessId(int64 host_transaction_id);
 
+  void HoldBlobDataHandle(

[jsbell, 2014/03/14 21:32:54]

FYI to other readers: it looks like we need to mirror this holding/acking
pattern for SharedWorker, ServiceWorker, MessagePort and other places that pass
Blob refs over IPC. http://crbug.com/351753

We don't know what that'll look like yet, but we may want to factor out a blob
handler service for the browsing context, or some such. Shouldn't hold up this
patch, though.

+      const std::string& uuid,
+      scoped_ptr<webkit_blob::BlobDataHandle>& blob_data_handle);
+  void DropBlobDataHandle(const std::string& uuid);
+
  private:
   // Friends to enable OnDestruct() delegation.
   friend class BrowserThread;
@@ -96,6 +102,8 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
   void OnIDBFactoryDeleteDatabase(
       const IndexedDBHostMsg_FactoryDeleteDatabase_Params& p);
 
+  void OnAckReceivedBlobs(const std::vector<std::string>& uuids);
+
   void ResetDispatcherHosts();
 
   // IDMap for RefCounted types
@@ -230,6 +238,9 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
 
   scoped_refptr<IndexedDBContextImpl> indexed_db_context_;
 
+  typedef std::map<std::string, webkit_blob::BlobDataHandle*> BlobDataHandleMap;
+  BlobDataHandleMap blob_data_handle_map_;
+
   // Only access on IndexedDB thread.
   scoped_ptr<DatabaseDispatcherHost> database_dispatcher_host_;
   scoped_ptr<CursorDispatcherHost> cursor_dispatcher_host_;