[BlobStorage] Fix IPC race in sending IPC and posting to IO thread

content/child/blob_storage/blob_transport_controller.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/blob_storage/blob_transport_controller.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/lazy_instance.h"
@@ skipping 54 matching lines @@
     std::unique_ptr<BlobConsolidation> consolidation,
     scoped_refptr<ThreadSafeSender> sender,
     base::SingleThreadTaskRunner* io_runner,
     scoped_refptr<base::SingleThreadTaskRunner> main_runner) {
   if (main_runner->BelongsToCurrentThread()) {
     IncChildProcessRefCount();
   } else {
     main_runner->PostTask(FROM_HERE, base::Bind(&IncChildProcessRefCount));
   }
 
-  std::vector<storage::DataElement> descriptions;
-  std::set<std::string> referenced_blobs = consolidation->referenced_blobs();
-  BlobTransportController::GetDescriptions(
-      consolidation.get(), kBlobStorageIPCThresholdBytes, &descriptions);
-  // I post the task first to make sure that we store our consolidation before
-  // we get a request back from the browser.
   io_runner->PostTask(
       FROM_HERE,
-      base::Bind(&BlobTransportController::StoreBlobDataForRequests,
-                 base::Unretained(BlobTransportController::GetInstance()), uuid,
-                 base::Passed(std::move(consolidation)),
+      base::Bind(&BlobTransportController::InitiateBlobTransferOnIOThread, uuid,
+                 content_type, base::Passed(std::move(consolidation)),
+                 base::Passed(std::move(sender)),
                  base::Passed(std::move(main_runner))));
-  // TODO(dmurph): Merge register and start messages.
-  sender->Send(new BlobStorageMsg_RegisterBlobUUID(uuid, content_type, "",
-                                                   referenced_blobs));
-  sender->Send(new BlobStorageMsg_StartBuildingBlob(uuid, descriptions));
 }
 
 void BlobTransportController::OnMemoryRequest(
     const std::string& uuid,
     const std::vector<storage::BlobItemBytesRequest>& requests,
     std::vector<base::SharedMemoryHandle>* memory_handles,
     const std::vector<IPC::PlatformFileForTransit>& file_handles,
     IPC::Sender* sender) {
   std::vector<storage::BlobItemBytesResponse> responses;
   ResponsesStatus status =
@@ skipping 90 matching lines @@
 BlobTransportController::~BlobTransportController() {}
 
 void BlobTransportController::ClearForTesting() {
   if (!blob_storage_.empty() && main_thread_runner_) {
     main_thread_runner_->PostTask(FROM_HERE,
                                   base::Bind(&DecChildProcessRefCount));
   }
   blob_storage_.clear();
 }
 
+// static
+void BlobTransportController::InitiateBlobTransferOnIOThread(
+    const std::string& uuid,
+    const std::string& content_type,
+    std::unique_ptr<BlobConsolidation> consolidation,
+    scoped_refptr<ThreadSafeSender> sender,
+    scoped_refptr<base::SingleThreadTaskRunner> main_runner) {
+  std::vector<storage::DataElement> descriptions;
+  std::set<std::string> referenced_blobs = consolidation->referenced_blobs();
+  BlobTransportController::GetDescriptions(
+      consolidation.get(), kBlobStorageIPCThresholdBytes, &descriptions);
+  BlobTransportController::GetInstance()->StoreBlobDataForRequests(
+      uuid, std::move(consolidation), std::move(main_runner));
+
+  // TODO(dmurph): Merge register and start messages.
+  sender->Send(new BlobStorageMsg_RegisterBlobUUID(uuid, content_type, "",
+                                                   referenced_blobs));
+  sender->Send(new BlobStorageMsg_StartBuildingBlob(uuid, descriptions));
+}
+
 void BlobTransportController::StoreBlobDataForRequests(
     const std::string& uuid,
     std::unique_ptr<BlobConsolidation> consolidation,
     scoped_refptr<base::SingleThreadTaskRunner> main_runner) {
   if (!main_thread_runner_.get()) {
     main_thread_runner_ = std::move(main_runner);
   }
   blob_storage_[uuid] = std::move(consolidation);
 }
 
@@ skipping 74 matching lines @@
 
 void BlobTransportController::ReleaseBlobConsolidation(
     const std::string& uuid) {
   if (blob_storage_.erase(uuid)) {
     main_thread_runner_->PostTask(FROM_HERE,
                                   base::Bind(&DecChildProcessRefCount));
   }
 }
 
 }  // namespace content