Fix a data race in WebMessagePortChannelImpl.

content/child/webmessageportchannel_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/webmessageportchannel_impl.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 150 matching lines @@
   // Release the object on the main thread, since the destructor might want to
   // send an IPC, and that has to happen on the main thread.
   main_thread_task_runner_->ReleaseSoon(FROM_HERE, this);
 }
 
 void WebMessagePortChannelImpl::postMessage(
     const WebString& message,
     WebMessagePortChannelArray* channels_ptr) {
   std::unique_ptr<WebMessagePortChannelArray> channels(channels_ptr);
   if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    // Note: we must construct the base::string16 here and pass that. Otherwise,
+    // the WebString will be passed, leading to references to the StringImpl
+    // from two threads, which is a data race.
     main_thread_task_runner_->PostTask(
         FROM_HERE, base::Bind(&WebMessagePortChannelImpl::SendPostMessage, this,
-                              message, base::Passed(std::move(channels))));
+                              base::Passed(base::string16(message)),
+                              base::Passed(std::move(channels))));
   } else {
     SendPostMessage(message, std::move(channels));
   }
 }
 
 void WebMessagePortChannelImpl::SendPostMessage(
     const base::string16& message,
     std::unique_ptr<WebMessagePortChannelArray> channels) {
   IPC::Message* msg = new MessagePortHostMsg_PostMessage(
       message_port_id_, message, ExtractMessagePortIDs(std::move(channels)));
@@ skipping 128 matching lines @@
   ChildProcess::current()->ReleaseProcess();
 }
 
 WebMessagePortChannelImpl::Message::Message() {}
 
 WebMessagePortChannelImpl::Message::Message(const Message& other) = default;
 
 WebMessagePortChannelImpl::Message::~Message() {}
 
 }  // namespace content