[BlobAsync] Moving async handling into BlobStorageContext & quota out.

chrome/browser/chrome_security_exploit_browsertest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/macros.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
@@ skipping 73 matching lines @@
   std::string blob_contents = "<script>chrome.extensions</script>";
   std::string blob_path = "5881f76e-10d2-410d-8c61-ef210502acfd";
 
   // Target the bookmark manager extension.
   std::string target_origin =
       "chrome-extension://eemcgdkfndhakfknompkggombfjjjeno";
 
   std::vector<storage::DataElement> data_elements(1);
   data_elements[0].SetToBytes(blob_contents.c_str(), blob_contents.size());
 
   // Set up a blob ID and populate it with attacker-controlled value. These two

[pwnall, 2016/11/04 02:26:54]

The comment diverges from the code.

[dmurph, 2016/11/04 23:23:01]

Done.

   // messages are allowed, because this data is not in any origin.
   IPC::IpcSecurityTestUtil::PwnMessageReceived(
       rfh->GetProcess()->GetChannel(),
-      BlobStorageMsg_RegisterBlobUUID(blob_id, blob_type, "",
-                                      std::set<std::string>()));
+      BlobStorageMsg_RegisterBlob(blob_id, blob_type, "", data_elements));
 
-  IPC::IpcSecurityTestUtil::PwnMessageReceived(
-      rfh->GetProcess()->GetChannel(),
-      BlobStorageMsg_StartBuildingBlob(blob_id, data_elements));
 
   // This IPC should result in a kill because |target_origin| is not commitable
   // in |rfh->GetProcess()|.
   content::RenderProcessHostWatcher crash_observer(
       rfh->GetProcess(),
       content::RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
   IPC::IpcSecurityTestUtil::PwnMessageReceived(
       rfh->GetProcess()->GetChannel(),
       BlobHostMsg_RegisterPublicURL(
           GURL("blob:" + target_origin + "/" + blob_path), blob_id));
   crash_observer.Wait();  // If the process is killed, this test passes.
 }