ServiceWorker: Add a check if error handler runs on the right thread

content/browser/service_worker/embedded_worker_instance.cc

Index: content/browser/service_worker/embedded_worker_instance.cc
diff --git a/content/browser/service_worker/embedded_worker_instance.cc b/content/browser/service_worker/embedded_worker_instance.cc
index dcf7580597bc687029169a2ba30cc41139c05a63..6fb30fdeff79f0695c595379d08da704e500893d 100644
--- a/content/browser/service_worker/embedded_worker_instance.cc
+++ b/content/browser/service_worker/embedded_worker_instance.cc
@@ -121,6 +121,17 @@ void SetupMojoOnUIThread(
       mojo::MakeProxy(std::move(exposed_interfaces)));
 }
 
+void CallDetach(EmbeddedWorkerInstance* instance) {

[nhiroki, 2016/11/02 08:42:39]

Just to confirm: A raw pointer is safe here because a callback bound with
CallDetach() is owned by EmbeddedWorkerInstance::client_ that has the same
lifetime with EmbeddedWorkerInstance.

[shimazu, 2016/11/04 01:09:21]

Done.

+  // This could be called on the UI thread if |client_| still be valid when the
+  // message loop on the UI thread gets destructed.
+  // TODO(shimazu): Remove this after https://crbug.com/604762 is fixed
+  if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
+    DCHECK(ServiceWorkerUtils::IsMojoForServiceWorkerEnabled());
+    return;
+  }
+  instance->Detach();
+}
+
 }  // namespace
 
 // Lives on IO thread, proxies notifications to DevToolsManager that lives on
@@ -477,7 +488,7 @@ void EmbeddedWorkerInstance::Start(
   if (ServiceWorkerUtils::IsMojoForServiceWorkerEnabled()) {
     request = mojo::GetProxy(&client_);
     client_.set_connection_error_handler(
-        base::Bind(&EmbeddedWorkerInstance::Detach, base::Unretained(this)));
+        base::Bind(&CallDetach, base::Unretained(this)));
   }
 
   inflight_start_task_.reset(