[IndexedDB] Delete callbacks state on worker thread exit.

content/child/indexed_db/indexed_db_dispatcher.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/indexed_db/indexed_db_dispatcher.h"
 
 #include <utility>
 
 #include "base/format_macros.h"
 #include "base/lazy_instance.h"
@@ skipping 178 matching lines @@
   DCHECK(!base::ContainsKey(cursors_, ipc_cursor_id));
   cursors_[ipc_cursor_id] = cursor;
 }
 
 void IndexedDBDispatcher::CursorDestroyed(int32_t ipc_cursor_id) {
   cursors_.erase(ipc_cursor_id);
 }
 
 void IndexedDBDispatcher::RegisterMojoOwnedCallbacks(
     IndexedDBCallbacksImpl::InternalState* callbacks) {
-  mojo_owned_callback_state_.insert(callbacks);
+  mojo_owned_callback_state_[callbacks] = base::WrapUnique(callbacks);
 }
 
 void IndexedDBDispatcher::UnregisterMojoOwnedCallbacks(
     IndexedDBCallbacksImpl::InternalState* callbacks) {
-  DCHECK(base::ContainsValue(mojo_owned_callback_state_, callbacks));
-  mojo_owned_callback_state_.erase(callbacks);
+  auto it = mojo_owned_callback_state_.find(callbacks);
+  DCHECK(it != mojo_owned_callback_state_.end());
+  it->second.release();

[jsbell, 2016/11/21 22:38:06]

Is the release() necessary?

[Reilly Grant (use Gerrit), 2016/11/21 23:26:10]

Yes. Otherwise erase(it) will free the object and that would be bad because this
is called from within the object's destructor.

[jsbell, 2016/11/21 23:36:29]

Derp. My brain was reading `reset()` for some reason.

+  mojo_owned_callback_state_.erase(it);
 }
 
 void IndexedDBDispatcher::RegisterMojoOwnedDatabaseCallbacks(
     blink::WebIDBDatabaseCallbacks* callbacks) {
-  mojo_owned_database_callback_state_.insert(callbacks);
+  mojo_owned_database_callback_state_[callbacks] = base::WrapUnique(callbacks);
 }
 
 void IndexedDBDispatcher::UnregisterMojoOwnedDatabaseCallbacks(
     blink::WebIDBDatabaseCallbacks* callbacks) {
-  DCHECK(base::ContainsValue(mojo_owned_database_callback_state_, callbacks));
-  mojo_owned_database_callback_state_.erase(callbacks);
+  auto it = mojo_owned_database_callback_state_.find(callbacks);
+  DCHECK(it != mojo_owned_database_callback_state_.end());
+  it->second.release();
+  mojo_owned_database_callback_state_.erase(it);
 }
 
 // Populate some WebIDBValue members (data & blob info) from the supplied
 // value message (IndexedDBMsg_Value or one that includes it).
 template <class IndexedDBMsgValueType>
 static void PrepareWebValue(const IndexedDBMsgValueType& value,
                             WebIDBValue* web_value) {
   if (value.bits.empty())
     return;
 
@@ skipping 131 matching lines @@
   typedef std::map<int32_t, WebIDBCursorImpl*>::iterator Iterator;
   for (Iterator i = cursors_.begin(); i != cursors_.end(); ++i) {
     if (i->first == ipc_exception_cursor_id ||
         i->second->transaction_id() != transaction_id)
       continue;
     i->second->ResetPrefetchCache();
   }
 }
 
 }  // namespace content