Use UtilityProcessHost to patch files.

chrome/browser/component_updater/component_updater_service.cc

Index: chrome/browser/component_updater/component_updater_service.cc
diff --git a/chrome/browser/component_updater/component_updater_service.cc b/chrome/browser/component_updater/component_updater_service.cc
index 920871d207f782ab0320fa425f5d3dc3cc965ec1..548a5f803d672c4ca42c6b20a16e4b4b8fef2108 100644
--- a/chrome/browser/component_updater/component_updater_service.cc
+++ b/chrome/browser/component_updater/component_updater_service.cc
@@ -21,7 +21,6 @@
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/timer/timer.h"
 #include "chrome/browser/browser_process.h"
-#include "chrome/browser/component_updater/component_patcher.h"
 #include "chrome/browser/component_updater/component_unpacker.h"
 #include "chrome/browser/component_updater/component_updater_ping_manager.h"
 #include "chrome/browser/component_updater/component_updater_utils.h"
@@ -251,8 +250,6 @@ class CrxUpdateService : public ComponentUpdateService {
 
   scoped_ptr<ComponentUpdateService::Configurator> config_;
 
-  scoped_ptr<ComponentPatcher> component_patcher_;
-
   scoped_ptr<UpdateChecker> update_checker_;
 
   scoped_ptr<PingManager> ping_manager_;
@@ -280,7 +277,6 @@ class CrxUpdateService : public ComponentUpdateService {
 
 CrxUpdateService::CrxUpdateService(ComponentUpdateService::Configurator* config)
     : config_(config),
-      component_patcher_(config->CreateComponentPatcher()),
       ping_manager_(new PingManager(config->PingUrl(),
                                     config->RequestContext())),
       blocking_task_runner_(BrowserThread::GetBlockingPool()->
@@ -843,8 +839,8 @@ void CrxUpdateService::Install(scoped_ptr<CRXContext> context,
   unpacker_.reset(new ComponentUnpacker(context->pk_hash,
                                         crx_path,
                                         context->fingerprint,
-                                        component_patcher_.get(),
                                         context->installer,
+                                        config_->InProcess(),
                                         blocking_task_runner_));
   unpacker_->Unpack(base::Bind(&CrxUpdateService::EndUnpacking,
                                base::Unretained(this),
@@ -864,6 +860,8 @@ void CrxUpdateService::EndUnpacking(const std::string& component_id,
       base::Bind(&CrxUpdateService::DoneInstalling, base::Unretained(this),
                  component_id, error, extended_error),
       base::TimeDelta::FromMilliseconds(config_->StepDelay()));
+  // Reset the unpacker last, otherwise we free our own arguments.

[Sorin Jianu, 2014/02/03 20:57:57]

What happens if the unpacker is destroyed sooner?

[waffles, 2014/02/07 01:00:59]

The problem is that the unpacker owns the EndUnpacking callback, which owns
component_id, crx_path.

If EndUnpacking destroys the unpacker, the unpacker destroys the callback, while
the callback code is running.

This is a pretty awful situation.

One possible solution is to pass a component unpacker function as the callback
function, and make the component unpacker refcounted so that the callback
maintains a reference to the component unpacker. That component unpacker
function could then call CrxUpdateService::EndUnpacking directly. This seems
really circuitous, though.

[Sorin Jianu, 2014/02/27 20:53:57]

Thank you. I would suggest rewording the comment as:
// Reset the unpacker last, since it owns the callback which is currently
running.
 
It also made me think about how the other objects in the service are released
(or not).

+  unpacker_.reset();
 }
 
 // Installation has been completed. Adjust the component status and