Make WebTaskRunner::postTask thread safe

third_party/WebKit/Source/platform/WebTaskRunner.cpp

Index: third_party/WebKit/Source/platform/WebTaskRunner.cpp
diff --git a/third_party/WebKit/Source/platform/WebTaskRunner.cpp b/third_party/WebKit/Source/platform/WebTaskRunner.cpp
index d7b0d130780aa540e5ffb9bc11ab21b645b4c390..3555a3eb8452cfbd5b251e0da7464e09d7962dfe 100644
--- a/third_party/WebKit/Source/platform/WebTaskRunner.cpp
+++ b/third_party/WebKit/Source/platform/WebTaskRunner.cpp
@@ -29,6 +29,14 @@ struct CallbackCancellationTraits<
 
 namespace blink {
 
+namespace {
+
+void runCrossThreadClosure(std::unique_ptr<CrossThreadClosure> task) {
+  (*task)();
+}
+
+}  // namespace
+
 class TaskHandle::Runner : public WTF::ThreadSafeRefCounted<Runner> {
  public:
   explicit Runner(std::unique_ptr<WTF::Closure> task)
@@ -103,17 +111,21 @@ TaskHandle::TaskHandle(RefPtr<Runner> runner) : m_runner(std::move(runner)) {
   DCHECK(m_runner);
 }
 
+// Use a custom function for base::Bind instead of convertToBaseCallback to
+// avoid copying the closure later in the call chain. Copying the bound state
+// can lead to data races with ref counted objects like StringImpl. See
+// crbug.com/679915 for more details.

[Wez, 2017/01/11 21:21:49]

Wouldn't it be better to "fix" convertToBaseCallback() to do this wrapping of
the |task| into a Callback?

This issue is caused by moving from a Task with move semantics to a Callback
with copy semantics, so it will also affect other sites where
convertToBaseCallback() is used, e.g. the WTF::Closure postTask() overload
below, right?

 void WebTaskRunner::postTask(const WebTraceLocation& location,
                              std::unique_ptr<CrossThreadClosure> task) {
-  toSingleThreadTaskRunner()->PostTask(location,
-                                       convertToBaseCallback(std::move(task)));
+  toSingleThreadTaskRunner()->PostTask(
+      location, base::Bind(&runCrossThreadClosure, base::Passed(&task)));
 }
 
 void WebTaskRunner::postDelayedTask(const WebTraceLocation& location,
                                     std::unique_ptr<CrossThreadClosure> task,
                                     long long delayMs) {
   toSingleThreadTaskRunner()->PostDelayedTask(
-      location, convertToBaseCallback(std::move(task)),
+      location, base::Bind(&runCrossThreadClosure, base::Passed(&task)),
       base::TimeDelta::FromMilliseconds(delayMs));
 }