Remove data race in WebDataRequest::CancelRequest.

components/webdata/common/web_data_request_manager.h

Index: components/webdata/common/web_data_request_manager.h
diff --git a/components/webdata/common/web_data_request_manager.h b/components/webdata/common/web_data_request_manager.h
index 87b5509158375c61b8abe819be392828c1127d89..46699c8b3df7ba519175ba6bffe1bff4fb2aa820 100644
--- a/components/webdata/common/web_data_request_manager.h
+++ b/components/webdata/common/web_data_request_manager.h
@@ -12,6 +12,7 @@
 #include <map>
 #include <memory>
 
+#include "base/atomicops.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/single_thread_task_runner.h"
@@ -48,11 +49,13 @@ class WebDataRequest {
 
   // Private constructor called for WebDataRequestManager::NewRequest.
   WebDataRequest(WebDataRequestManager* manager,
-                 WebDataServiceConsumer* consumer);
+                 WebDataServiceConsumer* consumer,
+                 WebDataServiceBase::Handle handle);
 
-  // Internal debugging helper to assert that the request is active and that the
-  // manager's lock is held by the current thread.
-  void AssertThreadSafe() const;
+  // Retrieves the manager set in the constructor, if the request is still
+  // active, or nullptr if the request is inactive. The returned value may
+  // change between calls.
+  WebDataRequestManager* GetManager() const;

[Peter Kasting, 2017/04/28 06:36:41]

Const methods should not return non-const pointers.  Either make the pointer
const or the method non-const.

[Roger McFarlane (Chromium), 2017/04/28 15:06:13]

Removed const qualifiers as needed.

 
   // Retrieves the |consumer_| set in the constructor.
   WebDataServiceConsumer* GetConsumer() const;
@@ -67,16 +70,18 @@ class WebDataRequest {
   // Tracks task runner that the request originated on.
   const scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
-  // Used to notify manager if request is cancelled. Uses a raw ptr instead of
-  // a ref_ptr so that it can be set to null when a request is cancelled or
-  // completed.
-  WebDataRequestManager* manager_;
+  // The manager associated with this request. This is stored as a raw (untyped)
+  // pointer value because it does double duty as the flag indicating whether or
+  // not this request is active (non-nullptr => active).
+  base::subtle::AtomicWord atomic_manager_;
+  static_assert(sizeof(atomic_manager_) == sizeof(WebDataRequestManager*),
+                "size mismatch");
 
   // The originator of the service request.
-  WebDataServiceConsumer* consumer_;
+  WebDataServiceConsumer* const consumer_;
 
   // Identifier for this request.
-  WebDataServiceBase::Handle handle_;
+  const WebDataServiceBase::Handle handle_;
 
   DISALLOW_COPY_AND_ASSIGN(WebDataRequest);
 };
@@ -104,10 +109,6 @@ class WebDataRequestManager
   void RequestCompleted(std::unique_ptr<WebDataRequest> request,
                         std::unique_ptr<WDTypedResult> result);
 
-  // A debugging aid to assert that the pending_lock_ is held by the current
-  // thread.
-  void AssertLockedByCurrentThread() const;
-
  private:
   friend class base::RefCountedThreadSafe<WebDataRequestManager>;