Fixed use-after-free in LoadCallback in bookmark_storage.cc

Fixed use-after-free in LoadCallback in bookmark_storage.cc

Note: this is a reland of https://codereview.chromium.org/373153002/
after plugging a memory leak.

BookmarkStorage isn't ref counted anymore since
https://codereview.chromium.org/370323002, and the LoadCallback() task
now gets a WeakPtr to the owning BookmarkStorage. However, it gets a
raw pointer to the BookmarkLoadDetails object, which is still owned
by BookmarkStorage and may have been destroyed when the background
task runs.

This happened on iOS tests after a recent merge.

TBR=sky@chromium.org
BUG=165760
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=282097

[Joao da Silva, 2014-07-09 13:58:16]

Sigurõur, PTAL

Cait, FYI

https://codereview.chromium.org/376203002/diff/20001/chrome/browser/bookmarks...
File chrome/browser/bookmarks/chrome_bookmark_client.cc (left):

https://codereview.chromium.org/376203002/diff/20001/chrome/browser/bookmarks...
chrome/browser/bookmarks/chrome_bookmark_client.cc:175:
->GetBookmarkTaskRunner(),
This is what caused the leak:

- this callback is owned by BookmarkLoadDetails

- BookmarkLoadDetails is owned by the LoadCallback task, which is sent to this
task runner

- some tests delete their ProfileImpls before spinning the loops, so the Profile
that owns the StartupTaskRunnerService is deleted (and the service too), but now
the deferred_task_runner_ that was created by the service stays around because
it contains a task that references the runner itself

- that task never runs (and thus never releases its reference to the task
runner) because StartupTaskRunnerService::Start() is never called (this is
usually done by the profile_manager, but some tests create Profile directly and
bypass the manager)

[Sigurður Ásgeirsson, 2014-07-09 14:02:39]

lgtm - thanks for the quick re-fix!

[sky, 2014-07-09 15:43:38]

LGTM

[Joao da Silva, 2014-07-09 15:43:39]

The CQ bit was checked by joaodasilva@chromium.org

[commit-bot: I haz the power, 2014-07-09 15:47:06]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/joaodasilva@chromium.org/376203002/20001

[commit-bot: I haz the power, 2014-07-09 16:57:03]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  mac_chromium_rel on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/mac_chromium_rel/buil...)

[commit-bot: I haz the power, 2014-07-09 19:20:47]

Change committed as 282097