Fixes possible crash in SessionBackend. I believe what's happening...

chrome/browser/sessions/session_backend.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/sessions/session_backend.h"
 
 #include <limits>
 
 #include "base/file_util.h"
 #include "base/histogram.h"
@@ skipping 195 matching lines @@
   // Create the directory for session info.
   file_util::CreateDirectory(path_to_dir_);
 
   MoveCurrentSessionToLastSession();
 }
 
 void SessionBackend::AppendCommands(
     std::vector<SessionCommand*>* commands,
     bool reset_first) {
   Init();
-  if ((reset_first && !empty_file_) || !current_session_file_->IsOpen())
+  // Make sure and check current_session_file_, if opening the file failed
+  // current_session_file_ will be NULL.
+  if ((reset_first && !empty_file_) || !current_session_file_.get() ||
+      !current_session_file_->IsOpen()) {
     ResetFile();
-  if (current_session_file_->IsOpen() &&
+  }
+  // Need to check current_session_file_ again, ResetFile may fail.
+  if (current_session_file_.get() && current_session_file_->IsOpen() &&
       !AppendCommandsToFile(current_session_file_.get(), *commands)) {
     current_session_file_.reset(NULL);
   }
   empty_file_ = false;
   STLDeleteElements(commands);
   delete commands;
 }
 
 void SessionBackend::ReadLastSessionCommands(
     scoped_refptr<BaseSessionService::InternalGetCommandsRequest> request) {
@@ skipping 77 matching lines @@
     if (wrote != content_size) {
       NOTREACHED() << "error writing";
       return false;
     }
   }
   return true;
 }
 
 void SessionBackend::ResetFile() {
   DCHECK(inited_);
-  current_session_file_.reset(OpenAndWriteHeader(GetCurrentSessionPath()));
+  if (current_session_file_.get()) {
+    // File is already open, truncate it. We truncate instead of closing and
+    // reopening to avoid the possibility of scanners locking the file out
+    // from under us once we close it. If truncation fails, we'll try to
+    // recreate.
+    if (current_session_file_->Truncate(sizeof_header()) != sizeof_header())
+      current_session_file_.reset(NULL);
+  }
+  if (!current_session_file_.get())
+    current_session_file_.reset(OpenAndWriteHeader(GetCurrentSessionPath()));
   empty_file_ = true;
 }
 
 net::FileStream* SessionBackend::OpenAndWriteHeader(const FilePath& path) {
   DCHECK(!path.empty());
   net::FileStream* file = new net::FileStream();
   file->Open(path, base::PLATFORM_FILE_CREATE_ALWAYS |
-             base::PLATFORM_FILE_WRITE);
+             base::PLATFORM_FILE_WRITE | base::PLATFORM_FILE_EXCLUSIVE_WRITE |
+             base::PLATFORM_FILE_EXCLUSIVE_READ);
   if (!file->IsOpen())
     return NULL;
   int32 header[2];
   header[0] = kFileSignature;
   header[1] = kFileCurrentVersion;
   int wrote = file->Write(reinterpret_cast<char*>(&header),
                           sizeof(header), NULL);
-  if (wrote != sizeof(header))
+  if (wrote != sizeof_header())
     return NULL;
   return file;
 }
 
 FilePath SessionBackend::GetLastSessionPath() {
   FilePath path = path_to_dir_;
   if (type_ == BaseSessionService::TAB_RESTORE)
     path = path.AppendASCII(kLastTabSessionFileName);
   else
     path = path.AppendASCII(kLastSessionFileName);
   return path;
 }
 
 FilePath SessionBackend::GetCurrentSessionPath() {
   FilePath path = path_to_dir_;
   if (type_ == BaseSessionService::TAB_RESTORE)
     path = path.AppendASCII(kCurrentTabSessionFileName);
   else
     path = path.AppendASCII(kCurrentSessionFileName);
   return path;
 }