indexeddb: Removed use of dangling ptr in writeBlobToFileOnIOThread.

content/browser/indexed_db/indexed_db_backing_store.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_backing_store.h"
 
 #include "base/file_util.h"
 #include "base/files/file_path.h"
 #include "base/format_macros.h"
 #include "base/json/json_reader.h"
@@ skipping 2235 matching lines @@
   int64 database_id_;
   IndexedDBBackingStore* backing_store_;
   scoped_refptr<IndexedDBBackingStore::BlobWriteCallback> callback_;
   scoped_ptr<FileWriterDelegate> delegate_;
   bool aborted_;
 
   DISALLOW_COPY_AND_ASSIGN(ChainedBlobWriterImpl);
 };
 
 class LocalWriteClosure : public FileWriterDelegate::DelegateWriteCallback,
-                          public base::RefCounted<LocalWriteClosure> {
+                          public base::RefCountedThreadSafe<LocalWriteClosure> {
  public:
   LocalWriteClosure(IndexedDBBackingStore::Transaction::ChainedBlobWriter*
                         chained_blob_writer,
                     base::TaskRunner* task_runner)
       : chained_blob_writer_(chained_blob_writer),
         task_runner_(task_runner),
         bytes_written_(0) {}
 
   void Run(base::File::Error rv,
            int64 bytes,
            FileWriterDelegate::WriteProgressStatus write_status) {
     DCHECK_GE(bytes, 0);
     bytes_written_ += bytes;
     if (write_status == FileWriterDelegate::SUCCESS_IO_PENDING)
       return;  // We don't care about progress events.
     if (rv == base::File::FILE_OK) {
       DCHECK_EQ(write_status, FileWriterDelegate::SUCCESS_COMPLETED);
     } else {
       DCHECK(write_status == FileWriterDelegate::ERROR_WRITE_STARTED ||
              write_status == FileWriterDelegate::ERROR_WRITE_NOT_STARTED);
     }
     task_runner_->PostTask(
         FROM_HERE,
         base::Bind(&LocalWriteClosure::callBlobCallbackOnIDBTaskRunner,
                    this,
                    write_status == FileWriterDelegate::SUCCESS_COMPLETED));
   }
 
+  static void ReleaseWriterOnIDBThread(
+      scoped_refptr<IndexedDBBackingStore::Transaction::ChainedBlobWriter>
+          chained_blob_writer) {
+    // Don't actually release the writer (the closure will do that) Merely

[jsbell, 2014/07/23 17:41:15]

Nit: Needs a period at the end of the sentence.

[cmumford, 2014/07/23 17:46:09]

Done.

+    // posting the ref counted pointer over to this thread ensures that it is
+    // deleted on the correct thread.
+  }
+
   void writeBlobToFileOnIOThread(const FilePath& file_path,
                                  const GURL& blob_url,
                                  net::URLRequestContext* request_context) {
     DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
     scoped_ptr<fileapi::FileStreamWriter> writer(
         fileapi::FileStreamWriter::CreateForLocalFile(
             task_runner_, file_path, 0,
             fileapi::FileStreamWriter::CREATE_NEW_FILE));
     scoped_ptr<FileWriterDelegate> delegate(
         new FileWriterDelegate(writer.Pass(),
                                FileWriterDelegate::FLUSH_ON_COMPLETION));
 
     DCHECK(blob_url.is_valid());
     scoped_ptr<net::URLRequest> blob_request(request_context->CreateRequest(
         blob_url, net::DEFAULT_PRIORITY, delegate.get(), NULL));
 
     delegate->Start(blob_request.Pass(),
                     base::Bind(&LocalWriteClosure::Run, this));
     chained_blob_writer_->set_delegate(delegate.Pass());
   }
 
  private:
-  virtual ~LocalWriteClosure() {}
-  friend class base::RefCounted<LocalWriteClosure>;
+  virtual ~LocalWriteClosure() {
+    // Make sure the ChainedBlobWriter is derefed (and deleted) on the IDB
+    // thread since it owns a transaction which has thread affinity.
+    task_runner_->PostTask(
+        FROM_HERE,
+        base::Bind(&LocalWriteClosure::ReleaseWriterOnIDBThread,
+                   chained_blob_writer_));
+  }
+  friend class base::RefCountedThreadSafe<LocalWriteClosure>;
 
   void callBlobCallbackOnIDBTaskRunner(bool succeeded) {
     DCHECK(task_runner_->RunsTasksOnCurrentThread());
     chained_blob_writer_->ReportWriteCompletion(succeeded, bytes_written_);
   }
 
-  IndexedDBBackingStore::Transaction::ChainedBlobWriter* chained_blob_writer_;
+  scoped_refptr<IndexedDBBackingStore::Transaction::ChainedBlobWriter>
+      chained_blob_writer_;
   base::TaskRunner* task_runner_;
   int64 bytes_written_;
 
   DISALLOW_COPY_AND_ASSIGN(LocalWriteClosure);
 };
 
 bool IndexedDBBackingStore::WriteBlobFile(
     int64 database_id,
     const Transaction::WriteDescriptor& descriptor,
     Transaction::ChainedBlobWriter* chained_blob_writer) {
@@ skipping 1933 matching lines @@
     int64_t size,
     base::Time last_modified)
     : is_file_(true),
       file_path_(file_path),
       key_(key),
       size_(size),
       last_modified_(last_modified) {
 }
 
 }  // namespace content