indexeddb: Removed use of dangling ptr in writeBlobToFileOnIOThread.

content/browser/indexed_db/indexed_db_backing_store.cc

Index: content/browser/indexed_db/indexed_db_backing_store.cc
diff --git a/content/browser/indexed_db/indexed_db_backing_store.cc b/content/browser/indexed_db/indexed_db_backing_store.cc
index 9c220f24533b9ba1e3d92283916316cb30f465dd..50debe3e4a283718d11596b34424e8cb6db234bc 100644
--- a/content/browser/indexed_db/indexed_db_backing_store.cc
+++ b/content/browser/indexed_db/indexed_db_backing_store.cc
@@ -2253,7 +2253,7 @@ class IndexedDBBackingStore::Transaction::ChainedBlobWriterImpl
 };
 
 class LocalWriteClosure : public FileWriterDelegate::DelegateWriteCallback,
-                          public base::RefCounted<LocalWriteClosure> {
+                          public base::RefCountedThreadSafe<LocalWriteClosure> {
  public:
   LocalWriteClosure(IndexedDBBackingStore::Transaction::ChainedBlobWriter*
                         chained_blob_writer,
@@ -2282,6 +2282,14 @@ class LocalWriteClosure : public FileWriterDelegate::DelegateWriteCallback,
                    write_status == FileWriterDelegate::SUCCESS_COMPLETED));
   }
 
+  static void ReleaseWriterOnIDBThread(
+      scoped_refptr<IndexedDBBackingStore::Transaction::ChainedBlobWriter>
+          chained_blob_writer) {
+    // Don't actually release the writer (the closure will do that) Merely

[jsbell, 2014/07/23 17:41:15]

Nit: Needs a period at the end of the sentence.

[cmumford, 2014/07/23 17:46:09]

Done.

+    // posting the ref counted pointer over to this thread ensures that it is
+    // deleted on the correct thread.
+  }
+
   void writeBlobToFileOnIOThread(const FilePath& file_path,
                                  const GURL& blob_url,
                                  net::URLRequestContext* request_context) {
@@ -2304,15 +2312,23 @@ class LocalWriteClosure : public FileWriterDelegate::DelegateWriteCallback,
   }
 
  private:
-  virtual ~LocalWriteClosure() {}
-  friend class base::RefCounted<LocalWriteClosure>;
+  virtual ~LocalWriteClosure() {
+    // Make sure the ChainedBlobWriter is derefed (and deleted) on the IDB
+    // thread since it owns a transaction which has thread affinity.
+    task_runner_->PostTask(
+        FROM_HERE,
+        base::Bind(&LocalWriteClosure::ReleaseWriterOnIDBThread,
+                   chained_blob_writer_));
+  }
+  friend class base::RefCountedThreadSafe<LocalWriteClosure>;
 
   void callBlobCallbackOnIDBTaskRunner(bool succeeded) {
     DCHECK(task_runner_->RunsTasksOnCurrentThread());
     chained_blob_writer_->ReportWriteCompletion(succeeded, bytes_written_);
   }
 
-  IndexedDBBackingStore::Transaction::ChainedBlobWriter* chained_blob_writer_;
+  scoped_refptr<IndexedDBBackingStore::Transaction::ChainedBlobWriter>
+      chained_blob_writer_;
   base::TaskRunner* task_runner_;
   int64 bytes_written_;