Fix use after free bug by calling GetTokenService in Core's ctor.

sync/internal_api/attachments/attachment_downloader_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sync/internal_api/public/attachments/attachment_downloader_impl.h"
 
 #include "base/bind.h"
 #include "base/message_loop/message_loop.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_status_code.h"
@@ skipping 23 matching lines @@
     const AttachmentUrl& attachment_url)
     : attachment_id(attachment_id), attachment_url(attachment_url) {
 }
 
 AttachmentDownloaderImpl::AttachmentDownloaderImpl(
     const GURL& sync_service_url,
     const scoped_refptr<net::URLRequestContextGetter>&
         url_request_context_getter,
     const std::string& account_id,
     const OAuth2TokenService::ScopeSet& scopes,
-    scoped_ptr<OAuth2TokenServiceRequest::TokenServiceProvider>
+    const scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>&
         token_service_provider)
     : OAuth2TokenService::Consumer("attachment-downloader-impl"),
       sync_service_url_(sync_service_url),
       url_request_context_getter_(url_request_context_getter),
       account_id_(account_id),
       oauth2_scopes_(scopes),
-      token_service_provider_(token_service_provider.Pass()) {
+      token_service_provider_(token_service_provider) {
   DCHECK(!account_id.empty());
   DCHECK(!scopes.empty());
   DCHECK(token_service_provider_);
   DCHECK(url_request_context_getter_);
 }
 
 AttachmentDownloaderImpl::~AttachmentDownloaderImpl() {
 }
 
 void AttachmentDownloaderImpl::DownloadAttachment(
@@ skipping 131 matching lines @@
       attachment.reset(new Attachment(Attachment::CreateWithId(
           download_state.attachment_id, attachment_data)));
     }
 
     base::MessageLoop::current()->PostTask(
         FROM_HERE, base::Bind(*iter, result, base::Passed(&attachment)));
   }
 }
 
 }  // namespace syncer