Fix use after free bug by calling GetTokenService in Core's ctor.

sync/internal_api/public/attachments/attachment_downloader_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SYNC_INTERNAL_API_PUBLIC_ATTACHMENTS_ATTACHMENT_DOWNLOADER_IMPL_H_
 #define SYNC_INTERNAL_API_PUBLIC_ATTACHMENTS_ATTACHMENT_DOWNLOADER_IMPL_H_
 
 #include "base/containers/scoped_ptr_hash_map.h"
 #include "base/threading/non_thread_safe.h"
 #include "google_apis/gaia/oauth2_token_service_request.h"
@@ skipping 18 matching lines @@
   //
   // |scopes| is the set of scopes to use for downloads.
   //
   // |token_service_provider| provides an OAuth2 token service.
   AttachmentDownloaderImpl(
       const GURL& sync_service_url,
       const scoped_refptr<net::URLRequestContextGetter>&
           url_request_context_getter,
       const std::string& account_id,
       const OAuth2TokenService::ScopeSet& scopes,
-      scoped_ptr<OAuth2TokenServiceRequest::TokenServiceProvider>
+      const scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>&
           token_service_provider);
   virtual ~AttachmentDownloaderImpl();
 
   // AttachmentDownloader implementation.
   virtual void DownloadAttachment(const AttachmentId& attachment_id,
                                   const DownloadCallback& callback) OVERRIDE;
 
   // OAuth2TokenService::Consumer implementation.
   virtual void OnGetTokenSuccess(const OAuth2TokenService::Request* request,
                                  const std::string& access_token,
@@ skipping 16 matching lines @@
   void ReportResult(
       const DownloadState& download_state,
       const DownloadResult& result,
       const scoped_refptr<base::RefCountedString>& attachment_data);
 
   GURL sync_service_url_;
   scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_;
 
   std::string account_id_;
   OAuth2TokenService::ScopeSet oauth2_scopes_;
-  scoped_ptr<OAuth2TokenServiceRequest::TokenServiceProvider>
+  scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>
       token_service_provider_;
   scoped_ptr<OAuth2TokenService::Request> access_token_request_;
 
   StateMap state_map_;
   // |requests_waiting_for_access_token_| only keeps references to DownloadState
   // objects while access token request is pending. It doesn't control objects'
   // lifetime.
   StateList requests_waiting_for_access_token_;
 
   DISALLOW_COPY_AND_ASSIGN(AttachmentDownloaderImpl);
 };
 
 }  // namespace syncer
 
 #endif  // SYNC_INTERNAL_API_PUBLIC_ATTACHMENTS_ATTACHMENT_DOWNLOADER_IMPL_H_