Fix use after free bug by calling GetTokenService in Core's ctor.

chrome/browser/sync/profile_sync_components_factory_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "build/build_config.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "chrome/browser/bookmarks/enhanced_bookmarks_features.h"
 #include "chrome/browser/dom_distiller/dom_distiller_service_factory.h"
 #include "chrome/browser/history/history_service.h"
@@ skipping 537 matching lines @@
       return base::WeakPtr<syncer::SyncableService>();
   }
 }
 
 class TokenServiceProvider
     : public OAuth2TokenServiceRequest::TokenServiceProvider {
  public:
   TokenServiceProvider(
       const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
       OAuth2TokenService* token_service);
-  virtual ~TokenServiceProvider();
 
   // OAuth2TokenServiceRequest::TokenServiceProvider implementation.
   virtual scoped_refptr<base::SingleThreadTaskRunner>
       GetTokenServiceTaskRunner() OVERRIDE;
   virtual OAuth2TokenService* GetTokenService() OVERRIDE;
 
  private:
+  virtual ~TokenServiceProvider();
+
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   OAuth2TokenService* token_service_;
 };
 
 TokenServiceProvider::TokenServiceProvider(
     const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
     OAuth2TokenService* token_service)
     : task_runner_(task_runner), token_service_(token_service) {
 }
 
@@ skipping 18 matching lines @@
       new syncer::FakeAttachmentStore(
           BrowserThread::GetMessageLoopProxyForThread(BrowserThread::FILE)));
 
   scoped_ptr<syncer::AttachmentUploader> attachment_uploader;
   scoped_ptr<syncer::AttachmentDownloader> attachment_downloader;
   // Only construct an AttachmentUploader and AttachmentDownload if we have sync
   // credentials. We may not have sync credentials because there may not be a
   // signed in sync user (e.g. sync is running in "backup" mode).
   if (!user_share.sync_credentials.email.empty() &&
       !user_share.sync_credentials.scope_set.empty()) {
-    scoped_ptr<OAuth2TokenServiceRequest::TokenServiceProvider>
+    scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>
         token_service_provider(new TokenServiceProvider(
             content::BrowserThread::GetMessageLoopProxyForThread(
                 content::BrowserThread::UI),
             token_service_));
     // TODO(maniscalco): Use shared (one per profile) thread-safe instances of
     // AttachmentUploader and AttachmentDownloader instead of creating a new one
     // per AttachmentService (bug 369536).
     attachment_uploader.reset(new syncer::AttachmentUploaderImpl(
         sync_service_url_,
         url_request_context_getter_,
         user_share.sync_credentials.email,
         user_share.sync_credentials.scope_set,
-        token_service_provider.Pass()));
+        token_service_provider));
 
-    token_service_provider.reset(new TokenServiceProvider(
+    token_service_provider = new TokenServiceProvider(
         content::BrowserThread::GetMessageLoopProxyForThread(
             content::BrowserThread::UI),
-        token_service_));
+        token_service_);
     attachment_downloader = syncer::AttachmentDownloader::Create(
         sync_service_url_,
         url_request_context_getter_,
         user_share.sync_credentials.email,
         user_share.sync_credentials.scope_set,
-        token_service_provider.Pass());
+        token_service_provider);
   }
 
   scoped_ptr<syncer::AttachmentService> attachment_service(
       new syncer::AttachmentServiceImpl(attachment_store.Pass(),
                                         attachment_uploader.Pass(),
                                         attachment_downloader.Pass(),
                                         delegate));
 
   return attachment_service.Pass();
 }
@@ skipping 33 matching lines @@
       new TypedUrlModelAssociator(profile_sync_service,
                                   history_backend,
                                   error_handler);
   TypedUrlChangeProcessor* change_processor =
       new TypedUrlChangeProcessor(profile_,
                                   model_associator,
                                   history_backend,
                                   error_handler);
   return SyncComponents(model_associator, change_processor);
 }