Fix use after free bug by calling GetTokenService in Core's ctor.

sync/internal_api/attachments/attachment_downloader_impl_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sync/internal_api/public/attachments/attachment_downloader.h"
 
 #include "base/bind.h"
 #include "base/memory/weak_ptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
@@ skipping 81 matching lines @@
     const ScopeSet& scopes,
     const std::string& access_token) {
   ++num_invalidate_token_;
 }
 
 class TokenServiceProvider
     : public OAuth2TokenServiceRequest::TokenServiceProvider,
       base::NonThreadSafe {
  public:
   TokenServiceProvider(OAuth2TokenService* token_service);
-  virtual ~TokenServiceProvider();
 
   // OAuth2TokenService::TokenServiceProvider implementation.
   virtual scoped_refptr<base::SingleThreadTaskRunner>
       GetTokenServiceTaskRunner() OVERRIDE;
   virtual OAuth2TokenService* GetTokenService() OVERRIDE;
 
  private:
+  virtual ~TokenServiceProvider();
+
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   OAuth2TokenService* token_service_;
 };
 
 TokenServiceProvider::TokenServiceProvider(OAuth2TokenService* token_service)
     : task_runner_(base::ThreadTaskRunnerHandle::Get()),
       token_service_(token_service) {
   DCHECK(token_service_);
 }
 
@@ skipping 55 matching lines @@
   ResultsMap download_results_;
   int num_completed_downloads_;
 };
 
 void AttachmentDownloaderImplTest::SetUp() {
   url_request_context_getter_ =
       new net::TestURLRequestContextGetter(message_loop_.message_loop_proxy());
   url_fetcher_factory_.set_remove_fetcher_on_delete(true);
   token_service_.reset(new MockOAuth2TokenService());
   token_service_->AddAccount(kAccountId);
-  scoped_ptr<OAuth2TokenServiceRequest::TokenServiceProvider>
+  scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>
       token_service_provider(new TokenServiceProvider(token_service_.get()));
 
   OAuth2TokenService::ScopeSet scopes;
   scopes.insert(GaiaConstants::kChromeSyncOAuth2Scope);
   attachment_downloader_ =
       AttachmentDownloader::Create(GURL(kAttachmentServerUrl),
                                    url_request_context_getter_,
                                    kAccountId,
                                    scopes,
-                                   token_service_provider.Pass());
+                                   token_service_provider);
 }
 
 void AttachmentDownloaderImplTest::TearDown() {
   RunMessageLoop();
 }
 
 void AttachmentDownloaderImplTest::CompleteDownload(int response_code) {
   // TestURLFetcherFactory remembers last active URLFetcher.
   net::TestURLFetcher* fetcher = url_fetcher_factory_.GetFetcherByID(0);
   // There should be outstanding url fetch request.
@@ skipping 142 matching lines @@
       GoogleServiceAuthError::AuthErrorNone());
   RunMessageLoop();
   // Fail URLFetcher. This should trigger download failure. Access token
   // shouldn't be invalidated.
   CompleteDownload(net::HTTP_SERVICE_UNAVAILABLE);
   EXPECT_EQ(0, token_service()->num_invalidate_token());
   VerifyDownloadResult(id1, AttachmentDownloader::DOWNLOAD_UNSPECIFIED_ERROR);
 }
 
 }  // namespace syncer