Fix use after free bug by calling GetTokenService in Core's ctor.

sync/internal_api/attachments/attachment_uploader_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sync/internal_api/public/attachments/attachment_uploader_impl.h"
 
 #include "base/bind.h"
 #include "base/message_loop/message_loop.h"
 #include "base/threading/non_thread_safe.h"
 #include "google_apis/gaia/gaia_constants.h"
@@ skipping 194 matching lines @@
   owner_->DeleteUploadStateFor(attachment_.GetId().GetProto().unique_id());
   return;
 }
 
 AttachmentUploaderImpl::AttachmentUploaderImpl(
     const GURL& sync_service_url,
     const scoped_refptr<net::URLRequestContextGetter>&
         url_request_context_getter,
     const std::string& account_id,
     const OAuth2TokenService::ScopeSet& scopes,
-    scoped_ptr<OAuth2TokenServiceRequest::TokenServiceProvider>
+    const scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>&
         token_service_provider)
     : sync_service_url_(sync_service_url),
       url_request_context_getter_(url_request_context_getter),
       account_id_(account_id),
       scopes_(scopes),
-      token_service_provider_(token_service_provider.Pass()) {
+      token_service_provider_(token_service_provider) {
   DCHECK(CalledOnValidThread());
   DCHECK(!account_id.empty());
   DCHECK(!scopes.empty());
   DCHECK(token_service_provider_);
 }
 
 AttachmentUploaderImpl::~AttachmentUploaderImpl() {
   DCHECK(CalledOnValidThread());
 }
 
@@ skipping 37 matching lines @@
   GURL::Replacements replacements;
   replacements.SetPathStr(path);
   return sync_service_url.ReplaceComponents(replacements);
 }
 
 void AttachmentUploaderImpl::DeleteUploadStateFor(const UniqueId& unique_id) {
   state_map_.erase(unique_id);
 }
 
 }  // namespace syncer