Fix use after free bug by calling GetTokenService in Core's ctor.

sync/internal_api/attachments/attachment_uploader_impl_unittest.cc

Index: sync/internal_api/attachments/attachment_uploader_impl_unittest.cc
diff --git a/sync/internal_api/attachments/attachment_uploader_impl_unittest.cc b/sync/internal_api/attachments/attachment_uploader_impl_unittest.cc
index 14fcfc75cde4f566d6f2e7510765335a562f58dd..9cfc625b3b8247893ab2618a87ec8093090dbca6 100644
--- a/sync/internal_api/attachments/attachment_uploader_impl_unittest.cc
+++ b/sync/internal_api/attachments/attachment_uploader_impl_unittest.cc
@@ -135,7 +135,6 @@ class TokenServiceProvider
       base::NonThreadSafe {
  public:
   TokenServiceProvider(OAuth2TokenService* token_service);
-  virtual ~TokenServiceProvider();
 
   // OAuth2TokenService::TokenServiceProvider implementation.
   virtual scoped_refptr<base::SingleThreadTaskRunner>
@@ -143,6 +142,8 @@ class TokenServiceProvider
   virtual OAuth2TokenService* GetTokenService() OVERRIDE;
 
  private:
+  virtual ~TokenServiceProvider();
+
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   OAuth2TokenService* token_service_;
 };
@@ -268,7 +269,7 @@ void AttachmentUploaderImplTest::SetUp() {
   GURL url(base::StringPrintf("http://localhost:%d/", server_.port()));
 
   token_service_.reset(new MockOAuth2TokenService);
-  scoped_ptr<OAuth2TokenServiceRequest::TokenServiceProvider>
+  scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>
       token_service_provider(new TokenServiceProvider(token_service_.get()));
 
   OAuth2TokenService::ScopeSet scopes;
@@ -277,7 +278,7 @@ void AttachmentUploaderImplTest::SetUp() {
                                               url_request_context_getter_,
                                               kAccountId,
                                               scopes,
-                                              token_service_provider.Pass()));
+                                              token_service_provider));
 
   upload_callback_ = base::Bind(&AttachmentUploaderImplTest::UploadDone,
                                 base::Unretained(this));