Fix base::internal::WeakReferenceOwner races.

base/memory/weak_ptr.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Weak pointers help in cases where you have many objects referring back to a
 // shared object and you wish for the lifetime of the shared object to not be
 // bound to the lifetime of the referrers.  In other words, this is useful when
 // reference counting is not a good fit.
 //
 // A common alternative to weak pointers is to have the shared object hold a
@@ skipping 37 matching lines @@
 // WARNING: weak pointers are not threadsafe!!!  You must only use a WeakPtr
 // instance on thread where it was created.
 
 #ifndef BASE_MEMORY_WEAK_PTR_H_
 #define BASE_MEMORY_WEAK_PTR_H_
 #pragma once
 
 #include "base/base_api.h"
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
+#include "base/synchronization/lock.h"
 #include "base/threading/thread_checker.h"
 
 namespace base {
 
 namespace internal {
 // These classes are part of the WeakPtr implementation.
 // DO NOT USE THESE CLASSES DIRECTLY YOURSELF.
 
 class BASE_API WeakReference {
  public:
@@ skipping 28 matching lines @@
 };
 
 class BASE_API WeakReferenceOwner {
  public:
   WeakReferenceOwner();
   ~WeakReferenceOwner();
 
   WeakReference GetRef() const;
 
   bool HasRefs() const {
+    AutoLock auto_lock(lock_);
     return flag_ != NULL;
   }
 
   void Invalidate();
 
   // Indicates that this object will be used on another thread from now on.
   void DetachFromThread() {
+    AutoLock auto_lock(lock_);
     if (flag_) flag_->DetachFromThread();
   }
 
  private:
+  // Needs locking since WeakReference::Flag may be destroyed on a different
+  // thread.
+  mutable Lock lock_;
   mutable WeakReference::Flag* flag_;
 };
 
 // This class simplifies the implementation of WeakPtr's type conversion
 // constructor by avoiding the need for a public accessor for ref_.  A
 // WeakPtr<T> cannot access the private members of WeakPtr<U>, so this
 // base class gives us a way to access ref_ in a protected fashion.
 class BASE_API WeakPtrBase {
  public:
   WeakPtrBase();
@@ skipping 119 matching lines @@
 
  private:
   internal::WeakReferenceOwner weak_reference_owner_;
   T* ptr_;
   DISALLOW_IMPLICIT_CONSTRUCTORS(WeakPtrFactory);
 };
 
 }  // namespace base
 
 #endif  // BASE_MEMORY_WEAK_PTR_H_