Fix race when calling GetWeakPtr() from multiple threads.

media/blink/buffered_data_source.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MEDIA_BLINK_BUFFERED_DATA_SOURCE_H_
 #define MEDIA_BLINK_BUFFERED_DATA_SOURCE_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 25 matching lines @@
   virtual void AddBufferedByteRange(int64 start, int64 end) = 0;
 
  protected:
   virtual ~BufferedDataSourceHost() {}
 };
 
 // A data source capable of loading URLs and buffering the data using an
 // in-memory sliding window.
 //
 // BufferedDataSource must be created and initialized on the render thread
 // before being passed to other threads. It may be deleted on any thread.

[Wez, 2014/11/18 23:28:10]

This means you can't use thread-bound resources like WeakPtrFactory in this
class - WeakPtrFactory must always be torn down or invalidated on the same
thread that the WeakPtrs are used on.

Which threads does this implementation actually run, or get called, on?  It
looks like it's an "owned" object that gets called from multiple threads...?

[no sievers, 2014/11/18 23:32:19]

I missed that. That'd be bad. I thought this object lives on a thread which
doesn't change. And another thread comes and gets a WeakPtr (while it knows the
object is still around) and then uses the WeakPtr only to run tasks on the
thread that the object lives on.

[DaleCurtis, 2014/11/18 23:47:46]

I don't think these docs are true anymore, see:

https://code.google.com/p/chromium/codesearch#chromium/src/media/blink/webmed...

Which owns the BufferedDataSource.

 class MEDIA_EXPORT BufferedDataSource : public DataSource {
  public:
   // Used to specify video preload states. They are "hints" to the browser about
   // how aggressively the browser should load and buffer data.
   // Please see the HTML5 spec for the descriptions of these values:
   // http://www.w3.org/TR/html5/video.html#attr-media-preload
   //
   // Enum values must match the values in blink::WebMediaPlayer::Preload and
   // there will be assertions at compile time if they do not match.
   enum Preload {
@@ skipping 171 matching lines @@
   scoped_refptr<MediaLog> media_log_;
 
   // Host object to report buffered byte range changes to.
   BufferedDataSourceHost* host_;
 
   DownloadingCB downloading_cb_;
 
   // NOTE: Weak pointers must be invalidated before all other member variables.
   base::WeakPtrFactory<BufferedDataSource> weak_factory_;
 
+  // Disallow rebinding WeakReference ownership to a different thread by keeping
+  // a persistent reference. This avoids problems with the thread-safety of
+  // reaching into this class from multiple threads to attain a WeakPtr.
+  const base::WeakPtr<BufferedDataSource> weak_ptr_;
+
   DISALLOW_COPY_AND_ASSIGN(BufferedDataSource);
 };
 
 }  // namespace media
 
 #endif  // MEDIA_BLINK_BUFFERED_DATA_SOURCE_H_