IndexedDB: Fixed cursor/blob use-after-free bug

content/browser/indexed_db/indexed_db_callbacks.cc

Index: content/browser/indexed_db/indexed_db_callbacks.cc
diff --git a/content/browser/indexed_db/indexed_db_callbacks.cc b/content/browser/indexed_db/indexed_db_callbacks.cc
index a5aafddd557f3b871f816d978d54706f964de8e6..71d188a586b1dcc42440bf1320bcf45dac709110 100644
--- a/content/browser/indexed_db/indexed_db_callbacks.cc
+++ b/content/browser/indexed_db/indexed_db_callbacks.cc
@@ -228,9 +228,11 @@ static std::string CreateBlobData(
   std::string uuid = blob_info.uuid();
   if (!uuid.empty()) {
     // We're sending back a live blob, not a reference into our backing store.
-    scoped_ptr<storage::BlobDataHandle> blob_data_handle(
-        blob_storage_context->GetBlobDataFromUUID(uuid));
-    dispatcher_host->HoldBlobDataHandle(uuid, blob_data_handle.Pass());
+    if (!dispatcher_host->IncrementBlobDataIfHeld(uuid)) {

[jsbell, 2014/12/04 00:18:16]

Can we just make the HoldBlobDataHandle API take the uuid and mint a
BlobDataHandle if necessary?

[cmumford, 2014/12/04 18:00:29]

Done.

+      scoped_ptr<storage::BlobDataHandle> blob_data_handle(
+          blob_storage_context->GetBlobDataFromUUID(uuid));
+      dispatcher_host->HoldBlobDataHandle(uuid, blob_data_handle.Pass());
+    }
     return uuid;
   }
   scoped_refptr<ShareableFileReference> shareable_file =