IndexedDB: Fixed cursor/blob use-after-free bug

content/browser/indexed_db/indexed_db_dispatcher_host.cc

Index: content/browser/indexed_db/indexed_db_dispatcher_host.cc
diff --git a/content/browser/indexed_db/indexed_db_dispatcher_host.cc b/content/browser/indexed_db/indexed_db_dispatcher_host.cc
index ec8737b81680e5dd2c39873ee125df951688239f..abdf38046b8a897423dccf9849bc894173300526 100644
--- a/content/browser/indexed_db/indexed_db_dispatcher_host.cc
+++ b/content/browser/indexed_db/indexed_db_dispatcher_host.cc
@@ -69,7 +69,8 @@ IndexedDBDispatcherHost::IndexedDBDispatcherHost(
 }
 
 IndexedDBDispatcherHost::~IndexedDBDispatcherHost() {
-  STLDeleteValues(&blob_data_handle_map_);
+  for (auto& iter : blob_data_handle_map_)
+    delete iter.second.first;
 }
 
 void IndexedDBDispatcherHost::OnChannelConnected(int32 peer_pid) {
@@ -209,18 +210,36 @@ uint32 IndexedDBDispatcherHost::TransactionIdToProcessId(
   return (host_transaction_id >> 32) & 0xffffffff;
 }
 
+bool IndexedDBDispatcherHost::IncrementBlobDataIfHeld(const std::string& uuid) {
+  base::AutoLock lock(blob_data_map_lock_);
+  BlobDataHandleMap::iterator iter = blob_data_handle_map_.find(uuid);
+  if (iter != blob_data_handle_map_.end()) {
+    iter->second.second += 1;
+    return true;
+  }
+  return false;
+}
+
 void IndexedDBDispatcherHost::HoldBlobDataHandle(
     const std::string& uuid,
     scoped_ptr<storage::BlobDataHandle> blob_data_handle) {
+  base::AutoLock lock(blob_data_map_lock_);
   DCHECK(!ContainsKey(blob_data_handle_map_, uuid));
-  blob_data_handle_map_[uuid] = blob_data_handle.release();
+  blob_data_handle_map_[uuid] =
+      std::pair<storage::BlobDataHandle*, int>(blob_data_handle.release(), 1);
 }
 
 void IndexedDBDispatcherHost::DropBlobDataHandle(const std::string& uuid) {
+  base::AutoLock lock(blob_data_map_lock_);
   BlobDataHandleMap::iterator iter = blob_data_handle_map_.find(uuid);
   if (iter != blob_data_handle_map_.end()) {
-    delete iter->second;
-    blob_data_handle_map_.erase(iter);
+    DCHECK_GE(iter->second.second, 1);
+    if (iter->second.second == 1) {
+      delete iter->second.first;
+      blob_data_handle_map_.erase(iter);
+    } else {
+      iter->second.second -= 1;
+    }
   } else {
     DLOG(FATAL) << "Failed to find blob UUID in map:" << uuid;
   }