IndexedDB: Fixed cursor/blob use-after-free bug

content/browser/indexed_db/indexed_db_dispatcher_host.h

Index: content/browser/indexed_db/indexed_db_dispatcher_host.h
diff --git a/content/browser/indexed_db/indexed_db_dispatcher_host.h b/content/browser/indexed_db/indexed_db_dispatcher_host.h
index 667ec7cc2e86c65314bd26f7304bd666932c55d2..6bfc126a6e2e5b2114c70acdef1f74b057917c09 100644
--- a/content/browser/indexed_db/indexed_db_dispatcher_host.h
+++ b/content/browser/indexed_db/indexed_db_dispatcher_host.h
@@ -7,6 +7,7 @@
 
 #include <map>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/basictypes.h"
@@ -96,6 +97,7 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
 
   void HoldBlobDataHandle(const std::string& uuid,
                           scoped_ptr<storage::BlobDataHandle> blob_data_handle);
+  bool IncrementBlobDataIfHeld(const std::string& uuid);
   void DropBlobDataHandle(const std::string& uuid);
 
  private:
@@ -104,7 +106,8 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
   friend class base::DeleteHelper<IndexedDBDispatcherHost>;
 
   // Used in nested classes.
-  typedef std::map<std::string, storage::BlobDataHandle*> BlobDataHandleMap;
+  typedef std::map<std::string, std::pair<storage::BlobDataHandle*, int>>
+      BlobDataHandleMap;
   typedef std::map<int64, int64> TransactionIDToDatabaseIDMap;
   typedef std::map<int64, uint64> TransactionIDToSizeMap;
   typedef std::map<int64, GURL> TransactionIDToURLMap;
@@ -269,6 +272,7 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
   scoped_refptr<IndexedDBContextImpl> indexed_db_context_;
   scoped_refptr<ChromeBlobStorageContext> blob_storage_context_;
 
+  base::Lock blob_data_map_lock_;
   BlobDataHandleMap blob_data_handle_map_;
 
   // Only access on IndexedDB thread.