IndexedDB: Fixed cursor/blob use-after-free bug

content/browser/indexed_db/indexed_db_callbacks.cc

Index: content/browser/indexed_db/indexed_db_callbacks.cc
diff --git a/content/browser/indexed_db/indexed_db_callbacks.cc b/content/browser/indexed_db/indexed_db_callbacks.cc
index a5aafddd557f3b871f816d978d54706f964de8e6..ac12a15ec75f15762774e4b3e95e0694c2d7bfdc 100644
--- a/content/browser/indexed_db/indexed_db_callbacks.cc
+++ b/content/browser/indexed_db/indexed_db_callbacks.cc
@@ -6,7 +6,6 @@
 
 #include <algorithm>
 
-#include "base/guid.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
@@ -225,13 +224,9 @@ static std::string CreateBlobData(
     scoped_refptr<IndexedDBDispatcherHost> dispatcher_host,
     storage::BlobStorageContext* blob_storage_context,

[dgrogan, 2014/12/05 01:09:29]

Looks like you can ax this parameter.

[cmumford, 2014/12/05 19:08:09]

Done.

     base::TaskRunner* task_runner) {
-  std::string uuid = blob_info.uuid();
-  if (!uuid.empty()) {
+  if (!blob_info.uuid().empty()) {
     // We're sending back a live blob, not a reference into our backing store.
-    scoped_ptr<storage::BlobDataHandle> blob_data_handle(
-        blob_storage_context->GetBlobDataFromUUID(uuid));
-    dispatcher_host->HoldBlobDataHandle(uuid, blob_data_handle.Pass());
-    return uuid;
+    return dispatcher_host->HoldBlobData(blob_info);
   }
   scoped_refptr<ShareableFileReference> shareable_file =
       ShareableFileReference::Get(blob_info.file_path());
@@ -243,17 +238,7 @@ static std::string CreateBlobData(
     if (!blob_info.release_callback().is_null())
       shareable_file->AddFinalReleaseCallback(blob_info.release_callback());
   }
-
-  uuid = base::GenerateGUID();
-  scoped_refptr<storage::BlobData> blob_data = new storage::BlobData(uuid);
-  blob_data->set_content_type(base::UTF16ToUTF8(blob_info.type()));
-  blob_data->AppendFile(
-      blob_info.file_path(), 0, blob_info.size(), blob_info.last_modified());
-  scoped_ptr<storage::BlobDataHandle> blob_data_handle(
-      blob_storage_context->AddFinishedBlob(blob_data.get()));
-  dispatcher_host->HoldBlobDataHandle(uuid, blob_data_handle.Pass());
-
-  return uuid;
+  return dispatcher_host->HoldBlobData(blob_info);
 }
 
 static bool CreateAllBlobs(