IndexedDB: Fixed cursor/blob use-after-free bug

content/browser/indexed_db/indexed_db_dispatcher_host.h

Index: content/browser/indexed_db/indexed_db_dispatcher_host.h
diff --git a/content/browser/indexed_db/indexed_db_dispatcher_host.h b/content/browser/indexed_db/indexed_db_dispatcher_host.h
index 667ec7cc2e86c65314bd26f7304bd666932c55d2..eb727d15222a63c328aa141fb306b1718791eb57 100644
--- a/content/browser/indexed_db/indexed_db_dispatcher_host.h
+++ b/content/browser/indexed_db/indexed_db_dispatcher_host.h
@@ -7,6 +7,7 @@
 
 #include <map>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/basictypes.h"
@@ -33,6 +34,7 @@ struct IndexedDBHostMsg_FactoryGetDatabaseNames_Params;
 struct IndexedDBHostMsg_FactoryOpen_Params;
 
 namespace content {
+class IndexedDBBlobInfo;
 class IndexedDBConnection;
 class IndexedDBContextImpl;
 class IndexedDBCursor;
@@ -94,9 +96,7 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
   static uint32 TransactionIdToRendererTransactionId(int64 host_transaction_id);
   static uint32 TransactionIdToProcessId(int64 host_transaction_id);
 
-  void HoldBlobDataHandle(const std::string& uuid,
-                          scoped_ptr<storage::BlobDataHandle> blob_data_handle);
-  void DropBlobDataHandle(const std::string& uuid);
+  std::string HoldBlobData(const IndexedDBBlobInfo& blob_info);
 
  private:
   // Friends to enable OnDestruct() delegation.
@@ -104,7 +104,8 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
   friend class base::DeleteHelper<IndexedDBDispatcherHost>;
 
   // Used in nested classes.
-  typedef std::map<std::string, storage::BlobDataHandle*> BlobDataHandleMap;
+  typedef std::map<std::string, std::pair<storage::BlobDataHandle*, int>>
+      BlobDataHandleMap;
   typedef std::map<int64, int64> TransactionIDToDatabaseIDMap;
   typedef std::map<int64, uint64> TransactionIDToSizeMap;
   typedef std::map<int64, GURL> TransactionIDToURLMap;
@@ -261,6 +262,7 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
                    std::vector<storage::BlobDataHandle*> handles);
 
   void ResetDispatcherHosts();
+  void DropBlobData(const std::string& uuid);
 
   // The getter holds the context until OnChannelConnected() can be called from
   // the IO thread, which will extract the net::URLRequestContext from it.