Quota double-delete fix

webkit/quota/quota_task.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/quota/quota_task.h"
 
 #include <algorithm>
 #include <functional>
 
 #include "base/bind.h"
@@ skipping 12 matching lines @@
 }
 
 void QuotaTask::Start() {
   DCHECK(observer_);
   observer()->RegisterTask(this);
   Run();
 }
 
 QuotaTask::QuotaTask(QuotaTaskObserver* observer)
     : observer_(observer),
-      original_task_runner_(base::MessageLoopProxy::current()) {
+      original_task_runner_(base::MessageLoopProxy::current()),
+      delete_scheduled_(false) {
 }
 
 void QuotaTask::CallCompleted() {
   DCHECK(original_task_runner_->BelongsToCurrentThread());
   if (observer_) {
     observer_->UnregisterTask(this);
     Completed();
   }
 }
 
 void QuotaTask::Abort() {
   DCHECK(original_task_runner_->BelongsToCurrentThread());
   observer_ = NULL;
   Aborted();
 }
 
 void QuotaTask::DeleteSoon() {
+  DCHECK(original_task_runner_->BelongsToCurrentThread());
+  if (delete_scheduled_)
+    return;
+  delete_scheduled_ = true;
   MessageLoop::current()->DeleteSoon(FROM_HERE, this);
 }
 
 // QuotaThreadTask ---------------------------------------------------------
 
 QuotaThreadTask::QuotaThreadTask(
     QuotaTaskObserver* observer,
     TaskRunner* target_task_runner)
     : QuotaTask(observer),
       target_task_runner_(target_task_runner) {
@@ skipping 38 matching lines @@
 void QuotaTaskObserver::RegisterTask(QuotaTask* task) {
   running_quota_tasks_.insert(task);
 }
 
 void QuotaTaskObserver::UnregisterTask(QuotaTask* task) {
   DCHECK(running_quota_tasks_.find(task) != running_quota_tasks_.end());
   running_quota_tasks_.erase(task);
 }
 
 }  // namespace quota