Prevent cross-thread refcounting for thread-unsafe IndexedDBCallbacks.

content/browser/indexed_db/indexed_db_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 
 #include <stddef.h>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 275 matching lines @@
   if (!IsValidOrigin(origin)) {
     mojo::ReportBadMessage(kInvalidOrigin);
     return;
   }
 
   scoped_refptr<IndexedDBCallbacks> callbacks(
       new IndexedDBCallbacks(this, origin, std::move(callbacks_info)));
   indexed_db_context_->TaskRunner()->PostTask(
       FROM_HERE,
       base::Bind(&IndexedDBDispatcherHost::GetDatabaseNamesOnIDBThread, this,
-                 callbacks, origin));
+                 base::Passed(&callbacks), origin));
 }
 
 void IndexedDBDispatcherHost::Open(
     int32_t worker_thread,
     ::indexed_db::mojom::CallbacksAssociatedPtrInfo callbacks_info,
     ::indexed_db::mojom::DatabaseCallbacksAssociatedPtrInfo
         database_callbacks_info,
     const url::Origin& origin,
     const base::string16& name,
     int64_t version,
     int64_t transaction_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   if (!IsValidOrigin(origin)) {
     mojo::ReportBadMessage(kInvalidOrigin);
     return;
   }
 
   scoped_refptr<IndexedDBCallbacks> callbacks(
       new IndexedDBCallbacks(this, origin, std::move(callbacks_info)));
   scoped_refptr<IndexedDBDatabaseCallbacks> database_callbacks(
       new IndexedDBDatabaseCallbacks(this, worker_thread,
                                      std::move(database_callbacks_info)));
   indexed_db_context_->TaskRunner()->PostTask(
       FROM_HERE,
-      base::Bind(&IndexedDBDispatcherHost::OpenOnIDBThread, this, callbacks,
-                 database_callbacks, origin, name, version, transaction_id));
+      base::Bind(&IndexedDBDispatcherHost::OpenOnIDBThread, this,
+                 base::Passed(&callbacks), base::Passed(&database_callbacks),
+                 origin, name, version, transaction_id));
 }
 
 void IndexedDBDispatcherHost::DeleteDatabase(
     ::indexed_db::mojom::CallbacksAssociatedPtrInfo callbacks_info,
     const url::Origin& origin,
     const base::string16& name) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   if (!IsValidOrigin(origin)) {
     mojo::ReportBadMessage(kInvalidOrigin);
     return;
   }
 
   scoped_refptr<IndexedDBCallbacks> callbacks(
       new IndexedDBCallbacks(this, origin, std::move(callbacks_info)));
   indexed_db_context_->TaskRunner()->PostTask(
       FROM_HERE, base::Bind(&IndexedDBDispatcherHost::DeleteDatabaseOnIDBThread,
-                            this, callbacks, origin, name));
+                            this, base::Passed(&callbacks), origin, name));
 }
 
 void IndexedDBDispatcherHost::GetDatabaseNamesOnIDBThread(
     scoped_refptr<IndexedDBCallbacks> callbacks,
     const url::Origin& origin) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
 
   base::FilePath indexed_db_path = indexed_db_context_->data_path();
   context()->GetIDBFactory()->GetDatabaseNames(
       callbacks, origin, indexed_db_path, request_context_getter_);
@@ skipping 757 matching lines @@
     DLOG(ERROR) << "Unable to reset prefetch";
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
     int32_t ipc_object_id) {
   DCHECK(parent_->context()->TaskRunner()->RunsTasksOnCurrentThread());
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 }  // namespace content