[Sync] Fix thread-ordering-dependent NULL dereference in NewNonFrontendDTC

chrome/browser/sync/glue/shared_change_processor.h

-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_SYNC_GLUE_SHARED_CHANGE_PROCESSOR_H_
 #define CHROME_BROWSER_SYNC_GLUE_SHARED_CHANGE_PROCESSOR_H_
 #pragma once
 
 #include "base/location.h"
 #include "base/memory/ref_counted.h"
-#include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
+#include "base/message_loop_proxy.h"
 #include "base/synchronization/lock.h"
-#include "base/threading/thread_checker.h"
 #include "chrome/browser/sync/api/sync_change_processor.h"
 #include "chrome/browser/sync/api/sync_error.h"
 #include "chrome/browser/sync/engine/model_safe_worker.h"
 
 class ProfileSyncComponentsFactory;
 class ProfileSyncService;
 class SyncData;
 class SyncableService;
 
 typedef std::vector<SyncData> SyncDataList;
@@ skipping 14 matching lines @@
 // The only thread-safe method is Disconnect, which will disconnect from the
 // generic change processor, letting us shut down the syncer/datatype without
 // waiting for non-UI threads.
 //
 // Note: since we control the work being done while holding the lock, we ensure
 // no I/O or other intensive work is done while blocking the UI thread (all
 // the work is in-memory sync interactions).
 //
 // We use virtual methods so that we can use mock's in testing.
 class SharedChangeProcessor
-    : public base::RefCountedThreadSafe<SharedChangeProcessor>,
-      public base::ThreadChecker {
+    : public base::RefCountedThreadSafe<SharedChangeProcessor> {
  public:
   // Create an uninitialized SharedChangeProcessor (to be later connected).
   SharedChangeProcessor();
 
   // Connect to the Syncer. Will create and hold a new GenericChangeProcessor.
   // Returns: true if successful, false if disconnected or |local_service| was
   // NULL.
   virtual bool Connect(
     ProfileSyncComponentsFactory* sync_factory,
     ProfileSyncService* sync_service,
@@ skipping 35 matching lines @@
 
  private:
   // Monitor lock for this object. All methods that interact with the change
   // processor must aquire this lock and check whether we're disconnected or
   // not. Once disconnected, all attempted changes to or loads from the change
   // processor return errors. This enables us to shut down the syncer without
   // having to wait for possibly non-UI thread datatypes to complete work.
   mutable base::Lock monitor_lock_;
   bool disconnected_;
 
-  scoped_ptr<GenericChangeProcessor> generic_change_processor_;
+  // The loop that all methods except the constructor, destructor, and
+  // Disconnect() should be called on.  Set in Connect().
+  scoped_refptr<base::MessageLoopProxy> backend_loop_;
+
+  // Used only on |backend_loop_|.
+  GenericChangeProcessor* generic_change_processor_;
 
   DISALLOW_COPY_AND_ASSIGN(SharedChangeProcessor);
 };
 
 }  // namespace browser_sync
 
 #endif  // CHROME_BROWSER_SYNC_GLUE_SHARED_CHANGE_PROCESSOR_H_