[SessionStorage] Fixing race condition on namespace destruction

Bug: 822723
Change-Id: Ifdfe9ac1a72c39fd9a65a82da25f27b1ec246b9c
Reviewed-on: https://chromium-review.googlesource.com/966865Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
Commit-Queue: Daniel Murphy <dmurph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#543776}

content/browser/dom_storage/dom_storage_context_wrapper.cc

@@ -396,6 +396,7 @@ void DOMStorageContextWrapper::SetLocalStorageDatabaseForTesting(
 scoped_refptr<SessionStorageNamespaceImpl>
 DOMStorageContextWrapper::MaybeGetExistingNamespace(
     const std::string& namespace_id) const {
+  base::AutoLock lock(alive_namespaces_lock_);
   auto it = alive_namespaces_.find(namespace_id);
   return (it != alive_namespaces_.end()) ? it->second : nullptr;
 }
@@ -403,12 +404,14 @@ DOMStorageContextWrapper::MaybeGetExistingNamespace(
 void DOMStorageContextWrapper::AddNamespace(
     const std::string& namespace_id,
     SessionStorageNamespaceImpl* session_namespace) {
+  base::AutoLock lock(alive_namespaces_lock_);
   DCHECK(alive_namespaces_.find(namespace_id) == alive_namespaces_.end());
   alive_namespaces_[namespace_id] = session_namespace;
 }
 
 void DOMStorageContextWrapper::RemoveNamespace(
     const std::string& namespace_id) {
+  base::AutoLock lock(alive_namespaces_lock_);
   DCHECK(alive_namespaces_.find(namespace_id) != alive_namespaces_.end());
   alive_namespaces_.erase(namespace_id);
 }

content/browser/dom_storage/dom_storage_context_wrapper.h

@@ -13,6 +13,7 @@
 #include "base/memory/memory_pressure_listener.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
+#include "base/synchronization/lock.h"
 #include "content/browser/dom_storage/dom_storage_context_impl.h"
 #include "content/common/content_export.h"
 #include "content/common/storage_partition_service.mojom.h"
@@ -105,9 +106,11 @@ class CONTENT_EXPORT DOMStorageContextWrapper
   scoped_refptr<SessionStorageNamespaceImpl> MaybeGetExistingNamespace(
       const std::string& namespace_id) const;
 
+  // Note: can be called on multiple threads, protected by a mutex.
   void AddNamespace(const std::string& namespace_id,
                     SessionStorageNamespaceImpl* session_namespace);
 
+  // Note: can be called on multiple threads, protected by a mutex.
   void RemoveNamespace(const std::string& namespace_id);
 
   // Called on UI thread when the system is under memory pressure.
@@ -137,6 +140,7 @@ class CONTENT_EXPORT DOMStorageContextWrapper
   // the SessionStorageNamespaceImpl objects that are still alive thanks to the
   // sessions component.
   std::map<std::string, SessionStorageNamespaceImpl*> alive_namespaces_;
+  mutable base::Lock alive_namespaces_lock_;
 
   base::FilePath legacy_localstorage_path_;