Fix bug in BlobRegistryWrapper creation.

Since RefCounted starts out with a zero ref-count, it is not safe to
create scoped_refptrs (such as the one in base::BindOnce) in the
constructor (could result in this case in the IO thread deref-ing and
destroying the BlobRegistryWrapper before the UI thread got around to
increasing the refcount). This fixes that by not posting the task until
after the constructor has completed.

Bug: 611935
Change-Id: I3c716e23dd1b89692d61fef12e37eb3f9a8be6d5
Reviewed-on: https://chromium-review.googlesource.com/567383Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Commit-Queue: Marijn Kruisselbrink <mek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#485789}

content/browser/blob_storage/blob_registry_wrapper.cc

@@ -36,16 +36,21 @@ class BindingDelegate : public storage::BlobRegistryImpl::Delegate {
 
 }  // namespace
 
-BlobRegistryWrapper::BlobRegistryWrapper(
+// static
+scoped_refptr<BlobRegistryWrapper> BlobRegistryWrapper::Create(
     scoped_refptr<ChromeBlobStorageContext> blob_storage_context,
     scoped_refptr<storage::FileSystemContext> file_system_context) {
-  DCHECK(base::FeatureList::IsEnabled(features::kMojoBlobs));
-
+  scoped_refptr<BlobRegistryWrapper> result(new BlobRegistryWrapper());
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
-      base::BindOnce(&BlobRegistryWrapper::InitializeOnIOThread, this,
+      base::BindOnce(&BlobRegistryWrapper::InitializeOnIOThread, result,
                      std::move(blob_storage_context),
                      std::move(file_system_context)));
+  return result;
+}
+
+BlobRegistryWrapper::BlobRegistryWrapper() {
+  DCHECK(base::FeatureList::IsEnabled(features::kMojoBlobs));
 }
 
 void BlobRegistryWrapper::Bind(

content/browser/blob_storage/blob_registry_wrapper.h

@@ -28,7 +28,7 @@ class BlobRegistryWrapper
     : public base::RefCountedThreadSafe<BlobRegistryWrapper,
                                         BrowserThread::DeleteOnIOThread> {
  public:
-  BlobRegistryWrapper(
+  static scoped_refptr<BlobRegistryWrapper> Create(
       scoped_refptr<ChromeBlobStorageContext> blob_storage_context,
       scoped_refptr<storage::FileSystemContext> file_system_context);
 
@@ -37,6 +37,7 @@ class BlobRegistryWrapper
             storage::mojom::BlobRegistryRequest request);
 
  private:
+  BlobRegistryWrapper();
   friend struct BrowserThread::DeleteOnThread<BrowserThread::IO>;
   friend class base::DeleteHelper<BlobRegistryWrapper>;
   ~BlobRegistryWrapper();

content/browser/storage_partition_impl.cc

@@ -561,7 +561,7 @@ std::unique_ptr<StoragePartitionImpl> StoragePartitionImpl::Create(
       blob_context.get(), partition->url_loader_factory_getter_.get());
 
   if (base::FeatureList::IsEnabled(features::kMojoBlobs)) {
-    partition->blob_registry_ = base::MakeRefCounted<BlobRegistryWrapper>(
+    partition->blob_registry_ = BlobRegistryWrapper::Create(
         blob_context, partition->filesystem_context_);
   }