[SessionStorage] Remove unnecessary DomStorageSession class and avoid UAF

Bug: 716490
Change-Id: I94e6faf11937273273d1e3e48b661a5fe6c700b7
Reviewed-on: https://chromium-review.googlesource.com/985232Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Commit-Queue: Daniel Murphy <dmurph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#550364}

content/browser/BUILD.gn

@@ -678,8 +678,6 @@ jumbo_source_set("browser") {
     "dom_storage/dom_storage_message_filter.h",
     "dom_storage/dom_storage_namespace.cc",
     "dom_storage/dom_storage_namespace.h",
-    "dom_storage/dom_storage_session.cc",
-    "dom_storage/dom_storage_session.h",
     "dom_storage/dom_storage_task_runner.cc",
     "dom_storage/dom_storage_task_runner.h",
     "dom_storage/local_storage_context_mojo.cc",

content/browser/dom_storage/dom_storage_context_wrapper.cc

@@ -260,7 +260,8 @@ void DOMStorageContextWrapper::DeleteSessionStorage(
     mojo_task_runner_->PostTask(
         FROM_HERE, base::BindOnce(&SessionStorageContextMojo::DeleteStorage,
                                   base::Unretained(mojo_session_state_),
-                                  usage_info.origin, usage_info.namespace_id));
+                                  url::Origin::Create(usage_info.origin),
+                                  usage_info.namespace_id));
     return;
   }
   DCHECK(context_.get());
@@ -304,6 +305,12 @@ void DOMStorageContextWrapper::SetForceKeepSessionState() {
       FROM_HERE,
       base::BindOnce(&LocalStorageContextMojo::SetForceKeepSessionState,
                      base::Unretained(mojo_state_)));
+  if (mojo_session_state_) {
+    mojo_task_runner_->PostTask(
+        FROM_HERE,
+        base::BindOnce(&SessionStorageContextMojo::SetForceKeepSessionState,
+                       base::Unretained(mojo_session_state_)));
+  }
 }
 
 void DOMStorageContextWrapper::Shutdown() {

content/browser/dom_storage/dom_storage_context_wrapper.h

@@ -86,18 +86,18 @@ class CONTENT_EXPORT DOMStorageContextWrapper
   void SetLocalStorageDatabaseForTesting(
       leveldb::mojom::LevelDBDatabaseAssociatedPtr database);
 
+  SessionStorageContextMojo* mojo_session_state() {
+    return mojo_session_state_;
+  }
+
  private:
   friend class DOMStorageMessageFilter;  // for access to context()
   friend class SessionStorageNamespaceImpl;  // ditto
-  friend class DOMStorageSession;            // ditto
   friend class base::RefCountedThreadSafe<DOMStorageContextWrapper>;
   friend class DOMStorageBrowserTest;
 
   ~DOMStorageContextWrapper() override;
   DOMStorageContextImpl* context() const { return context_.get(); }
-  SessionStorageContextMojo* mojo_session_state() {
-    return mojo_session_state_;
-  }
 
   base::SequencedTaskRunner* mojo_task_runner() {
     return mojo_task_runner_.get();

content/browser/dom_storage/dom_storage_session.cc

-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/dom_storage/dom_storage_session.h"
-
-#include "base/bind.h"
-#include "base/bind_helpers.h"
-#include "base/logging.h"
-#include "base/memory/ptr_util.h"
-#include "base/single_thread_task_runner.h"
-#include "content/browser/dom_storage/dom_storage_context_impl.h"
-#include "content/browser/dom_storage/dom_storage_context_wrapper.h"
-#include "content/browser/dom_storage/dom_storage_task_runner.h"
-#include "content/browser/dom_storage/session_storage_context_mojo.h"
-#include "content/common/dom_storage/dom_storage_namespace_ids.h"
-#include "content/public/common/content_features.h"
-
-namespace content {
-
-// Constructed on thread that constructs DOMStorageSession. Used & destroyed on
-// the mojo task runner that the |mojo_context_| runs on.
-class DOMStorageSession::SequenceHelper {
- public:
-  SequenceHelper(SessionStorageContextMojo* context_wrapper)
-      : context_wrapper_(context_wrapper) {}
-  ~SequenceHelper() = default;
-
-  void CreateSessionNamespace(const std::string& namespace_id) {
-    context_wrapper_->CreateSessionNamespace(namespace_id);
-  }
-
-  void CloneSessionNamespace(const std::string& namespace_id_to_clone,
-                             const std::string& clone_namespace_id) {
-    context_wrapper_->CloneSessionNamespace(namespace_id_to_clone,
-                                            clone_namespace_id);
-  }
-
-  void DeleteSessionNamespace(const std::string& namespace_id,
-                              bool should_persist) {
-    context_wrapper_->DeleteSessionNamespace(namespace_id, should_persist);
-  }
-
- private:
-  SessionStorageContextMojo* context_wrapper_;
-};
-
-// static
-std::unique_ptr<DOMStorageSession> DOMStorageSession::Create(
-    scoped_refptr<DOMStorageContextWrapper> context) {
-  return DOMStorageSession::CreateWithNamespace(
-      std::move(context), AllocateSessionStorageNamespaceId());
-}
-
-// static
-std::unique_ptr<DOMStorageSession> DOMStorageSession::CreateWithNamespace(
-    scoped_refptr<DOMStorageContextWrapper> context,
-    const std::string& namespace_id) {
-  if (context->mojo_session_state()) {
-    DCHECK(base::FeatureList::IsEnabled(features::kMojoSessionStorage));
-    std::unique_ptr<DOMStorageSession> result = base::WrapUnique(
-        new DOMStorageSession(std::move(context), namespace_id));
-    result->mojo_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(&SequenceHelper::CreateSessionNamespace,
-                       base::Unretained(result->sequence_helper_.get()),
-                       result->namespace_id_));
-    return result;
-  }
-  scoped_refptr<DOMStorageContextImpl> context_impl = context->context();
-  context_impl->task_runner()->PostTask(
-      FROM_HERE, base::BindOnce(&DOMStorageContextImpl::CreateSessionNamespace,
-                                context_impl, namespace_id));
-  return std::unique_ptr<DOMStorageSession>(new DOMStorageSession(
-      std::move(context), std::move(context_impl), namespace_id));
-}
-
-// static
-std::unique_ptr<DOMStorageSession> DOMStorageSession::CloneFrom(
-    scoped_refptr<DOMStorageContextWrapper> context,
-    std::string namepace_id,
-    const std::string& namespace_id_to_clone) {
-  if (context->mojo_session_state()) {
-    DCHECK(base::FeatureList::IsEnabled(features::kMojoSessionStorage));
-    std::unique_ptr<DOMStorageSession> result = base::WrapUnique(
-        new DOMStorageSession(std::move(context), std::move(namepace_id)));
-
-    result->mojo_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(&SequenceHelper::CloneSessionNamespace,
-                       base::Unretained(result->sequence_helper_.get()),
-                       namespace_id_to_clone, result->namespace_id_));
-    return result;
-  }
-  scoped_refptr<DOMStorageContextImpl> context_impl = context->context();
-  context_impl->task_runner()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&DOMStorageContextImpl::CloneSessionNamespace,
-                     context_impl, namespace_id_to_clone, namepace_id));
-  return std::unique_ptr<DOMStorageSession>(new DOMStorageSession(
-      std::move(context), std::move(context_impl), std::move(namepace_id)));
-}
-
-void DOMStorageSession::SetShouldPersist(bool should_persist) {
-  should_persist_ = should_persist;
-}
-
-bool DOMStorageSession::should_persist() const {
-  return should_persist_;
-}
-
-bool DOMStorageSession::IsFromContext(DOMStorageContextWrapper* context) {
-  return context_wrapper_.get() == context;
-}
-
-std::unique_ptr<DOMStorageSession> DOMStorageSession::Clone() {
-  return CloneFrom(context_wrapper_, AllocateSessionStorageNamespaceId(),
-                   namespace_id_);
-}
-
-DOMStorageSession::DOMStorageSession(
-    scoped_refptr<DOMStorageContextWrapper> context_wrapper,
-    scoped_refptr<DOMStorageContextImpl> context,
-    std::string namespace_id)
-    : context_(std::move(context)),
-      context_wrapper_(std::move(context_wrapper)),
-      namespace_id_(std::move(namespace_id)),
-      should_persist_(false) {
-  DCHECK(!base::FeatureList::IsEnabled(features::kMojoSessionStorage));
-}
-
-DOMStorageSession::DOMStorageSession(
-    scoped_refptr<DOMStorageContextWrapper> context,
-    std::string namespace_id)
-    : context_wrapper_(std::move(context)),
-      mojo_task_runner_(context_wrapper_->mojo_task_runner()),
-      namespace_id_(std::move(namespace_id)),
-      should_persist_(false),
-      sequence_helper_(std::make_unique<SequenceHelper>(
-          context_wrapper_->mojo_session_state())) {
-  DCHECK(base::FeatureList::IsEnabled(features::kMojoSessionStorage));
-}
-
-DOMStorageSession::~DOMStorageSession() {
-  DCHECK(!!context_ || !!sequence_helper_);
-  if (context_) {
-    context_->task_runner()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&DOMStorageContextImpl::DeleteSessionNamespace, context_,
-                       namespace_id_, should_persist_));
-  }
-  if (sequence_helper_) {
-    mojo_task_runner_->PostTask(
-        FROM_HERE, base::BindOnce(&SequenceHelper::DeleteSessionNamespace,
-                                  base::Unretained(sequence_helper_.get()),
-                                  namespace_id_, should_persist_));
-    mojo_task_runner_->DeleteSoon(FROM_HERE, std::move(sequence_helper_));
-    context_wrapper_->AddRef();
-    if (!mojo_task_runner_->ReleaseSoon(FROM_HERE, context_wrapper_.get()))
-      context_wrapper_->Release();
-  }
-}
-
-}  // namespace content

content/browser/dom_storage/dom_storage_session.h

-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_DOM_STORAGE_DOM_STORAGE_SESSION_H_
-#define CONTENT_BROWSER_DOM_STORAGE_DOM_STORAGE_SESSION_H_
-
-#include <stdint.h>
-
-#include <memory>
-#include <string>
-
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
-
-namespace base {
-class SequencedTaskRunner;
-}
-
-namespace content {
-
-class DOMStorageContextImpl;
-class DOMStorageContextWrapper;
-
-// This class determines the lifetime of a session storage namespace and
-// provides an interface to Clone() an existing session storage namespace. It
-// may be used on any thread. See class comments for DOMStorageContextImpl for a
-// larger overview.
-class CONTENT_EXPORT DOMStorageSession {
- public:
-  // Constructs a |DOMStorageSession| and allocates a new ID for it.
-  static std::unique_ptr<DOMStorageSession> Create(
-      scoped_refptr<DOMStorageContextWrapper> context);
-
-  // Constructs a |DOMStorageSession| and assigns |namespace_id|
-  // to it.
-  static std::unique_ptr<DOMStorageSession> CreateWithNamespace(
-      scoped_refptr<DOMStorageContextWrapper> context,
-      const std::string& namespace_id);
-
-  // Constructs a |DOMStorageSession| with id |namespace_id| by cloning
-  // |namespace_id_to_clone|.
-  static std::unique_ptr<DOMStorageSession> CloneFrom(
-      scoped_refptr<DOMStorageContextWrapper> context,
-      std::string namepace_id,
-      const std::string& namepace_id_to_clone);
-
-  ~DOMStorageSession();
-
-  const std::string& namespace_id() const { return namespace_id_; }
-  void SetShouldPersist(bool should_persist);
-  bool should_persist() const;
-  DOMStorageContextWrapper* context() const { return context_wrapper_.get(); }
-  bool IsFromContext(DOMStorageContextWrapper* context);
-
-  std::unique_ptr<DOMStorageSession> Clone();
-
- private:
-  class SequenceHelper;
-
-  // Creates the non-mojo version.
-  DOMStorageSession(scoped_refptr<DOMStorageContextWrapper> context_wrapper,
-                    scoped_refptr<DOMStorageContextImpl> context_impl,
-                    std::string namespace_id);
-  // Creates a mojo version.
-  DOMStorageSession(scoped_refptr<DOMStorageContextWrapper> context,
-                    std::string namespace_id);
-
-  scoped_refptr<DOMStorageContextImpl> context_;
-  scoped_refptr<DOMStorageContextWrapper> context_wrapper_;
-  scoped_refptr<base::SequencedTaskRunner> mojo_task_runner_;
-  std::string namespace_id_;
-  bool should_persist_;
-
-  // Contructed on constructing thread of DOMStorageSession, used and destroyed
-  // on |mojo_task_runner_|.
-  std::unique_ptr<SequenceHelper> sequence_helper_;
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(DOMStorageSession);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_DOM_STORAGE_DOM_STORAGE_SESSION_H_

content/browser/dom_storage/session_storage_context_mojo.cc

@@ -63,7 +63,7 @@ void SessionStorageContextMojo::GetStorageUsage(
   NOTREACHED();
 }
 void SessionStorageContextMojo::DeleteStorage(
-    const GURL& origin,
+    const url::Origin& origin,
     const std::string& persistent_namespace_id) {
   NOTREACHED();
 }

content/browser/dom_storage/session_storage_context_mojo.h

@@ -54,8 +54,14 @@ class CONTENT_EXPORT SessionStorageContextMojo {
                               bool should_persist);
   void Flush();
 
+  // Used by content settings to alter the behavior around
+  // what data to keep and what data to discard at shutdown.
+  // The policy is not so straight forward to describe, see
+  // the implementation for details.
+  void SetForceKeepSessionState() { force_keep_session_state_ = true; }
+
   void GetStorageUsage(GetStorageUsageCallback callback);
-  void DeleteStorage(const GURL& origin,
+  void DeleteStorage(const url::Origin& origin,
                      const std::string& persistent_namespace_id);
 
   // Called when the owning BrowserContext is ending.
@@ -80,6 +86,8 @@ class CONTENT_EXPORT SessionStorageContextMojo {
   const base::Optional<base::FilePath> partition_directory_path_;
   std::string leveldb_name_;
 
+  bool force_keep_session_state_ = false;
+
   base::WeakPtrFactory<SessionStorageContextMojo> weak_ptr_factory_;
 };
 

content/browser/dom_storage/session_storage_namespace_impl.cc

@@ -6,73 +6,164 @@
 
 #include <utility>
 
+#include "base/bind.h"
+#include "base/callback_helpers.h"
+#include "base/logging.h"
+#include "base/memory/ptr_util.h"
+#include "base/sequenced_task_runner.h"
+#include "content/browser/dom_storage/dom_storage_context_impl.h"
 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
-#include "content/browser/dom_storage/dom_storage_session.h"
+#include "content/browser/dom_storage/dom_storage_task_runner.h"
 #include "content/browser/dom_storage/session_storage_context_mojo.h"
+#include "content/common/dom_storage/dom_storage_namespace_ids.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/common/content_features.h"
 
 namespace content {
 
 // static
 scoped_refptr<SessionStorageNamespaceImpl> SessionStorageNamespaceImpl::Create(
     scoped_refptr<DOMStorageContextWrapper> context) {
-  return base::WrapRefCounted(new SessionStorageNamespaceImpl(
-      DOMStorageSession::Create(std::move(context))));
+  return SessionStorageNamespaceImpl::Create(
+      std::move(context), AllocateSessionStorageNamespaceId());
 }
 
 // static
 scoped_refptr<SessionStorageNamespaceImpl> SessionStorageNamespaceImpl::Create(
     scoped_refptr<DOMStorageContextWrapper> context,
-    const std::string& namepace_id) {
+    std::string namespace_id) {
   scoped_refptr<SessionStorageNamespaceImpl> existing =
-      context->MaybeGetExistingNamespace(namepace_id);
-  if (!existing) {
-    existing = base::WrapRefCounted(
-        new SessionStorageNamespaceImpl(DOMStorageSession::CreateWithNamespace(
-            std::move(context), namepace_id)));
+      context->MaybeGetExistingNamespace(namespace_id);
+  if (existing)
+    return existing;
+  if (context->mojo_session_state()) {
+    DCHECK(base::FeatureList::IsEnabled(features::kMojoSessionStorage));
+    auto result = base::WrapRefCounted(
+        new SessionStorageNamespaceImpl(context, std::move(namespace_id)));
+    result->mojo_task_runner_->PostTask(
+        FROM_HERE,
+        base::BindOnce(&SessionStorageContextMojo::CreateSessionNamespace,
+                       base::Unretained(context->mojo_session_state()),
+                       result->namespace_id_));
+    return result;
   }
-  return existing;
+  scoped_refptr<DOMStorageContextImpl> context_impl = context->context();
+  context_impl->task_runner()->PostTask(
+      FROM_HERE, base::BindOnce(&DOMStorageContextImpl::CreateSessionNamespace,
+                                context_impl, namespace_id));
+  return base::WrapRefCounted(new SessionStorageNamespaceImpl(
+      std::move(context), std::move(context_impl), std::move(namespace_id)));
 }
 
 // static
 scoped_refptr<SessionStorageNamespaceImpl>
 SessionStorageNamespaceImpl::CloneFrom(
     scoped_refptr<DOMStorageContextWrapper> context,
-    std::string namepace_id,
-    const std::string& namepace_id_to_clone) {
-  return base::WrapRefCounted(
-      new SessionStorageNamespaceImpl(DOMStorageSession::CloneFrom(
-          std::move(context), std::move(namepace_id), namepace_id_to_clone)));
+    std::string namespace_id,
+    const std::string& namespace_id_to_clone) {
+  if (context->mojo_session_state()) {
+    DCHECK(base::FeatureList::IsEnabled(features::kMojoSessionStorage));
+    auto result = base::WrapRefCounted(
+        new SessionStorageNamespaceImpl(context, std::move(namespace_id)));
+    result->mojo_task_runner_->PostTask(
+        FROM_HERE,
+        base::BindOnce(&SessionStorageContextMojo::CloneSessionNamespace,
+                       base::Unretained(context->mojo_session_state()),
+                       namespace_id_to_clone, result->namespace_id_));
+    return result;
+  }
+  scoped_refptr<DOMStorageContextImpl> context_impl = context->context();
+  context_impl->task_runner()->PostTask(
+      FROM_HERE,
+      base::BindOnce(&DOMStorageContextImpl::CloneSessionNamespace,
+                     context_impl, namespace_id_to_clone, namespace_id));
+  return base::WrapRefCounted(new SessionStorageNamespaceImpl(
+      std::move(context), std::move(context_impl), std::move(namespace_id)));
 }
 
 const std::string& SessionStorageNamespaceImpl::id() const {
-  return session_->namespace_id();
+  return namespace_id_;
 }
 
 void SessionStorageNamespaceImpl::SetShouldPersist(bool should_persist) {
-  session_->SetShouldPersist(should_persist);
+  should_persist_ = should_persist;
 }
 
 bool SessionStorageNamespaceImpl::should_persist() const {
-  return session_->should_persist();
+  return should_persist_;
 }
 
-SessionStorageNamespaceImpl* SessionStorageNamespaceImpl::Clone() {
-  return new SessionStorageNamespaceImpl(session_->Clone());
+scoped_refptr<SessionStorageNamespaceImpl>
+SessionStorageNamespaceImpl::Clone() {
+  return CloneFrom(context_wrapper_, AllocateSessionStorageNamespaceId(),
+                   namespace_id_);
 }
 
 bool SessionStorageNamespaceImpl::IsFromContext(
     DOMStorageContextWrapper* context) {
-  return session_->IsFromContext(context);
+  return context_wrapper_.get() == context;
 }
 
 SessionStorageNamespaceImpl::SessionStorageNamespaceImpl(
-    std::unique_ptr<DOMStorageSession> session)
-    : session_(std::move(session)) {
-  session_->context()->AddNamespace(session_->namespace_id(), this);
+    scoped_refptr<DOMStorageContextWrapper> context_wrapper,
+    scoped_refptr<DOMStorageContextImpl> context,
+    std::string namespace_id)
+    : context_(std::move(context)),
+      context_wrapper_(std::move(context_wrapper)),
+      namespace_id_(std::move(namespace_id)),
+      should_persist_(false) {
+  context_wrapper_->AddNamespace(namespace_id_, this);
+  DCHECK(!base::FeatureList::IsEnabled(features::kMojoSessionStorage));
+}
+
+SessionStorageNamespaceImpl::SessionStorageNamespaceImpl(
+    scoped_refptr<DOMStorageContextWrapper> context,
+    std::string namespace_id)
+    : context_wrapper_(std::move(context)),
+      mojo_task_runner_(context_wrapper_->mojo_task_runner()),
+      namespace_id_(std::move(namespace_id)),
+      should_persist_(false) {
+  context_wrapper_->AddNamespace(namespace_id_, this);
+  DCHECK(base::FeatureList::IsEnabled(features::kMojoSessionStorage));
 }
 
 SessionStorageNamespaceImpl::~SessionStorageNamespaceImpl() {
-  session_->context()->RemoveNamespace(session_->namespace_id());
+  DCHECK(context_ || mojo_task_runner_);
+  context_wrapper_->RemoveNamespace(namespace_id_);
+  if (context_) {
+    context_->task_runner()->PostTask(
+        FROM_HERE,
+        base::BindOnce(&DOMStorageContextImpl::DeleteSessionNamespace, context_,
+                       namespace_id_, should_persist_));
+  }
+  if (IsMojoSessionStorage()) {
+    base::ScopedClosureRunner deleteNamespaceRunner =
+        base::ScopedClosureRunner(base::BindOnce(
+            &SessionStorageNamespaceImpl::DeleteSessionNamespaceFromUIThread,
+            std::move(mojo_task_runner_), std::move(context_wrapper_),
+            std::move(namespace_id_), should_persist_));
+    if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
+      // If this fails to post then that's fine, as the mojo state should
+      // already be destructed.
+      BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
+                              deleteNamespaceRunner.Release());
+    }
+  }
+}
+
+// static
+void SessionStorageNamespaceImpl::DeleteSessionNamespaceFromUIThread(
+    scoped_refptr<base::SequencedTaskRunner> mojo_task_runner,
+    scoped_refptr<DOMStorageContextWrapper> context_wrapper,
+    std::string namespace_id,
+    bool should_persist) {
+  if (context_wrapper->mojo_session_state()) {
+    mojo_task_runner->PostTask(
+        FROM_HERE,
+        base::BindOnce(&SessionStorageContextMojo::DeleteSessionNamespace,
+                       base::Unretained(context_wrapper->mojo_session_state()),
+                       namespace_id, should_persist));
+  }
 }
 
 }  // namespace content

content/browser/dom_storage/session_storage_namespace_impl.h

@@ -7,15 +7,21 @@
 
 #include <stdint.h>
 
+#include <memory>
+#include <string>
+
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/session_storage_namespace.h"
 
-namespace content {
+namespace base {
+class SequencedTaskRunner;
+}
 
+namespace content {
+class DOMStorageContextImpl;
 class DOMStorageContextWrapper;
-class DOMStorageSession;
 
 class SessionStorageNamespaceImpl : public SessionStorageNamespace {
  public:
@@ -27,32 +33,53 @@ class SessionStorageNamespaceImpl : public SessionStorageNamespace {
 
   // If there is an existing SessionStorageNamespaceImpl with the given id in
   // the DOMStorageContextWrapper, this will return that object. Otherwise this
-  // constructs a SessionStorageNamespaceImpl and assigns |namepace_id| to it.
+  // constructs a SessionStorageNamespaceImpl and assigns |namespace_id| to it.
   static scoped_refptr<SessionStorageNamespaceImpl> Create(
       scoped_refptr<DOMStorageContextWrapper> context,
-      const std::string& namepace_id);
+      std::string namespace_id);
 
   // Constructs a |SessionStorageNamespaceImpl| with id |namespace_id| by
-  // cloning |namespace_to_clone|.
+  // cloning |namespace_to_clone|. Allocates it a new ID.
   static scoped_refptr<SessionStorageNamespaceImpl> CloneFrom(
       scoped_refptr<DOMStorageContextWrapper> context,
-      std::string namepace_id,
-      const std::string& namepace_id_to_clone);
+      std::string namespace_id,
+      const std::string& namespace_id_to_clone);
+
+  DOMStorageContextWrapper* context() const { return context_wrapper_.get(); }
 
   // SessionStorageNamespace implementation.
   const std::string& id() const override;
   void SetShouldPersist(bool should_persist) override;
   bool should_persist() const override;
 
-  SessionStorageNamespaceImpl* Clone();
+  bool IsMojoSessionStorage() { return context_.get(); }
+
+  scoped_refptr<SessionStorageNamespaceImpl> Clone();
   bool IsFromContext(DOMStorageContextWrapper* context);
 
  private:
-  explicit SessionStorageNamespaceImpl(
-      std::unique_ptr<DOMStorageSession> session);
+  // Creates the non-mojo version.
+  SessionStorageNamespaceImpl(
+      scoped_refptr<DOMStorageContextWrapper> context_wrapper,
+      scoped_refptr<DOMStorageContextImpl> context_impl,
+      std::string namespace_id);
+  // Creates a mojo version.
+  SessionStorageNamespaceImpl(scoped_refptr<DOMStorageContextWrapper> context,
+                              std::string namespace_id);
+
   ~SessionStorageNamespaceImpl() override;
 
-  std::unique_ptr<DOMStorageSession> session_;
+  static void DeleteSessionNamespaceFromUIThread(
+      scoped_refptr<base::SequencedTaskRunner> mojo_task_runner,
+      scoped_refptr<DOMStorageContextWrapper> context_wrapper,
+      std::string namespace_id,
+      bool should_persist);
+
+  scoped_refptr<DOMStorageContextImpl> context_;
+  scoped_refptr<DOMStorageContextWrapper> context_wrapper_;
+  scoped_refptr<base::SequencedTaskRunner> mojo_task_runner_;
+  std::string namespace_id_;
+  bool should_persist_;
 
   DISALLOW_COPY_AND_ASSIGN(SessionStorageNamespaceImpl);
 };