Fix threading issue in SQLiteCursor.

CancelableRequestConsumer and CancelableTaskTracker should live on a single
thread.

BUG=165769


Review URL: https://chromiumcodereview.appspot.com/11553035

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@172774 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 17 insertions, 12 deletions

diff --git a/chrome/browser/history/android/sqlite_cursor.cc b/chrome/browser/history/android/sqlite_cursor.cc
index 2a89fc6..691ed95 100644
--- a/chrome/browser/history/android/sqlite_cursor.cc
+++ b/chrome/browser/history/android/sqlite_cursor.cc
@@ -212,8 +212,7 @@ bool SQLiteCursor::GetFavicon(history::FaviconID id,
         base::Bind(&SQLiteCursor::GetFaviconForIDInUIThread,
                    base::Unretained(this), id,
                    base::Bind(&SQLiteCursor::OnFaviconData,
-                              base::Unretained(this)),
-                   &tracker_));
+                              base::Unretained(this))));
 
     if (test_observer_)
       test_observer_->OnPostGetFaviconTask();
@@ -234,10 +233,11 @@ bool SQLiteCursor::GetFavicon(history::FaviconID id,
 
 void SQLiteCursor::GetFaviconForIDInUIThread(
     history::FaviconID id,
-    const FaviconService::FaviconRawCallback& callback,
-    CancelableTaskTracker* tracker) {
+    const FaviconService::FaviconRawCallback& callback) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  favicon_service_->GetLargestRawFaviconForID(id, callback, tracker);
+  if (!tracker_.get())
+    tracker_.reset(new CancelableTaskTracker());
+  favicon_service_->GetLargestRawFaviconForID(id, callback, tracker_.get());
 }
 
 
@@ -260,8 +260,11 @@ void SQLiteCursor::OnMoved(AndroidHistoryProviderService::Handle handle,
 
 void SQLiteCursor::CancelAllRequests(base::WaitableEvent* finished) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  consumer_.CancelAllRequests();
-  tracker_.TryCancelAll();
+
+  // Destruction will cancel all pending tasks.
+  consumer_.reset();
+  tracker_.reset();
+
   if (finished)
     finished->Signal();
 }
@@ -275,7 +278,9 @@ SQLiteCursor::JavaColumnType SQLiteCursor::GetColumnTypeInternal(int column) {
 
 void SQLiteCursor::RunMoveStatementOnUIThread(int pos) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  if (!consumer_.get())
+    consumer_.reset(new CancelableRequestConsumer());
   service_->MoveStatement(
-      statement_, position_, pos, &consumer_,
+      statement_, position_, pos, consumer_.get(),
       base::Bind(&SQLiteCursor::OnMoved, base::Unretained(this)));
 }
diff --git a/chrome/browser/history/android/sqlite_cursor.h b/chrome/browser/history/android/sqlite_cursor.h
index 3a5fc3a..b8cb140 100644
--- a/chrome/browser/history/android/sqlite_cursor.h
+++ b/chrome/browser/history/android/sqlite_cursor.h
@@ -147,8 +147,7 @@ class SQLiteCursor {
 
   void GetFaviconForIDInUIThread(
       history::FaviconID id,
-      const FaviconService::FaviconRawCallback& callback,
-      CancelableTaskTracker* tracker);
+      const FaviconService::FaviconRawCallback& callback);
 
   // The callback function of FaviconService::GetLargestRawFaviconForID().
   void OnFaviconData(const history::FaviconBitmapResult& bitmap_result);
@@ -180,8 +179,9 @@ class SQLiteCursor {
 
   FaviconService* favicon_service_;
 
-  CancelableRequestConsumer consumer_;
-  CancelableTaskTracker tracker_;
+  // Live on UI thread.
+  scoped_ptr<CancelableRequestConsumer> consumer_;
+  scoped_ptr<CancelableTaskTracker> tracker_;
 
   // The count of result rows.
   int count_;