Revert "Post loading tasks on the appropriate WebFrameScheduler's queue."

and "Fix a UAF in the BackgroundHtmlParser's constructor"

This reverts commit https://crrev.com/f3080498facd16066076e7d459ba7cfda11e582c and https://crrev.com/76d7303845116b1c08bd327c46c99e264b626ada.
(CLs: https://codereview.chromium.org/1366883002 and https://codereview.chromium.org/1391013004.)

Reason: Seems to have broken lots of browser_tests on WinXP.

TBR=jochen@chromium.org

BUG=510398, 538660

Review URL: https://codereview.chromium.org/1402933002

Cr-Commit-Position: refs/heads/master@{#353983}

11 files changed, 33 insertions, 168 deletions

diff --git a/content/child/blink_platform_impl.cc b/content/child/blink_platform_impl.cc
index 3b26b61..c8f4168 100644
--- a/content/child/blink_platform_impl.cc
+++ b/content/child/blink_platform_impl.cc
@@ -34,7 +34,6 @@
 #include "blink/public/resources/grit/blink_image_resources.h"
 #include "blink/public/resources/grit/blink_resources.h"
 #include "components/mime_util/mime_util.h"
-#include "components/scheduler/child/web_task_runner_impl.h"
 #include "components/scheduler/child/webthread_impl_for_worker_scheduler.h"
 #include "content/app/resources/grit/content_resources.h"
 #include "content/app/strings/grit/content_strings.h"
@@ -479,8 +478,7 @@ WebURLLoader* BlinkPlatformImpl::createURLLoader() {
   // data URLs to bypass the ResourceDispatcher.
   return new WebURLLoaderImpl(
       child_thread ? child_thread->resource_dispatcher() : NULL,
-      make_scoped_ptr(new scheduler::WebTaskRunnerImpl(
-            base::ThreadTaskRunnerHandle::Get())));
+      MainTaskRunnerForCurrentThread());
 }
 
 blink::WebSocketHandle* BlinkPlatformImpl::createWebSocketHandle() {
@@ -1365,6 +1363,16 @@ uint32_t BlinkPlatformImpl::getUniqueIdForProcess() {
   return base::trace_event::TraceLog::GetInstance()->process_id();
 }
 
+scoped_refptr<base::SingleThreadTaskRunner>
+BlinkPlatformImpl::MainTaskRunnerForCurrentThread() {
+  if (main_thread_task_runner_.get() &&
+      main_thread_task_runner_->BelongsToCurrentThread()) {
+    return main_thread_task_runner_;
+  } else {
+    return base::ThreadTaskRunnerHandle::Get();
+  }
+}
+
 bool BlinkPlatformImpl::IsMainThread() const {
   return main_thread_task_runner_.get() &&
          main_thread_task_runner_->BelongsToCurrentThread();
diff --git a/content/child/blink_platform_impl.h b/content/child/blink_platform_impl.h
index f9bf754..4ec1659 100644
--- a/content/child/blink_platform_impl.h
+++ b/content/child/blink_platform_impl.h
@@ -195,6 +195,8 @@ class CONTENT_EXPORT BlinkPlatformImpl
 
   bool IsMainThread() const;
 
+  scoped_refptr<base::SingleThreadTaskRunner> MainTaskRunnerForCurrentThread();
+
   scoped_refptr<base::SingleThreadTaskRunner> main_thread_task_runner_;
   WebThemeEngineImpl native_theme_engine_;
   WebFallbackThemeEngineImpl fallback_theme_engine_;
diff --git a/content/child/request_info.cc b/content/child/request_info.cc
index 2af34cd..b115b7d 100644
--- a/content/child/request_info.cc
+++ b/content/child/request_info.cc
@@ -27,8 +27,7 @@ RequestInfo::RequestInfo()
       enable_upload_progress(false),
       do_not_prompt_for_login(false),
       report_raw_headers(false),
-      extra_data(NULL),
-      loading_web_task_runner(nullptr) {}
+      extra_data(NULL) {}
 
 RequestInfo::~RequestInfo() {}
 
diff --git a/content/child/request_info.h b/content/child/request_info.h
index 037c1db..e610ac8 100644
--- a/content/child/request_info.h
+++ b/content/child/request_info.h
@@ -17,14 +17,9 @@
 #include "content/public/common/resource_type.h"
 #include "net/base/request_priority.h"
 #include "third_party/WebKit/public/platform/WebReferrerPolicy.h"
-#include "third_party/WebKit/public/platform/WebTaskRunner.h"
 #include "third_party/WebKit/public/platform/WebURLRequest.h"
 #include "url/gurl.h"
 
-namespace blink {
-class WebTaskRunner;
-} // namespace blink
-
 namespace content {
 
 // Structure used when calling BlinkPlatformImpl::CreateResourceLoader().
@@ -115,9 +110,6 @@ struct CONTENT_EXPORT RequestInfo {
   // Extra data associated with this request.  We do not own this pointer.
   blink::WebURLRequest::ExtraData* extra_data;
 
-  // Optional, the specific task queue to execute loading tasks on.
-  scoped_ptr<blink::WebTaskRunner> loading_web_task_runner;
-
  private:
   DISALLOW_COPY_AND_ASSIGN(RequestInfo);
 };
diff --git a/content/child/resource_dispatcher.cc b/content/child/resource_dispatcher.cc
index 0c99072..684f3ee 100644
--- a/content/child/resource_dispatcher.cc
+++ b/content/child/resource_dispatcher.cc
@@ -18,7 +18,6 @@
 #include "base/strings/string_util.h"
 #include "content/child/request_extra_data.h"
 #include "content/child/request_info.h"
-#include "content/child/resource_scheduling_filter.h"
 #include "content/child/shared_memory_received_data_factory.h"
 #include "content/child/site_isolation_stats_gatherer.h"
 #include "content/child/sync_load_response.h"
@@ -415,9 +414,6 @@ bool ResourceDispatcher::RemovePendingRequest(int request_id) {
         new ResourceHostMsg_ReleaseDownloadedFile(request_id));
   }
 
-  if (resource_scheduling_filter_.get())
-    resource_scheduling_filter_->ClearRequestIdTaskRunner(request_id);
-
   return true;
 }
 
@@ -603,13 +599,6 @@ int ResourceDispatcher::StartAsync(const RequestInfo& request_info,
                          request->url,
                          request_info.download_to_file);
 
-  if (resource_scheduling_filter_.get() &&
-      request_info.loading_web_task_runner) {
-    resource_scheduling_filter_->SetRequestIdTaskRunner(
-        request_id,
-        make_scoped_ptr(request_info.loading_web_task_runner->clone()));
-  }
-
   message_sender_->Send(new ResourceHostMsg_RequestResource(
       request_info.routing_id, request_id, *request));
 
@@ -816,9 +805,4 @@ scoped_ptr<ResourceHostMsg_Request> ResourceDispatcher::CreateRequest(
   return request.Pass();
 }
 
-void ResourceDispatcher::SetResourceSchedulingFilter(
-    scoped_refptr<ResourceSchedulingFilter> resource_scheduling_filter) {
-  resource_scheduling_filter_ = resource_scheduling_filter;
-}
-
 }  // namespace content
diff --git a/content/child/resource_dispatcher.h b/content/child/resource_dispatcher.h
index 05500f5..864b081 100644
--- a/content/child/resource_dispatcher.h
+++ b/content/child/resource_dispatcher.h
@@ -39,7 +39,6 @@ namespace content {
 class RequestPeer;
 class ResourceDispatcherDelegate;
 class ResourceRequestBody;
-class ResourceSchedulingFilter;
 class ThreadedDataProvider;
 struct ResourceResponseInfo;
 struct RequestInfo;
@@ -130,9 +129,6 @@ class CONTENT_EXPORT ResourceDispatcher : public IPC::Listener {
     main_thread_task_runner_ = main_thread_task_runner;
   }
 
-  void SetResourceSchedulingFilter(
-      scoped_refptr<ResourceSchedulingFilter> resource_scheduling_filter);
-
  private:
   friend class ResourceDispatcherTest;
 
@@ -253,7 +249,6 @@ class CONTENT_EXPORT ResourceDispatcher : public IPC::Listener {
   base::TimeTicks io_timestamp_;
 
   scoped_refptr<base::SingleThreadTaskRunner> main_thread_task_runner_;
-  scoped_refptr<ResourceSchedulingFilter> resource_scheduling_filter_;
 
   base::WeakPtrFactory<ResourceDispatcher> weak_factory_;
 
diff --git a/content/child/resource_scheduling_filter.cc b/content/child/resource_scheduling_filter.cc
index 6445c00..843cd87 100644
--- a/content/child/resource_scheduling_filter.cc
+++ b/content/child/resource_scheduling_filter.cc
@@ -9,32 +9,9 @@
 #include "content/child/resource_dispatcher.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_message_start.h"
-#include "third_party/WebKit/public/platform/WebTaskRunner.h"
-#include "third_party/WebKit/public/platform/WebTraceLocation.h"
 
 namespace content {
 
-namespace {
-class DispatchMessageTask : public blink::WebTaskRunner::Task {
- public:
-  DispatchMessageTask(
-      base::WeakPtr<ResourceSchedulingFilter> resource_scheduling_filter,
-      const IPC::Message& message)
-    : resource_scheduling_filter_(resource_scheduling_filter),
-      message_(message) {}
-
-  void run() override {
-    if (!resource_scheduling_filter_.get())
-      return;
-    resource_scheduling_filter_->DispatchMessage(message_);
-  }
-
- private:
-  base::WeakPtr<ResourceSchedulingFilter> resource_scheduling_filter_;
-  const IPC::Message message_;
-};
-} // namespace
-
 ResourceSchedulingFilter::ResourceSchedulingFilter(
     const scoped_refptr<base::SingleThreadTaskRunner>& main_thread_task_runner,
     ResourceDispatcher* resource_dispatcher)
@@ -49,42 +26,12 @@ ResourceSchedulingFilter::~ResourceSchedulingFilter() {
 }
 
 bool ResourceSchedulingFilter::OnMessageReceived(const IPC::Message& message) {
-  base::AutoLock lock(request_id_to_task_runner_map_lock_);
-  int request_id;
-
-  base::PickleIterator pickle_iterator(message);
-  if (!pickle_iterator.ReadInt(&request_id)) {
-    NOTREACHED() << "malformed resource message";
-    return true;
-  }
-  // Dispatch the message on the request id specific task runner, if there is
-  // one, or on the general main_thread_task_runner if there isn't.
-  RequestIdToTaskRunnerMap::const_iterator iter =
-      request_id_to_task_runner_map_.find(request_id);
-  if (iter != request_id_to_task_runner_map_.end()) {
-    // TODO(alexclarke): Find a way to let blink and chromium FROM_HERE coexist.
-    iter->second->postTask(
-        blink::WebTraceLocation(__FUNCTION__, __FILE__),
-        new DispatchMessageTask(weak_ptr_factory_.GetWeakPtr(), message));
-  } else {
-    main_thread_task_runner_->PostTask(
-        FROM_HERE, base::Bind(&ResourceSchedulingFilter::DispatchMessage,
-                              weak_ptr_factory_.GetWeakPtr(), message));
-  }
+  main_thread_task_runner_->PostTask(
+      FROM_HERE, base::Bind(&ResourceSchedulingFilter::DispatchMessage,
+                            weak_ptr_factory_.GetWeakPtr(), message));
   return true;
 }
 
-void ResourceSchedulingFilter::SetRequestIdTaskRunner(
-    int id, scoped_ptr<blink::WebTaskRunner> web_task_runner) {
-  base::AutoLock lock(request_id_to_task_runner_map_lock_);
-  request_id_to_task_runner_map_.insert(id, web_task_runner.Pass());
-}
-
-void ResourceSchedulingFilter::ClearRequestIdTaskRunner(int id) {
-  base::AutoLock lock(request_id_to_task_runner_map_lock_);
-  request_id_to_task_runner_map_.erase(id);
-}
-
 bool ResourceSchedulingFilter::GetSupportedMessageClasses(
     std::vector<uint32>* supported_message_classes) const {
   supported_message_classes->push_back(ResourceMsgStart);
diff --git a/content/child/resource_scheduling_filter.h b/content/child/resource_scheduling_filter.h
index fd24559..7ea73c9 100644
--- a/content/child/resource_scheduling_filter.h
+++ b/content/child/resource_scheduling_filter.h
@@ -5,19 +5,12 @@
 #ifndef CONTENT_CHILD_RESOURCE_SCHEDULING_FILTER_H_
 #define CONTENT_CHILD_RESOURCE_SCHEDULING_FILTER_H_
 
-#include <map>
-
 #include "base/containers/hash_tables.h"
-#include "base/containers/scoped_ptr_map.h"
 #include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
 #include "content/common/content_export.h"
 #include "ipc/message_filter.h"
 
-namespace blink {
-class WebTaskRunner;
-}
-
 namespace content {
 class ResourceDispatcher;
 
@@ -35,24 +28,10 @@ class CONTENT_EXPORT ResourceSchedulingFilter : public IPC::MessageFilter {
   bool GetSupportedMessageClasses(
       std::vector<uint32>* supported_message_classes) const override;
 
-  // Sets the task runner associated with request messages with |id|.
-  void SetRequestIdTaskRunner(
-      int id, scoped_ptr<blink::WebTaskRunner> web_task_runner);
-
-  // Removes the task runner associated with |id|.
-  void ClearRequestIdTaskRunner(int id);
-
-  void DispatchMessage(const IPC::Message& message);
-
- private:
+ protected:
   ~ResourceSchedulingFilter() override;
 
-  typedef base::ScopedPtrMap<int, scoped_ptr<blink::WebTaskRunner>>
-      RequestIdToTaskRunnerMap;
-
-  // This lock guards |request_id_to_task_runner_map_|
-  base::Lock request_id_to_task_runner_map_lock_;
-  RequestIdToTaskRunnerMap request_id_to_task_runner_map_;
+  void DispatchMessage(const IPC::Message& message);
 
   scoped_refptr<base::SingleThreadTaskRunner> main_thread_task_runner_;
   ResourceDispatcher* resource_dispatcher_;  // NOT OWNED
diff --git a/content/child/web_url_loader_impl.cc b/content/child/web_url_loader_impl.cc
index 68851d4..bf669cc 100644
--- a/content/child/web_url_loader_impl.cc
+++ b/content/child/web_url_loader_impl.cc
@@ -16,7 +16,6 @@
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
 #include "components/mime_util/mime_util.h"
-#include "components/scheduler/child/web_task_runner_impl.h"
 #include "content/child/child_thread_impl.h"
 #include "content/child/ftp_directory_listing_response_delegate.h"
 #include "content/child/multipart_response_delegate.h"
@@ -43,7 +42,6 @@
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "net/url_request/url_request_data_job.h"
 #include "third_party/WebKit/public/platform/WebHTTPLoadInfo.h"
-#include "third_party/WebKit/public/platform/WebTraceLocation.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 #include "third_party/WebKit/public/platform/WebURLError.h"
 #include "third_party/WebKit/public/platform/WebURLLoadTiming.h"
@@ -256,7 +254,7 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context>,
  public:
   Context(WebURLLoaderImpl* loader,
           ResourceDispatcher* resource_dispatcher,
-          scoped_ptr<blink::WebTaskRunner> task_runner);
+          scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 
   WebURLLoaderClient* client() const { return client_; }
   void set_client(WebURLLoaderClient* client) { client_ = client; }
@@ -269,7 +267,6 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context>,
       blink::WebThreadedDataReceiver* threaded_data_receiver);
   void Start(const WebURLRequest& request,
              SyncLoadResponse* sync_load_response);
-  void SetWebTaskRunner(scoped_ptr<blink::WebTaskRunner> task_runner);
 
   // RequestPeer methods:
   void OnUploadProgress(uint64 position, uint64 size) override;
@@ -298,19 +295,6 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context>,
   friend class base::RefCounted<Context>;
   ~Context() override;
 
-  class HandleDataURLTask : public blink::WebTaskRunner::Task {
-   public:
-    explicit HandleDataURLTask(scoped_refptr<Context> context)
-        : context_(context) {}
-
-    void run() override {
-      context_->HandleDataURL();
-    }
-
-   private:
-    scoped_refptr<Context> context_;
-  };
-
   // Called when the body data stream is detached from the reader side.
   void CancelBodyStreaming();
   // We can optimize the handling of data URLs in most cases.
@@ -321,7 +305,7 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context>,
   WebURLRequest request_;
   WebURLLoaderClient* client_;
   ResourceDispatcher* resource_dispatcher_;
-  scoped_ptr<blink::WebTaskRunner> web_task_runner_;
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   WebReferrerPolicy referrer_policy_;
   scoped_ptr<FtpDirectoryListingResponseDelegate> ftp_listing_delegate_;
   scoped_ptr<MultipartResponseDelegate> multipart_delegate_;
@@ -335,11 +319,11 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context>,
 WebURLLoaderImpl::Context::Context(
     WebURLLoaderImpl* loader,
     ResourceDispatcher* resource_dispatcher,
-    scoped_ptr<blink::WebTaskRunner> web_task_runner)
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
     : loader_(loader),
       client_(NULL),
       resource_dispatcher_(resource_dispatcher),
-      web_task_runner_(web_task_runner.Pass()),
+      task_runner_(task_runner),
       referrer_policy_(blink::WebReferrerPolicyDefault),
       defers_loading_(NOT_DEFERRING),
       request_id_(-1) {
@@ -375,11 +359,8 @@ void WebURLLoaderImpl::Context::SetDefersLoading(bool value) {
     defers_loading_ = SHOULD_DEFER;
   } else if (!value && defers_loading_ != NOT_DEFERRING) {
     if (defers_loading_ == DEFERRED_DATA) {
-      // TODO(alexclarke): Find a way to let blink and chromium FROM_HERE
-      // coexist.
-      web_task_runner_->postTask(
-          ::blink::WebTraceLocation(__FUNCTION__, __FILE__),
-          new HandleDataURLTask(this));
+      task_runner_->PostTask(FROM_HERE,
+                             base::Bind(&Context::HandleDataURL, this));
     }
     defers_loading_ = NOT_DEFERRING;
   }
@@ -437,11 +418,8 @@ void WebURLLoaderImpl::Context::Start(const WebURLRequest& request,
           GetInfoFromDataURL(sync_load_response->url, sync_load_response,
                              &sync_load_response->data);
     } else {
-      // TODO(alexclarke): Find a way to let blink and chromium FROM_HERE
-      // coexist.
-      web_task_runner_->postTask(
-          ::blink::WebTraceLocation(__FUNCTION__, __FILE__),
-          new HandleDataURLTask(this));
+      task_runner_->PostTask(FROM_HERE,
+                             base::Bind(&Context::HandleDataURL, this));
     }
     return;
   }
@@ -504,7 +482,6 @@ void WebURLLoaderImpl::Context::Start(const WebURLRequest& request,
       GetRequestContextFrameTypeForWebURLRequest(request);
   request_info.extra_data = request.extraData();
   request_info.report_raw_headers = request.reportRawHeaders();
-  request_info.loading_web_task_runner.reset(web_task_runner_->clone());
 
   scoped_refptr<ResourceRequestBody> request_body =
       GetRequestBodyForWebURLRequest(request).get();
@@ -519,11 +496,6 @@ void WebURLLoaderImpl::Context::Start(const WebURLRequest& request,
       request_info, request_body.get(), this);
 }
 
-void WebURLLoaderImpl::Context::SetWebTaskRunner(
-    scoped_ptr<blink::WebTaskRunner> web_task_runner) {
-  web_task_runner_ = web_task_runner.Pass();
-}
-
 void WebURLLoaderImpl::Context::OnUploadProgress(uint64 position, uint64 size) {
   if (client_)
     client_->didSendData(loader_, position, size);
@@ -869,8 +841,8 @@ void WebURLLoaderImpl::Context::HandleDataURL() {
 
 WebURLLoaderImpl::WebURLLoaderImpl(
     ResourceDispatcher* resource_dispatcher,
-    scoped_ptr<blink::WebTaskRunner> web_task_runner)
-    : context_(new Context(this, resource_dispatcher, web_task_runner.Pass())) {
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
+    : context_(new Context(this, resource_dispatcher, task_runner)) {
 }
 
 WebURLLoaderImpl::~WebURLLoaderImpl() {
@@ -1087,11 +1059,4 @@ bool WebURLLoaderImpl::attachThreadedDataReceiver(
   return context_->AttachThreadedDataReceiver(threaded_data_receiver);
 }
 
-void WebURLLoaderImpl::setLoadingTaskRunner(
-    blink::WebTaskRunner* loading_task_runner) {
-  // There's no guarantee on the lifetime of |loading_task_runner| so we take a
-  // copy.
-  context_->SetWebTaskRunner(make_scoped_ptr(loading_task_runner->clone()));
-}
-
 }  // namespace content
diff --git a/content/child/web_url_loader_impl.h b/content/child/web_url_loader_impl.h
index b31b57e..ebad018 100644
--- a/content/child/web_url_loader_impl.h
+++ b/content/child/web_url_loader_impl.h
@@ -36,10 +36,9 @@ struct StreamOverrideParameters {
 class CONTENT_EXPORT WebURLLoaderImpl
     : public NON_EXPORTED_BASE(blink::WebURLLoader) {
  public:
-
-  // Takes ownership of |web_task_runner|.
-  WebURLLoaderImpl(ResourceDispatcher* resource_dispatcher,
-                   scoped_ptr<blink::WebTaskRunner> web_task_runner);
+  explicit WebURLLoaderImpl(
+      ResourceDispatcher* resource_dispatcher,
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
   ~WebURLLoaderImpl() override;
 
   static void PopulateURLResponse(const GURL& url,
@@ -68,7 +67,6 @@ class CONTENT_EXPORT WebURLLoaderImpl
                          int intra_priority_value) override;
   bool attachThreadedDataReceiver(
       blink::WebThreadedDataReceiver* threaded_data_receiver) override;
-  void setLoadingTaskRunner(blink::WebTaskRunner* loading_task_runner) override;
 
  private:
   class Context;
diff --git a/content/child/web_url_loader_impl_unittest.cc b/content/child/web_url_loader_impl_unittest.cc
index 00354dd..6fb686e 100644
--- a/content/child/web_url_loader_impl_unittest.cc
+++ b/content/child/web_url_loader_impl_unittest.cc
@@ -13,7 +13,6 @@
 #include "base/message_loop/message_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/time/time.h"
-#include "components/scheduler/child/web_task_runner_impl.h"
 #include "content/child/request_extra_data.h"
 #include "content/child/request_info.h"
 #include "content/child/resource_dispatcher.h"
@@ -107,10 +106,7 @@ class TestWebURLLoaderClient : public blink::WebURLLoaderClient {
   TestWebURLLoaderClient(
       ResourceDispatcher* dispatcher,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-      : loader_(
-          new WebURLLoaderImpl(
-              dispatcher,
-              make_scoped_ptr(new scheduler::WebTaskRunnerImpl(task_runner)))),
+      : loader_(new WebURLLoaderImpl(dispatcher, task_runner)),
         expect_multipart_response_(false),
         delete_on_receive_redirect_(false),
         delete_on_receive_response_(false),