In ThreadProxy, tasks posted from the main thread to the impl thread can safely use base::Unretained(this) for the very subtle reason that shutdown is blocking from the main thread to the impl thread, so any tasks posted main->impl will run before the shutdown task runs. Tasks from the impl thread to the main thread all go through the mainThreadProxy which is a WeakPtr, essentially. Tasks posted from impl->impl are unsafe and there's no way to make them safe. These are rare, but a few have snuck in and copied the main->impl pattern of using base::Unretained(this). This adds a WeakPtr bound to the impl thread to provide a safe way for posting impl->impl thread tasks. I converted all of the main->impl tasks as well, since while I think the base::Unretained(this) code is safe it's subtle and easy to incorrectly copy. The one exception is ThreadProxy::start() which has to use a raw pointer since the WeakPtr is bound to the impl thread. BUG= Review URL: https://chromiumcodereview.appspot.com/11649009 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@173905 0039d316-1c4b-4281-b951-d872f2087c98