In IndexedDBDispatcherHost::OnChannelClosing(), reset dispatcher hosts on the correct thread.

It's important that database_dispatcher_host_, et. al are reset on the WebKit
thread, as there may be pending tasks on that thread that need them.
This regressed in r69050.

BUG=84933
TEST=browser_tests --gtest_filter=IndexedDBBrowserTest.Bug84933Test

Review URL: http://codereview.chromium.org/6995111

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@88972 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 35 insertions, 14 deletions

diff --git a/content/browser/in_process_webkit/indexed_db_browsertest.cc b/content/browser/in_process_webkit/indexed_db_browsertest.cc
index fc472b3..9670a37 100644
--- a/content/browser/in_process_webkit/indexed_db_browsertest.cc
+++ b/content/browser/in_process_webkit/indexed_db_browsertest.cc
@@ -26,6 +26,10 @@ class IndexedDBBrowserTest : public InProcessBrowserTest {
     EnableDOMAutomation();
   }
 
+  virtual void SetUpCommandLine(CommandLine* command_line) {
+    command_line->AppendSwitch(switches::kUnlimitedQuotaForIndexedDB);
+  }
+
   GURL testUrl(const FilePath& file_path) {
     const FilePath kTestDir(FILE_PATH_LITERAL("indexeddb"));
     return ui_test_utils::GetTestUrl(kTestDir, file_path);
@@ -100,6 +104,13 @@ IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DISABLED_DoesntHangTest) {
   SimpleTest(testUrl(FilePath(FILE_PATH_LITERAL("transaction_test.html"))));
 }
 
+IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, Bug84933Test) {
+  const GURL url = testUrl(FilePath(FILE_PATH_LITERAL("bug_84933.html")));
+
+  // Just navigate to the URL. Test will crash if it fails.
+  ui_test_utils::NavigateToURLBlockUntilNavigationsComplete(browser(), url, 1);
+}
+
 // In proc browser test is needed here because ClearLocalState indirectly calls
 // WebKit's isMainThread through WebSecurityOrigin->SecurityOrigin.
 IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, ClearLocalState) {
diff --git a/content/browser/in_process_webkit/indexed_db_dispatcher_host.cc b/content/browser/in_process_webkit/indexed_db_dispatcher_host.cc
index bc40db4..90ec706 100644
--- a/content/browser/in_process_webkit/indexed_db_dispatcher_host.cc
+++ b/content/browser/in_process_webkit/indexed_db_dispatcher_host.cc
@@ -80,18 +80,28 @@ IndexedDBDispatcherHost::~IndexedDBDispatcherHost() {
 
 void IndexedDBDispatcherHost::OnChannelClosing() {
   BrowserMessageFilter::OnChannelClosing();
-  BrowserThread::DeleteSoon(
-        BrowserThread::WEBKIT, FROM_HERE, database_dispatcher_host_.release());
-  BrowserThread::DeleteSoon(
-        BrowserThread::WEBKIT, FROM_HERE, index_dispatcher_host_.release());
-  BrowserThread::DeleteSoon(
-        BrowserThread::WEBKIT, FROM_HERE,
-        object_store_dispatcher_host_.release());
-  BrowserThread::DeleteSoon(
-        BrowserThread::WEBKIT, FROM_HERE, cursor_dispatcher_host_.release());
-  BrowserThread::DeleteSoon(
-        BrowserThread::WEBKIT, FROM_HERE,
-        transaction_dispatcher_host_.release());
+
+  bool success = BrowserThread::PostTask(
+      BrowserThread::WEBKIT, FROM_HERE,
+      NewRunnableMethod(this, &IndexedDBDispatcherHost::ResetDispatcherHosts));
+
+  if (!success)
+    ResetDispatcherHosts();
+}
+
+void IndexedDBDispatcherHost::ResetDispatcherHosts() {
+  // It is important that the various *_dispatcher_host_ members are reset
+  // on the WebKit thread, since there might be incoming messages on that
+  // thread, and we must not reset the dispatcher hosts until after those
+  // messages are processed.
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT) ||
+         CommandLine::ForCurrentProcess()->HasSwitch(switches::kSingleProcess));
+
+  database_dispatcher_host_.reset();
+  index_dispatcher_host_.reset();
+  object_store_dispatcher_host_.reset();
+  cursor_dispatcher_host_.reset();
+  transaction_dispatcher_host_.reset();
 }
 
 void IndexedDBDispatcherHost::OverrideThreadForMessage(
@@ -108,8 +118,6 @@ bool IndexedDBDispatcherHost::OnMessageReceived(const IPC::Message& message,
 
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
 
-  // TODO(dgrogan): The page cycler test can crash here because
-  // database_dispatcher_host_ becomes invalid.
   bool handled =
       database_dispatcher_host_->OnMessageReceived(message, message_was_ok) ||
       index_dispatcher_host_->OnMessageReceived(message, message_was_ok) ||
diff --git a/content/browser/in_process_webkit/indexed_db_dispatcher_host.h b/content/browser/in_process_webkit/indexed_db_dispatcher_host.h
index 49a93fb..78bbf95 100644
--- a/content/browser/in_process_webkit/indexed_db_dispatcher_host.h
+++ b/content/browser/in_process_webkit/indexed_db_dispatcher_host.h
@@ -68,6 +68,8 @@ class IndexedDBDispatcherHost : public BrowserMessageFilter {
   void OnIDBFactoryDeleteDatabase(
       const IndexedDBHostMsg_FactoryDeleteDatabase_Params& p);
 
+  void ResetDispatcherHosts();
+
   // Helper templates.
   template <class ReturnType>
   ReturnType* GetOrTerminateProcess(