Revert of Allow BlobDataHandles to be copied, and have their UUIDs read, on any thread. (https://codereview.chromium.org/259773006/)

Reason for revert:
I'm sorry to revert this change. It looks like it breaks the ASAN bot:

http://build.chromium.org/p/chromium.memory/builders/Linux%20ASan%20LSan%20Tests%20%282%29/builds/2161/steps/content_unittests/logs/ResolveBlobAndCreateUploadDataStream

Direct leak of 120 byte(s) in 3 object(s) allocated from:
    #0 0x520dbb in operator new(unsigned long) /usr/local/google/work/chromium/src/third_party/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:62
    #1 0x3a0f611 in webkit_blob::BlobDataHandle::BlobDataHandle(webkit_blob::BlobData*, webkit_blob::BlobStorageContext*, base::SequencedTaskRunner*) webkit/browser/blob/blob_data_handle.cc:42
    #2 0x3a0fd71 in webkit_blob::BlobStorageContext::GetBlobDataFromUUID(std::string const&) webkit/browser/blob/blob_storage_context.cc:69
    #3 0x268955d in ResolveBlobReference content/browser/loader/upload_data_stream_builder.cc:73
...

Original issue's description:
> Allow BlobDataHandles to be copied, and have their UUIDs read, on any thread.
> 
> BUG=108012
> 
> Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=266817
> 
> Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=267423

TBR=michaeln@chromium.org,piman@chromium.org,ericu@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=108012

Review URL: https://codereview.chromium.org/261683005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@267479 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 36 insertions, 67 deletions

diff --git a/webkit/browser/blob/blob_data_handle.cc b/webkit/browser/blob/blob_data_handle.cc
index 8ccba74..fd0ae54 100644
--- a/webkit/browser/blob/blob_data_handle.cc
+++ b/webkit/browser/blob/blob_data_handle.cc
@@ -13,56 +13,44 @@
 
 namespace webkit_blob {
 
-BlobDataHandle::BlobDataHandleShared::BlobDataHandleShared(
-    BlobData* blob_data,
-    BlobStorageContext* context,
-    base::SequencedTaskRunner* task_runner)
-    : blob_data_(blob_data),
-      context_(context->AsWeakPtr()) {
-  context_->IncrementBlobRefCount(blob_data->uuid());
-}
-
-BlobData* BlobDataHandle::BlobDataHandleShared::data() const {
-  return blob_data_;
-}
-
-const std::string& BlobDataHandle::BlobDataHandleShared::uuid() const {
-  return blob_data_->uuid();
-}
-
-BlobDataHandle::BlobDataHandleShared::~BlobDataHandleShared() {
-  if (context_.get())
-    context_->DecrementBlobRefCount(blob_data_->uuid());
-}
-
-BlobDataHandle::BlobDataHandle(BlobData* blob_data,
-                               BlobStorageContext* context,
+BlobDataHandle::BlobDataHandle(BlobData* blob_data, BlobStorageContext* context,
                                base::SequencedTaskRunner* task_runner)
-    : io_task_runner_(task_runner),
-      shared_(new BlobDataHandleShared(blob_data, context, task_runner)) {
-  DCHECK(io_task_runner_);
+    : blob_data_(blob_data),
+      context_(context->AsWeakPtr()),
+      io_task_runner_(task_runner) {
+  // Ensures the uuid remains registered and the underlying data is not deleted.
   DCHECK(io_task_runner_->RunsTasksOnCurrentThread());
-}
-
-BlobDataHandle::BlobDataHandle(const BlobDataHandle& other) {
-  io_task_runner_ = other.io_task_runner_;
-  shared_ = other.shared_;
+  context_->IncrementBlobRefCount(blob_data->uuid());
+  blob_data_->AddRef();
 }
 
 BlobDataHandle::~BlobDataHandle() {
-  BlobDataHandleShared* raw = shared_.get();
-  raw->AddRef();
-  shared_ = 0;
-  io_task_runner_->ReleaseSoon(FROM_HERE, raw);
+  if (io_task_runner_->RunsTasksOnCurrentThread()) {
+    // Note: Do not test context_ or alter the blob_data_ refcount
+    // on the wrong thread.
+    if (context_.get())
+      context_->DecrementBlobRefCount(blob_data_->uuid());
+    blob_data_->Release();
+    return;
+  }
+
+  io_task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(&DeleteHelper, context_, base::Unretained(blob_data_)));
 }
 
 BlobData* BlobDataHandle::data() const {
   DCHECK(io_task_runner_->RunsTasksOnCurrentThread());
-  return shared_->data();
+  return blob_data_;
 }
 
-std::string BlobDataHandle::uuid() const {
-  return shared_->uuid();
+// static
+void BlobDataHandle::DeleteHelper(
+    base::WeakPtr<BlobStorageContext> context,
+    BlobData* blob_data) {
+  if (context.get())
+    context->DecrementBlobRefCount(blob_data->uuid());
+  blob_data->Release();
 }
 
 }  // namespace webkit_blob
diff --git a/webkit/browser/blob/blob_data_handle.h b/webkit/browser/blob/blob_data_handle.h
index 917a0b3..5f870f2 100644
--- a/webkit/browser/blob/blob_data_handle.h
+++ b/webkit/browser/blob/blob_data_handle.h
@@ -28,42 +28,23 @@ class BlobStorageContext;
 class WEBKIT_STORAGE_BROWSER_EXPORT BlobDataHandle
     : public base::SupportsUserData::Data {
  public:
-  BlobDataHandle(const BlobDataHandle& other);  // May be copied on any thread.
   virtual ~BlobDataHandle();  // Maybe be deleted on any thread.
   BlobData* data() const;  // May only be accessed on the IO thread.
 
-  std::string uuid() const;  // May be accessed on any thread.
-
  private:
-  class BlobDataHandleShared
-      : public base::RefCountedThreadSafe<BlobDataHandleShared> {
-   public:
-    BlobDataHandleShared(BlobData* blob_data,
-                         BlobStorageContext* context,
-                         base::SequencedTaskRunner* task_runner);
-
-    BlobData* data() const;
-    const std::string& uuid() const;
-
-   private:
-    friend class base::DeleteHelper<BlobDataHandleShared>;
-    friend class base::RefCountedThreadSafe<BlobDataHandleShared>;
-    friend class BlobDataHandle;
-
-    virtual ~BlobDataHandleShared();
-
-    scoped_refptr<BlobData> blob_data_;
-    base::WeakPtr<BlobStorageContext> context_;
-
-    DISALLOW_COPY_AND_ASSIGN(BlobDataHandleShared);
-  };
-
   friend class BlobStorageContext;
   BlobDataHandle(BlobData* blob_data, BlobStorageContext* context,
                  base::SequencedTaskRunner* task_runner);
 
+  static void DeleteHelper(
+      base::WeakPtr<BlobStorageContext> context,
+      BlobData* blob_data);
+
+  BlobData* blob_data_;  // Intentionally a raw ptr to a non-thread-safe ref.
+  base::WeakPtr<BlobStorageContext> context_;
   scoped_refptr<base::SequencedTaskRunner> io_task_runner_;
-  scoped_refptr<BlobDataHandleShared> shared_;
+
+  DISALLOW_COPY_AND_ASSIGN(BlobDataHandle);
 };
 
 }  // namespace webkit_blob
diff --git a/webkit/browser/blob/blob_storage_context.h b/webkit/browser/blob/blob_storage_context.h
index a753c59..dda669a 100644
--- a/webkit/browser/blob/blob_storage_context.h
+++ b/webkit/browser/blob/blob_storage_context.h
@@ -53,7 +53,7 @@ class WEBKIT_STORAGE_BROWSER_EXPORT BlobStorageContext
 
  private:
   friend class content::BlobStorageHost;
-  friend class BlobDataHandle::BlobDataHandleShared;
+  friend class BlobDataHandle;
   friend class ViewBlobInternalsJob;
 
   enum EntryFlags {