commit b1dda104f92db54ab30dfb2912d9d552bc5e0073
author tzik <tzik@chromium.org> Wed Jul 25 16:40:57 2018
committer Commit Bot <commit-bot@chromium.org> Wed Jul 25 16:40:57 2018
tree 7ceac5a94ed9dafb0c3efd05ec6649f211dde7dc
parent 0f60eb2885fe4582afaf2a5879338aebda2f69ed

Avoid touching NestedSubscription's ref count before it's fully constructed

NestedSubscription is a ref-counted object, and its first reference used to
be made by base::BindOnce in its constructor. The reference is passed to
another thread, and released when the callback instance is destroyed.

However, if the PostTask failed or the posted task ran soon before the
constructor finished to construct the NestedSubscription instance, the
ref count is decremented to 0, and `new NestedSubscription` may return
a stale pointer.

This CL adds a static constructor to avoid that by splitting the ref-count
related set up out of the constructor.

Bug: 866456
Change-Id: Idf03b31b95b4a7ddee81fdebff78a594e52a62f8
Reviewed-on: https://chromium-review.googlesource.com/1149762
Reviewed-by: Richard Coles <torne@chromium.org>
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Cr-Commit-Position: refs/heads/master@{#577933}