Code: void GDataFileSystem::AddUploadedFileOnUIThread(
    UploadMode upload_mode,
    const FilePath& virtual_dir_path,
    scoped_ptr<DocumentEntry> entry,
    const FilePath& file_content_path,
    GDataCache::FileOperationType cache_operation,
    const base::Closure& callback) {
  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));

  base::ScopedClosureRunner callback_runner(callback);

  if (!entry.get()) {
    NOTREACHED();
    return;
  }

  GDataEntry* dir_entry = directory_service_->FindEntryByPathSync(
      virtual_dir_path);
  if (!dir_entry)
    return;

  GDataDirectory* parent_dir  = dir_entry->AsGDataDirectory();
  if (!parent_dir)
     return;
 
   scoped_ptr<GDataEntry> new_entry(
      GDataEntry::FromDocumentEntry(
          NULL, entry.get(), directory_service_.get()));
   if (!new_entry.get())
     return;
 
  if (upload_mode == UPLOAD_EXISTING_FILE) {
    const std::string& resource_id = new_entry->resource_id();
    directory_service_->GetEntryByResourceIdAsync(resource_id,
        base::Bind(&RemoveStaleEntryOnUpload, resource_id, parent_dir));
  }

  GDataFile* file = new_entry->AsGDataFile();
  DCHECK(file);
  const std::string& resource_id = file->resource_id();
  const std::string& md5 = file->file_md5();
  parent_dir->AddEntry(new_entry.release());

  OnDirectoryChanged(virtual_dir_path);

  if (upload_mode == UPLOAD_NEW_FILE) {
    cache_->StoreOnUIThread(resource_id,
                            md5,
                            file_content_path,
                            cache_operation,
                            base::Bind(&OnCacheUpdatedForAddUploadedFile,
                                       callback_runner.Release()));
  } else if (upload_mode == UPLOAD_EXISTING_FILE) {
    cache_->ClearDirtyOnUIThread(resource_id,
                                 md5,
                                 base::Bind(&OnCacheUpdatedForAddUploadedFile,
                                            callback_runner.Release()));
  } else {
    NOTREACHED() << "Unexpected upload mode: " << upload_mode;
  }
}

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of fonts in CANVAS elements.
Commit Message: Remove parent* arg from GDataEntry ctor.

* Remove static FromDocumentEntry from GDataEntry, GDataFile, GDataDirectory. Replace with InitFromDocumentEntry.
* Move common code from GDataFile::InitFromDocumentEntry and GDataDirectory::InitFromDocumentEntry to GDataEntry::InitFromDocumentEntry.
* Add GDataDirectoryService::FromDocumentEntry and use this everywhere.
* Make ctors of GDataFile, GDataDirectory private, so these must be created by GDataDirectoryService's CreateGDataFile and
CreateGDataDirectory. Make GDataEntry ctor protected.

BUG=141494
TEST=unit tests.
Review URL: https://chromiumcodereview.appspot.com/10854083

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@151008 0039d316-1c4b-4281-b951-d872f2087c98