From 940386e6d3a30535066a33db46eac550eda944c6 Mon Sep 17 00:00:00 2001
From: bridiver <github@brianjohnson.cc>
Date: Wed, 17 Oct 2018 16:18:49 -0700
Subject: [PATCH 1/2] make RunIOTask safer when returning back from the task
 runner thread before this change returning back using ledger_->RunTask could
 cause a free after use crash during shutdown if the task returned after the
 rewards service has been destroyed

---
 .../browser/rewards_service_impl.cc           | 24 +++++++++++++------
 .../browser/rewards_service_impl.h            |  7 +++++-
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/components/brave_rewards/browser/rewards_service_impl.cc b/components/brave_rewards/browser/rewards_service_impl.cc
index 4d8e938af102..4a9da173ee87 100644
--- a/components/brave_rewards/browser/rewards_service_impl.cc
+++ b/components/brave_rewards/browser/rewards_service_impl.cc
@@ -851,17 +851,27 @@ void RewardsServiceImpl::OnURLFetchComplete(
   callback.Run(response_code, body, headers);
 }
 
+void RunIOTaskCallback(
+    base::WeakPtr<RewardsServiceImpl> rewards_service,
+    std::function<void(void)> callback) {
+  content::BrowserThread::PostTask(content::BrowserThread::UI, FROM_HERE,
+      base::BindOnce(&RewardsServiceImpl::OnIOTaskComplete,
+                      rewards_service,
+                      callback));
+}
+
+void RewardsServiceImpl::OnIOTaskComplete(std::function<void(void)> callback) {
+  callback();
+}
+
 void RewardsServiceImpl::RunIOTask(
     std::unique_ptr<ledger::LedgerTaskRunner> task) {
-  file_task_runner_->PostTask(FROM_HERE,
-      base::BindOnce(&ledger::LedgerTaskRunner::Run, std::move(task)));
-}
+  ledger::LedgerTaskRunner::CallerThreadCallback callback =
+      std::bind(&RunIOTaskCallback, AsWeakPtr(), _1);
 
-void RewardsServiceImpl::RunTask(
-      std::unique_ptr<ledger::LedgerTaskRunner> task) {
-  content::BrowserThread::PostTask(content::BrowserThread::UI, FROM_HERE,
+  file_task_runner_->PostTask(FROM_HERE,
       base::BindOnce(&ledger::LedgerTaskRunner::Run,
-                     std::move(task)));
+          std::move(task), std::move(callback)));
 }
 
 void RewardsServiceImpl::TriggerOnWalletInitialized(int error_code) {
diff --git a/components/brave_rewards/browser/rewards_service_impl.h b/components/brave_rewards/browser/rewards_service_impl.h
index ad04d95a6ef1..1d7ec76dc7be 100644
--- a/components/brave_rewards/browser/rewards_service_impl.h
+++ b/components/brave_rewards/browser/rewards_service_impl.h
@@ -5,6 +5,7 @@
 #ifndef BRAVE_BROWSER_PAYMENTS_PAYMENTS_SERVICE_IMPL_
 #define BRAVE_BROWSER_PAYMENTS_PAYMENTS_SERVICE_IMPL_
 
+#include <functional>
 #include <map>
 #include <memory>
 #include <string>
@@ -111,6 +112,9 @@ class RewardsServiceImpl : public RewardsService,
   void UpdateTipsList() override;
 
  private:
+  friend void RunIOTaskCallback(
+      base::WeakPtr<RewardsServiceImpl>,
+      std::function<void(void)>);
   typedef base::Callback<void(int, const std::string&, const std::map<std::string, std::string>& headers)> FetchCallback;
 
   const extensions::OneShotEvent& ready() const { return ready_; }
@@ -212,7 +216,6 @@ class RewardsServiceImpl : public RewardsService,
       ledger::LedgerCallbackHandler* handler) override;
 
   void RunIOTask(std::unique_ptr<ledger::LedgerTaskRunner> task) override;
-  void RunTask(std::unique_ptr<ledger::LedgerTaskRunner> task) override;
   void SetRewardsMainEnabled(bool enabled) const override;
   void SetPublisherMinVisitTime(uint64_t duration_in_seconds) const override;
   void SetPublisherMinVisits(unsigned int visits) const override;
@@ -239,6 +242,8 @@ class RewardsServiceImpl : public RewardsService,
                             const ledger::PUBLISHER_CATEGORY category) override;
   void GetRecurringDonations(ledger::RecurringDonationCallback callback) override;
 
+  void OnIOTaskComplete(std::function<void(void)> callback);
+
   // URLFetcherDelegate impl
   void OnURLFetchComplete(const net::URLFetcher* source) override;
 

From 62262427c9864594d91de82bd8b31e4f828a5bfa Mon Sep 17 00:00:00 2001
From: NejcZdovc <nejc.zdovc@3zsistemi.si>
Date: Thu, 18 Oct 2018 08:27:27 +0200
Subject: [PATCH 2/2] Update deps

---
 DEPS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DEPS b/DEPS
index 1df6ec428fec..a4267fd17bf3 100644
--- a/DEPS
+++ b/DEPS
@@ -10,7 +10,7 @@ deps = {
   "vendor/boto": "https://github.com/boto/boto@f7574aa6cc2c819430c1f05e9a1a1a666ef8169b",
   "vendor/python-patch": "https://github.com/svn2github/python-patch@a336a458016ced89aba90dfc3f4c8222ae3b1403",
   "vendor/sparkle": "https://github.com/brave/Sparkle.git@c0759cce415d7c0feae45005c8a013b1898711f0",
-  "vendor/bat-native-ledger": "https://github.com/brave-intl/bat-native-ledger@8a45775a4df42276013d2f8aa3c69ad9f283ff15",
+  "vendor/bat-native-ledger": "https://github.com/brave-intl/bat-native-ledger@9276e6390242b63e50e2462a6186f8a6e8daa917",
   "vendor/bat-native-rapidjson": "https://github.com/brave-intl/bat-native-rapidjson.git@86aafe2ef89835ae71c9ed7c2527e3bb3000930e",
   "vendor/bip39wally-core-native": "https://github.com/brave-intl/bip39wally-core-native.git@9b119931c702d55be994117eb505d56310720b1d",
   "vendor/bat-native-anonize": "https://github.com/brave-intl/bat-native-anonize.git@adeff3254bb90ccdc9699040d5a4e1cd6b8393b7",