The impl's comment says:

// This can be accessed from the IO thread.

but then it returns 

return content::URLDataSource::MessageLoopForRequestPath(path);

whose documentation is:

  // Returns the MessageLoop on which the delegate wishes to have
  // StartDataRequest called to handle the request for |path|. The default
  // implementation returns BrowserThread::UI. If the delegate does not care
  // which thread StartDataRequest is called on, this should return nullptr.
  // It may be beneficial to return nullptr for requests that are safe to handle
  // directly on the IO thread.  This can improve performance by satisfying such
  // requests more rapidly when there is a large amount of UI thread contention.
  // Or the delegate can return a specific thread's Messageloop if they wish.

i.e. comment says it should run on IO thread but it returns something which asks for it to run on UI thread..? If it doesn't care then it should return nullptr per documentation.