Fix reads and writes to freed memory in Channel::ChannelImpl::OnFileCanReadWi...

ipc/ipc_channel_posix.cc

 // Copyright (c) 2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ipc/ipc_channel_posix.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stddef.h>
 #include <sys/types.h>
@@ skipping 887 matching lines @@
       // of the pipe in Connect().
       waiting_connect_ = false;
     }
     send_server_hello_msg = true;
   }
 
   if (!waiting_connect_ && fd == pipe_) {
     if (!ProcessIncomingMessages()) {
       Close();
       listener_->OnChannelError();
+      // The OnChannelError() call may delete this, so we need to exit now.
+      return;
     }
   }
 
   // If we're a server and handshaking, then we want to make sure that we
   // only send our handshake message after we've processed the client's.
   // This gives us a chance to kill the client if the incoming handshake
   // is invalid.
   if (send_server_hello_msg) {
     // This should be our first write so there's no chance we can block here...
     DCHECK(is_blocked_on_write_ == false);
@@ skipping 87 matching lines @@
 
 bool Channel::Send(Message* message) {
   return channel_impl_->Send(message);
 }
 
 int Channel::GetClientFileDescriptor() const {
   return channel_impl_->GetClientFileDescriptor();
 }
 
 }  // namespace IPC