Multiple sync channels if used in the same listener thread could result in ca...

base/waitable_event_watcher_posix.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/waitable_event_watcher.h"
 
 #include "base/condition_variable.h"
 #include "base/lock.h"
 #include "base/message_loop.h"
 #include "base/waitable_event.h"
@@ skipping 104 matching lines @@
  private:
   scoped_refptr<Flag> flag_;
   WaitableEventWatcher::Delegate *const delegate_;
   WaitableEvent *const event_;
 };
 
 WaitableEventWatcher::WaitableEventWatcher()
     : event_(NULL),
       message_loop_(NULL),
       cancel_flag_(NULL),
-      callback_task_(NULL) {
+      callback_task_(NULL),
+      delegate_(NULL) {
 }
 
 WaitableEventWatcher::~WaitableEventWatcher() {
   StopWatching();
 }
 
 // -----------------------------------------------------------------------------
 // The Handle is how the user cancels a wait. After deleting the Handle we
 // insure that the delegate cannot be called.
 // -----------------------------------------------------------------------------
@@ skipping 16 matching lines @@
   }
 
   DCHECK(!cancel_flag_.get()) << "StartWatching called while still watching";
 
   cancel_flag_ = new Flag;
   callback_task_ = new AsyncCallbackTask(cancel_flag_, delegate, event);
   WaitableEvent::WaitableEventKernel* kernel = event->kernel_.get();
 
   AutoLock locked(kernel->lock_);
 
+  delegate_ = delegate;
+  event_ = event;
+
   if (kernel->signaled_) {
     if (!kernel->manual_reset_)
       kernel->signaled_ = false;
 
     // No hairpinning - we can't call the delegate directly here. We have to
     // enqueue a task on the MessageLoop as normal.
     current_ml->PostTask(FROM_HERE, callback_task_);
     return true;
   }
 
   message_loop_ = current_ml;
   current_ml->AddDestructionObserver(this);
 
-  event_ = event;
   kernel_ = kernel;
   waiter_ = new AsyncWaiter(current_ml, callback_task_, cancel_flag_);
   event->Enqueue(waiter_);
 
   return true;
 }
 
 void WaitableEventWatcher::StopWatching() {
+  delegate_ = NULL;
+
   if (message_loop_) {
     message_loop_->RemoveDestructionObserver(this);
     message_loop_ = NULL;
   }
 
   if (!cancel_flag_.get())  // if not currently watching...
     return;
 
   if (cancel_flag_->value()) {
     // In this case, the event has fired, but we haven't figured that out yet.
@@ skipping 72 matching lines @@
 // -----------------------------------------------------------------------------
 // This is called when the MessageLoop which the callback will be run it is
 // deleted. We need to cancel the callback as if we had been deleted, but we
 // will still be deleted at some point in the future.
 // -----------------------------------------------------------------------------
 void WaitableEventWatcher::WillDestroyCurrentMessageLoop() {
   StopWatching();
 }
 
 }  // namespace base