Update mojo sdk to rev 7214b7ec7d27563b2666afad86cf1c5895c56c18

third_party/mojo/src/mojo/edk/system/channel_endpoint.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/channel_endpoint.h"
 
 #include "base/logging.h"
 #include "base/threading/platform_thread.h"
 #include "mojo/edk/system/channel.h"
 #include "mojo/edk/system/channel_endpoint_client.h"
@@ skipping 75 matching lines @@
     LOG_IF(WARNING, !ok) << "Failed to write enqueue message to channel";
   }
 
   if (!client_) {
     channel_->DetachEndpoint(this, local_id_, remote_id_);
     ResetChannelNoLock();
   }
 }
 
 void ChannelEndpoint::OnReadMessage(scoped_ptr<MessageInTransit> message) {
-  scoped_refptr<ChannelEndpointClient> client;
-  unsigned client_port = 0;
+  if (message->type() == MessageInTransit::kTypeEndpointClient) {
+    OnReadMessageForClient(message.Pass());
+    return;
+  }
 
-  // This loop is to make |ReplaceClient()| work. We can't call the client's
-  // |OnReadMessage()| under our lock, so by the time we do that, |client| may
-  // no longer be our client.
-  //
-  // In that case, |client| must return false. We'll then yield, and retry with
-  // the new client. (Theoretically, the client could be replaced again.)
-  //
-  // This solution isn't terribly elegant, but it's the least costly way of
-  // handling/avoiding this (very unlikely) race. (Other solutions -- e.g.,
-  // adding a client message queue, which the client only fetches messages from
-  // -- impose significant cost in the common case.)
-  for (;;) {
-    {
-      base::AutoLock locker(lock_);
-      if (!channel_ || !client_) {
-        // This isn't a failure per se. (It just means that, e.g., the other end
-        // of the message point closed first.)
-        return;
-      }
+  DCHECK_EQ(message->type(), MessageInTransit::kTypeEndpoint);
 
-      // If we get here in a second (third, etc.) iteration of the loop, it's
-      // because |ReplaceClient()| was called.
-      DCHECK(client_ != client || client_port_ != client_port);
-
-      // Take a ref, and call |OnReadMessage()| outside the lock.
-      client = client_;
-      client_port = client_port_;
-    }
-
-    if (client->OnReadMessage(client_port, message.get())) {
-      ignore_result(message.release());
-      break;
-    }
-
-    base::PlatformThread::YieldCurrentThread();
-  }
+  // TODO(vtl)
+  // Note that this won't crash on Release builds, which is important (since the
+  // other side may be malicious). Doing nothing is safe and will dispose of the
+  // message.
+  NOTREACHED();
 }
 
 void ChannelEndpoint::DetachFromChannel() {
   scoped_refptr<ChannelEndpointClient> client;
   unsigned client_port = 0;
   {
     base::AutoLock locker(lock_);
 
     if (client_) {
       // Take a ref, and call |OnDetachFromChannel()| outside the lock.
@@ skipping 34 matching lines @@
   DCHECK(channel_);
   DCHECK(local_id_.is_valid());
   DCHECK(remote_id_.is_valid());
 
   message->SerializeAndCloseDispatchers(channel_);
   message->set_source_id(local_id_);
   message->set_destination_id(remote_id_);
   return channel_->WriteMessage(message.Pass());
 }
 
+void ChannelEndpoint::OnReadMessageForClient(
+    scoped_ptr<MessageInTransit> message) {
+  DCHECK_EQ(message->type(), MessageInTransit::kTypeEndpointClient);
+
+  scoped_refptr<ChannelEndpointClient> client;
+  unsigned client_port = 0;
+
+  // This loop is to make |ReplaceClient()| work. We can't call the client's
+  // |OnReadMessage()| under our lock, so by the time we do that, |client| may
+  // no longer be our client.
+  //
+  // In that case, |client| must return false. We'll then yield, and retry with
+  // the new client. (Theoretically, the client could be replaced again.)
+  //
+  // This solution isn't terribly elegant, but it's the least costly way of
+  // handling/avoiding this (very unlikely) race. (Other solutions -- e.g.,
+  // adding a client message queue, which the client only fetches messages from
+  // -- impose significant cost in the common case.)
+  for (;;) {
+    {
+      base::AutoLock locker(lock_);
+      if (!channel_ || !client_) {
+        // This isn't a failure per se. (It just means that, e.g., the other end
+        // of the message point closed first.)
+        return;
+      }
+
+      // If we get here in a second (third, etc.) iteration of the loop, it's
+      // because |ReplaceClient()| was called.
+      DCHECK(client_ != client || client_port_ != client_port);
+
+      // Take a ref, and call |OnReadMessage()| outside the lock.
+      client = client_;
+      client_port = client_port_;
+    }
+
+    if (client->OnReadMessage(client_port, message.get())) {
+      ignore_result(message.release());
+      break;
+    }
+
+    base::PlatformThread::YieldCurrentThread();
+  }
+}
+
 void ChannelEndpoint::ResetChannelNoLock() {
   DCHECK(channel_);
   DCHECK(local_id_.is_valid());
   DCHECK(remote_id_.is_valid());
   DCHECK(!is_detached_from_channel_);
 
   channel_ = nullptr;
   local_id_ = ChannelEndpointId();
   remote_id_ = ChannelEndpointId();
   is_detached_from_channel_ = true;
 }
 
 }  // namespace system
 }  // namespace mojo