Mandoline: Move ContentHandlerConnection into separate file

mojo/shell/content_handler_connection.cc

Index: mojo/shell/content_handler_connection.cc
diff --git a/mojo/shell/content_handler_connection.cc b/mojo/shell/content_handler_connection.cc
new file mode 100644
index 0000000000000000000000000000000000000000..9f48e93450bf0b11f60343a5ebac12097ea8addb
--- /dev/null
+++ b/mojo/shell/content_handler_connection.cc
@@ -0,0 +1,53 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mojo/shell/content_handler_connection.h"
+
+#include "mojo/shell/application_manager.h"
+
+namespace mojo {
+namespace shell {
+
+ContentHandlerConnection::ContentHandlerConnection(
+    ApplicationManager* manager,
+    const GURL& content_handler_url,
+    const GURL& requestor_url,
+    const std::string& qualifier)
+    : manager_(manager),
+      content_handler_url_(content_handler_url),
+      content_handler_qualifier_(qualifier),
+      connection_closed_(false) {
+  ServiceProviderPtr services;
+  mojo::URLRequestPtr request(mojo::URLRequest::New());
+  request->url = mojo::String::From(content_handler_url.spec());
+  manager->ConnectToApplicationInternal(
+      request.Pass(), qualifier, requestor_url, GetProxy(&services),
+      nullptr, base::Closure());
+  MessagePipe pipe;
+  content_handler_.Bind(
+      InterfacePtrInfo<ContentHandler>(pipe.handle0.Pass(), 0u));
+  services->ConnectToService(ContentHandler::Name_, pipe.handle1.Pass());
+  content_handler_.set_error_handler(this);
+}
+
+void ContentHandlerConnection::CloseConnection() {
+  if (connection_closed_)
+    return;

[jam, 2015/07/09 17:27:23]

in this case, how does the object get deleted?

[Fady Samuel, 2015/07/09 17:49:21]

The point of this flag is to ensure that CloseConnection can only delete this
once.

[jam, 2015/07/09 18:00:17]

Sure. But what I mean, if connection_closed_ is true, it means that this object
is deleted. so we have a UAF. or am i missing something?

+  connection_closed_ = true;
+  manager_->OnContentHandlerConnectionClosed(this);
+  delete this;
+}
+
+ContentHandlerConnection::~ContentHandlerConnection() {
+  // If this DCHECK fails then something has tried to delete this object without
+  // calling CloseConnection.
+  DCHECK(connection_closed_);
+}
+
+void ContentHandlerConnection::OnConnectionError() {
+  CloseConnection();
+}
+
+}  // namespace shell
+}  // namespace mojo