bluetooth: Detect and fix incorrect thread usage of BluetoothDispatcherHost.

content/browser/bluetooth/bluetooth_dispatcher_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // NETWORK_ERROR Note:
 // When a device can't be found in the BluetoothAdapter, that generally
 // indicates that it's gone out of range. We reject with a NetworkError in that
 // case.
 // https://webbluetoothchrome.github.io/web-bluetooth/#dom-bluetoothdevice-connectgatt
 
@@ skipping 153 matching lines @@
           // TODO(jyasskin): Add a way for tests to control the dialog
           // directly, and change this to a reasonable discovery timeout.
           base::TimeDelta::FromSecondsD(current_delay_time_),
           base::Bind(&BluetoothDispatcherHost::StopDeviceDiscovery,
                      // base::Timer guarantees it won't call back after its
                      // destructor starts.
                      base::Unretained(this)),
           /*is_repeating=*/false),
       weak_ptr_factory_(this) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  // Bind all future weak pointers to the UI thread.
+  weak_ptr_on_ui_thread_ = weak_ptr_factory_.GetWeakPtr();
+  weak_ptr_on_ui_thread_.get();  // Associates with UI thread.
+
   if (BluetoothAdapterFactory::IsBluetoothAdapterAvailable())
     BluetoothAdapterFactory::GetAdapter(
         base::Bind(&BluetoothDispatcherHost::set_adapter,
                    weak_ptr_factory_.GetWeakPtr()));
 }
 
 void BluetoothDispatcherHost::OnDestruct() const {
   // See class comment: UI Thread Note.
   BrowserThread::DeleteOnUIThread::Destruct(this);
 }
@@ skipping 87 matching lines @@
   if (adapter_.get())
     adapter_->RemoveObserver(this);
   adapter_ = adapter;
   if (adapter_.get())
     adapter_->AddObserver(this);
 }
 
 void BluetoothDispatcherHost::StartDeviceDiscovery(
     RequestDeviceSession* session,
     int chooser_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (session->discovery_session) {
     // Already running; just increase the timeout.
     discovery_session_timer_.Reset();
   } else {
     session->chooser->ShowDiscoveryState(
         BluetoothChooser::DiscoveryState::DISCOVERING);
     adapter_->StartDiscoverySessionWithFilter(
         session->ComputeScanFilter(),
         base::Bind(&BluetoothDispatcherHost::OnDiscoverySessionStarted,
-                   weak_ptr_factory_.GetWeakPtr(), chooser_id),
+                   weak_ptr_on_ui_thread_, chooser_id),
         base::Bind(&BluetoothDispatcherHost::OnDiscoverySessionStartedError,
-                   weak_ptr_factory_.GetWeakPtr(), chooser_id));
+                   weak_ptr_on_ui_thread_, chooser_id));
   }
 }
 
 void BluetoothDispatcherHost::StopDeviceDiscovery() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   for (IDMap<RequestDeviceSession, IDMapOwnPointer>::iterator iter(
            &request_device_sessions_);
        !iter.IsAtEnd(); iter.Advance()) {
     RequestDeviceSession* session = iter.GetCurrentValue();
     if (session->discovery_session) {
       StopDiscoverySession(session->discovery_session.Pass());
     }
     if (session->chooser) {
       session->chooser->ShowDiscoveryState(
           BluetoothChooser::DiscoveryState::IDLE);
     }
   }
 }
 
 void BluetoothDispatcherHost::AdapterPoweredChanged(
     device::BluetoothAdapter* adapter,
     bool powered) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   const BluetoothChooser::AdapterPresence presence =
       powered ? BluetoothChooser::AdapterPresence::POWERED_ON
               : BluetoothChooser::AdapterPresence::POWERED_OFF;
   for (IDMap<RequestDeviceSession, IDMapOwnPointer>::iterator iter(
            &request_device_sessions_);
        !iter.IsAtEnd(); iter.Advance()) {
     RequestDeviceSession* session = iter.GetCurrentValue();
     if (session->chooser)
       session->chooser->SetAdapterPresence(presence);
   }
 }
 
 void BluetoothDispatcherHost::DeviceAdded(device::BluetoothAdapter* adapter,
                                           device::BluetoothDevice* device) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   VLOG(1) << "Adding device to all choosers: " << device->GetAddress();
   for (IDMap<RequestDeviceSession, IDMapOwnPointer>::iterator iter(
            &request_device_sessions_);
        !iter.IsAtEnd(); iter.Advance()) {
     RequestDeviceSession* session = iter.GetCurrentValue();
     session->AddFilteredDevice(*device);
   }
 }
 
 void BluetoothDispatcherHost::DeviceRemoved(device::BluetoothAdapter* adapter,
                                             device::BluetoothDevice* device) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   VLOG(1) << "Marking device removed on all choosers: " << device->GetAddress();
   for (IDMap<RequestDeviceSession, IDMapOwnPointer>::iterator iter(
            &request_device_sessions_);
        !iter.IsAtEnd(); iter.Advance()) {
     RequestDeviceSession* session = iter.GetCurrentValue();
     if (session->chooser) {
       session->chooser->RemoveDevice(device->GetAddress());
     }
   }
 }
@@ skipping 51 matching lines @@
   }
 
   // Create storage for the information that backs the chooser, and show the
   // chooser.
   RequestDeviceSession* const session = new RequestDeviceSession(
       thread_id, request_id, filters, optional_services);
   int chooser_id = request_device_sessions_.Add(session);
 
   BluetoothChooser::EventHandler chooser_event_handler =
       base::Bind(&BluetoothDispatcherHost::OnBluetoothChooserEvent,
-                 weak_ptr_factory_.GetWeakPtr(), chooser_id);
+                 weak_ptr_on_ui_thread_, chooser_id);
   if (WebContents* web_contents =
           WebContents::FromRenderFrameHost(render_frame_host)) {
     if (WebContentsDelegate* delegate = web_contents->GetDelegate()) {
       session->chooser = delegate->RunBluetoothChooser(
           web_contents, chooser_event_handler,
           render_frame_host->GetLastCommittedURL().GetOrigin());
     }
   }
   if (!session->chooser) {
     LOG(WARNING)
@@ skipping 38 matching lines @@
   // the device. https://crbug.com/484745
   device::BluetoothDevice* device = adapter_->GetDevice(device_instance_id);
   if (device == nullptr) {  // See "NETWORK_ERROR Note" above.
     RecordConnectGATTOutcome(UMAConnectGATTOutcome::NO_DEVICE);
     Send(new BluetoothMsg_ConnectGATTError(
         thread_id, request_id, WebBluetoothError::DeviceNoLongerInRange));
     return;
   }
   device->CreateGattConnection(
       base::Bind(&BluetoothDispatcherHost::OnGATTConnectionCreated,
-                 weak_ptr_factory_.GetWeakPtr(), thread_id, request_id,
+                 weak_ptr_on_ui_thread_, thread_id, request_id,
                  device_instance_id, start_time),
       base::Bind(&BluetoothDispatcherHost::OnCreateGATTConnectionError,
-                 weak_ptr_factory_.GetWeakPtr(), thread_id, request_id,
+                 weak_ptr_on_ui_thread_, thread_id, request_id,
                  device_instance_id, start_time));
 }
 
 void BluetoothDispatcherHost::OnGetPrimaryService(
     int thread_id,
     int request_id,
     const std::string& device_instance_id,
     const std::string& service_uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(UMAWebBluetoothFunction::GET_PRIMARY_SERVICE);
   RecordGetPrimaryServiceService(BluetoothUUID(service_uuid));
 
   // TODO(ortuno): Check if device_instance_id is in "allowed devices"
   // https://crbug.com/493459
   // TODO(ortuno): Check if service_uuid is in "allowed services"
   // https://crbug.com/493460
   // For now just wait a fixed time and call OnServiceDiscovered.
   // TODO(ortuno): Use callback once it's implemented http://crbug.com/484504
   BrowserThread::PostDelayedTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&BluetoothDispatcherHost::OnServicesDiscovered,
-                 weak_ptr_factory_.GetWeakPtr(), thread_id, request_id,
+                 weak_ptr_on_ui_thread_, thread_id, request_id,
                  device_instance_id, service_uuid),
       base::TimeDelta::FromSeconds(current_delay_time_));
 }
 
 void BluetoothDispatcherHost::OnGetCharacteristic(
     int thread_id,
     int request_id,
     const std::string& service_instance_id,
     const std::string& characteristic_uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ skipping 107 matching lines @@
     RecordCharacteristicReadValueOutcome(
         UMAGATTOperationOutcome::NO_CHARACTERISTIC);
     Send(new BluetoothMsg_ReadCharacteristicValueError(
         thread_id, request_id,
         WebBluetoothError::CharacteristicNoLongerExists));
     return;
   }
 
   characteristic->ReadRemoteCharacteristic(
       base::Bind(&BluetoothDispatcherHost::OnCharacteristicValueRead,
-                 weak_ptr_factory_.GetWeakPtr(), thread_id, request_id),
+                 weak_ptr_on_ui_thread_, thread_id, request_id),
       base::Bind(&BluetoothDispatcherHost::OnCharacteristicReadValueError,
-                 weak_ptr_factory_.GetWeakPtr(), thread_id, request_id));
+                 weak_ptr_on_ui_thread_, thread_id, request_id));
 }
 
 void BluetoothDispatcherHost::OnWriteValue(
     int thread_id,
     int request_id,
     const std::string& characteristic_instance_id,
     const std::vector<uint8_t>& value) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(
       UMAWebBluetoothFunction::CHARACTERISTIC_WRITE_VALUE);
@@ skipping 47 matching lines @@
   if (characteristic == nullptr) {
     RecordCharacteristicWriteValueOutcome(
         UMAGATTOperationOutcome::NO_CHARACTERISTIC);
     Send(new BluetoothMsg_WriteCharacteristicValueError(
         thread_id, request_id,
         WebBluetoothError::CharacteristicNoLongerExists));
     return;
   }
   characteristic->WriteRemoteCharacteristic(
       value, base::Bind(&BluetoothDispatcherHost::OnWriteValueSuccess,
-                        weak_ptr_factory_.GetWeakPtr(), thread_id, request_id),
+                        weak_ptr_on_ui_thread_, thread_id, request_id),
       base::Bind(&BluetoothDispatcherHost::OnWriteValueFailed,
-                 weak_ptr_factory_.GetWeakPtr(), thread_id, request_id));
+                 weak_ptr_on_ui_thread_, thread_id, request_id));
 }
 
 void BluetoothDispatcherHost::OnDiscoverySessionStarted(
     int chooser_id,
     scoped_ptr<device::BluetoothDiscoverySession> discovery_session) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   VLOG(1) << "Started discovery session for " << chooser_id;
   if (RequestDeviceSession* session =
           request_device_sessions_.Lookup(chooser_id)) {
     session->discovery_session = discovery_session.Pass();
@@ skipping 18 matching lines @@
     }
   }
   // Ignore discovery session start errors when the dialog was already closed by
   // the time they happen.
 }
 
 void BluetoothDispatcherHost::OnBluetoothChooserEvent(
     int chooser_id,
     BluetoothChooser::Event event,
     const std::string& device_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RequestDeviceSession* session = request_device_sessions_.Lookup(chooser_id);
   DCHECK(session) << "Shouldn't receive an event (" << static_cast<int>(event)
                   << ") from a closed chooser.";
   CHECK(session->chooser) << "Shouldn't receive an event ("
                           << static_cast<int>(event)
                           << ") from a closed chooser.";
   switch (event) {
     case BluetoothChooser::Event::RESCAN:
       StartDeviceDiscovery(session, chooser_id);
       break;
     case BluetoothChooser::Event::CANCELLED:
     case BluetoothChooser::Event::SELECTED: {
       // Synchronously ensure nothing else calls into the chooser after it has
       // asked to be closed.
       session->chooser.reset();
 
       // Yield to the event loop to make sure we don't destroy the session
       // within a BluetoothDispatcherHost stack frame.
       if (!base::ThreadTaskRunnerHandle::Get()->PostTask(
               FROM_HERE,
               base::Bind(&BluetoothDispatcherHost::FinishClosingChooser,
-                         weak_ptr_factory_.GetWeakPtr(), chooser_id, event,
+                         weak_ptr_on_ui_thread_, chooser_id, event,
                          device_id))) {
         LOG(WARNING) << "No TaskRunner; not closing requestDevice dialog.";
       }
       break;
     }
     case BluetoothChooser::Event::SHOW_OVERVIEW_HELP:
       ShowBluetoothOverviewLink();
       break;
     case BluetoothChooser::Event::SHOW_PAIRING_HELP:
       ShowBluetoothPairingLink();
       break;
     case BluetoothChooser::Event::SHOW_ADAPTER_OFF_HELP:
       ShowBluetoothAdapterOffLink();
       break;
   }
 }
 
 void BluetoothDispatcherHost::FinishClosingChooser(
     int chooser_id,
     BluetoothChooser::Event event,
     const std::string& device_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RequestDeviceSession* session = request_device_sessions_.Lookup(chooser_id);
   DCHECK(session) << "Session removed unexpectedly.";
 
   if (event == BluetoothChooser::Event::CANCELLED) {
     RecordRequestDeviceOutcome(
         UMARequestDeviceOutcome::BLUETOOTH_CHOOSER_CANCELLED);
     VLOG(1) << "Bluetooth chooser cancelled";
     Send(new BluetoothMsg_RequestDeviceError(
         session->thread_id, session->request_id,
         WebBluetoothError::ChooserCancelled));
@@ skipping 35 matching lines @@
                                              session->request_id, device_ipc));
   request_device_sessions_.Remove(chooser_id);
 }
 
 void BluetoothDispatcherHost::OnGATTConnectionCreated(
     int thread_id,
     int request_id,
     const std::string& device_instance_id,
     base::TimeTicks start_time,
     scoped_ptr<device::BluetoothGattConnection> connection) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // TODO(ortuno): Save the BluetoothGattConnection so we can disconnect
   // from it.
   RecordConnectGATTTimeSuccess(base::TimeTicks::Now() - start_time);
   RecordConnectGATTOutcome(UMAConnectGATTOutcome::SUCCESS);
   Send(new BluetoothMsg_ConnectGATTSuccess(thread_id, request_id,
                                            device_instance_id));
 }
 
 void BluetoothDispatcherHost::OnCreateGATTConnectionError(
     int thread_id,
     int request_id,
     const std::string& device_instance_id,
     base::TimeTicks start_time,
     device::BluetoothDevice::ConnectErrorCode error_code) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // There was an error creating the ATT Bearer so we reject with
   // NetworkError.
   // https://webbluetoothchrome.github.io/web-bluetooth/#dom-bluetoothdevice-connectgatt
   RecordConnectGATTTimeFailed(base::TimeTicks::Now() - start_time);
   // RecordConnectGATTOutcome is called by TranslateConnectError.
   Send(new BluetoothMsg_ConnectGATTError(thread_id, request_id,
                                          TranslateConnectError(error_code)));
 }
 
 void BluetoothDispatcherHost::OnServicesDiscovered(
@@ skipping 35 matching lines @@
   VLOG(1) << "No service found";
   RecordGetPrimaryServiceOutcome(UMAGetPrimaryServiceOutcome::NOT_FOUND);
   Send(new BluetoothMsg_GetPrimaryServiceError(
       thread_id, request_id, WebBluetoothError::ServiceNotFound));
 }
 
 void BluetoothDispatcherHost::OnCharacteristicValueRead(
     int thread_id,
     int request_id,
     const std::vector<uint8>& value) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordCharacteristicReadValueOutcome(UMAGATTOperationOutcome::SUCCESS);
   Send(new BluetoothMsg_ReadCharacteristicValueSuccess(thread_id, request_id,
                                                        value));
 }
 
 void BluetoothDispatcherHost::OnCharacteristicReadValueError(
     int thread_id,
     int request_id,
     device::BluetoothGattService::GattErrorCode error_code) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // TranslateGATTError calls RecordGATTOperationOutcome.
   Send(new BluetoothMsg_ReadCharacteristicValueError(
       thread_id, request_id,
       TranslateGATTError(error_code, UMAGATTOperation::CHARACTERISTIC_READ)));
 }
 
 void BluetoothDispatcherHost::OnWriteValueSuccess(int thread_id,
                                                   int request_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordCharacteristicWriteValueOutcome(UMAGATTOperationOutcome::SUCCESS);
   Send(new BluetoothMsg_WriteCharacteristicValueSuccess(thread_id, request_id));
 }
 
 void BluetoothDispatcherHost::OnWriteValueFailed(
     int thread_id,
     int request_id,
     device::BluetoothGattService::GattErrorCode error_code) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // TranslateGATTError calls RecordGATTOperationOutcome.
   Send(new BluetoothMsg_WriteCharacteristicValueError(
       thread_id, request_id,
       TranslateGATTError(error_code, UMAGATTOperation::CHARACTERISTIC_WRITE)));
 }
 
 void BluetoothDispatcherHost::ShowBluetoothOverviewLink() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   NOTIMPLEMENTED();
 }
 
 void BluetoothDispatcherHost::ShowBluetoothPairingLink() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   NOTIMPLEMENTED();
 }
 
 void BluetoothDispatcherHost::ShowBluetoothAdapterOffLink() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   NOTIMPLEMENTED();
 }
 
 }  // namespace content