Fix UAF in new Mojo EDK.

mojo/edk/system/broker_state.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/broker_state.h"
 
 #include "base/bind.h"
 #include "base/rand_util.h"
 #include "mojo/edk/embedder/embedder_internal.h"
 #include "mojo/edk/embedder/platform_channel_pair.h"
@@ skipping 84 matching lines @@
     pending_child_connects_.erase(pipe_id);
     return;
   }
 
   pending_connects_[pipe_id] = message_pipe;
 }
 
 void BrokerState::CloseMessagePipe(uint64_t pipe_id,
                                    MessagePipeDispatcher* message_pipe) {
   DCHECK(internal::g_io_thread_task_runner->RunsTasksOnCurrentThread());
-  base::AutoLock auto_lock(lock_);
 
   CHECK(connected_pipes_.find(message_pipe) != connected_pipes_.end());
   connected_pipes_[message_pipe]->RemoveRoute(pipe_id);
   connected_pipes_.erase(message_pipe);
 }
 
 void BrokerState::ChildBrokerHostCreated(ChildBrokerHost* child_broker_host) {
   base::AutoLock auto_lock(lock_);
   CHECK(child_processes_.find(child_broker_host->GetProcessId()) ==
         child_processes_.end());
@@ skipping 112 matching lines @@
 
 void BrokerState::AttachMessagePipe(MessagePipeDispatcher* message_pipe,
                                     uint64_t pipe_id,
                                     RoutedRawChannel* raw_channel) {
   connected_pipes_[message_pipe] = raw_channel;
   // Note: we must call GotNonTransferableChannel before AddRoute because there
   // could be race conditions if the pipe got queued messages in |AddRoute| but
   // then when it's read it returns no messages because it doesn't have the
   // channel yet.
   message_pipe->GotNonTransferableChannel(raw_channel->channel());
-  raw_channel->AddRoute(pipe_id, message_pipe);
+  // The above call could have caused |CloseMessagePipe| to be called.
+  if (connected_pipes_.find(message_pipe) != connected_pipes_.end())
+    raw_channel->AddRoute(pipe_id, message_pipe);
 }
 
 }  // namespace edk
 }  // namespace mojo