Fix UAF in new Mojo EDK.

mojo/edk/system/child_broker.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/child_broker.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "mojo/edk/embedder/embedder_internal.h"
 #include "mojo/edk/embedder/platform_channel_pair.h"
@@ skipping 254 matching lines @@
 
 void ChildBroker::AttachMessagePipe(MessagePipeDispatcher* message_pipe,
                                     uint64_t pipe_id,
                                     RoutedRawChannel* raw_channel) {
   connected_pipes_[message_pipe] = raw_channel;
   // Note: we must call GotNonTransferableChannel before AddRoute because there
   // could be race conditions if the pipe got queued messages in |AddRoute| but
   // then when it's read it returns no messages because it doesn't have the
   // channel yet.
   message_pipe->GotNonTransferableChannel(raw_channel->channel());
-  raw_channel->AddRoute(pipe_id, message_pipe);
+  // The above call could have caused |CloseMessagePipe| to be called.
+  if (connected_pipes_.find(message_pipe) != connected_pipes_.end())
+    raw_channel->AddRoute(pipe_id, message_pipe);
 }
 
 #if defined(OS_WIN)
 
 bool ChildBroker::WriteAndReadResponse(BrokerMessage* message,
                                        void* response,
                                        uint32_t response_size) {
   CHECK(parent_sync_channel_.is_valid());
 
   bool result = true;
@@ skipping 34 matching lines @@
   if (WriteAndReadResponse(&message, handles, response_size)) {
     server->reset(PlatformHandle(handles[0]));
     client->reset(PlatformHandle(handles[1]));
   }
 }
 
 #endif
 
 }  // namespace edk
 }  // namespace mojo