Fix UAF in new Mojo EDK.

mojo/edk/system/message_pipe_dispatcher.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/message_pipe_dispatcher.h"
 
 #include "base/bind.h"
 #include "base/debug/stack_trace.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 175 matching lines @@
 void MessagePipeDispatcher::GotNonTransferableChannel(RawChannel* channel) {
   base::AutoLock locker(lock());
   channel_ = channel;
   while (!non_transferable_outgoing_message_queue_.IsEmpty()) {
     channel_->WriteMessage(
         non_transferable_outgoing_message_queue_.GetMessage());
   }
 
   if (non_transferable_state_ == WAITING_FOR_CONNECT_TO_CLOSE) {
     // We kept this object alive until it's connected, we can release it now.
-    // Since we're in a callback from the Broker, call it asynchronously.
-    internal::g_io_thread_task_runner->PostTask(
-        FROM_HERE,
-        base::Bind(&Broker::CloseMessagePipe,
-                   base::Unretained(internal::g_broker), pipe_id_,
-                   base::Unretained(this)));
+    internal::g_broker->CloseMessagePipe(pipe_id_, this);
     non_transferable_state_ = CLOSED;
     channel_ = nullptr;
     base::MessageLoop::current()->ReleaseSoon(FROM_HERE, this);
   } else {
     non_transferable_state_ = CONNECTED;
   }
 }
 
 #if defined(OS_WIN)
 // TODO(jam): this is copied from RawChannelWin till I figure out what's the
@@ skipping 705 matching lines @@
     base::AutoLock locker(lock());
     // We can get two OnError callbacks before the post task below completes.
     // Although RawChannel still has a pointer to this object until Shutdown is
     // called, that is safe since this class always does a PostTask to the IO
     // thread to self destruct.
     if (channel_ && error != ERROR_WRITE) {
       if (transferable_) {
         channel_->Shutdown();
       } else {
         CHECK_NE(non_transferable_state_, CLOSED);
-        // Since we're in a callback from the Broker, call it asynchronously.
-        internal::g_io_thread_task_runner->PostTask(
-            FROM_HERE,
-            base::Bind(&Broker::CloseMessagePipe,
-                       base::Unretained(internal::g_broker), pipe_id_,
-                       base::Unretained(this)));
+        internal::g_broker->CloseMessagePipe(pipe_id_, this);
         non_transferable_state_ = CLOSED;
       }
       channel_ = nullptr;
     }
     awakable_list_.AwakeForStateChange(GetHandleSignalsStateImplNoLock());
     started_transport_.Release();
   } else {
     // We must be waiting to call ReleaseHandle. It will call Shutdown.
   }
 }
@@ skipping 57 matching lines @@
   // PostTask since the broker can call us back synchronously.
   internal::g_io_thread_task_runner->PostTask(
       FROM_HERE,
       base::Bind(&Broker::ConnectMessagePipe,
                  base::Unretained(internal::g_broker), pipe_id_,
                  base::Unretained(this)));
 }
 
 }  // namespace edk
 }  // namespace mojo