Fix Mojo broker crash on Windows.

mojo/edk/system/broker_state.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/broker_state.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include "base/bind.h"
@@ skipping 75 matching lines @@
     AttachMessagePipe(pending_connects_[pipe_id], pipe_id,
                      in_process_pipes_channel1_);
     AttachMessagePipe(message_pipe, pipe_id, in_process_pipes_channel2_);
     pending_connects_.erase(pipe_id);
     return;
   }
 
   if (pending_child_connects_.find(pipe_id) != pending_child_connects_.end()) {
     // A child process has already tried to connect.
     ChildBrokerHost* child_host = pending_child_connects_[pipe_id];
-    AttachMessagePipe(message_pipe, pipe_id, child_host->channel());
-    child_host->ConnectMessagePipe(pipe_id, 0);
+    if (child_host && child_host->channel()) {
+      AttachMessagePipe(message_pipe, pipe_id, child_host->channel());
+      child_host->ConnectMessagePipe(pipe_id, 0);
+    } else {
+      message_pipe->OnError(RawChannel::Delegate::ERROR_READ_SHUTDOWN);
+    }
+
     pending_child_connects_.erase(pipe_id);
     return;
   }
 
   pending_connects_[pipe_id] = message_pipe;
 }
 
 void BrokerState::CloseMessagePipe(uint64_t pipe_id,
                                    MessagePipeDispatcher* message_pipe) {
   DCHECK(internal::g_io_thread_task_runner->RunsTasksOnCurrentThread());
 
   CHECK(connected_pipes_.find(message_pipe) != connected_pipes_.end());
   connected_pipes_[message_pipe]->RemoveRoute(pipe_id);
   connected_pipes_.erase(message_pipe);
 }
 
 void BrokerState::ChildBrokerHostCreated(ChildBrokerHost* child_broker_host) {
   base::AutoLock auto_lock(lock_);
   CHECK(child_processes_.find(child_broker_host->GetProcessId()) ==
         child_processes_.end());
   child_processes_[child_broker_host->GetProcessId()] = child_broker_host;
 }
 
 void BrokerState::ChildBrokerHostDestructed(
     ChildBrokerHost* child_broker_host) {
   DCHECK(internal::g_io_thread_task_runner->RunsTasksOnCurrentThread());
   base::AutoLock auto_lock(lock_);
 
   for (auto it = pending_child_connects_.begin();
-       it != pending_child_connects_.end();) {
+       it != pending_child_connects_.end(); ++it) {
     if (it->second == child_broker_host) {
-      // Since we can't do it = pending_child_connects_.erase(it); until
-      // hash_map uses unordered_map on posix.
-      auto cur = it++;
-      pending_child_connects_.erase(cur);
-    } else {
-      it++;
+      // Signify that the process has died. When another process tries to
+      // connect to the message pipe, we will tell it that the peer has died so
+      // that it can fire a peer closed notification.
+      it->second = nullptr;
     }
   }
 
   base::ProcessId pid = child_broker_host->GetProcessId();
   for (auto it = connected_processes_.begin();
        it != connected_processes_.end();) {
     if ((*it).first == pid || (*it).second == pid) {
-      // Since we can't do it = pending_child_connects_.erase(it); until
-      // hash_map uses unordered_map on posix.
+      // Since we can't do it = connected_processes_.erase(it); until hash_map
+      // uses unordered_map on posix.
       auto cur = it++;
       connected_processes_.erase(cur);
     } else {
       it++;
     }
   }
 
   CHECK(child_processes_.find(pid) != child_processes_.end());
   child_processes_.erase(pid);
 }
 
 void BrokerState::HandleConnectMessagePipe(ChildBrokerHost* pipe_process,
                                            uint64_t pipe_id) {
   DCHECK(internal::g_io_thread_task_runner->RunsTasksOnCurrentThread());
   base::AutoLock auto_lock(lock_);
   if (pending_child_connects_.find(pipe_id) != pending_child_connects_.end()) {
     // Another child process is waiting to connect to the given pipe.
     ChildBrokerHost* pending_pipe_process = pending_child_connects_[pipe_id];
-    EnsureProcessesConnected(pipe_process->GetProcessId(),
-                             pending_pipe_process->GetProcessId());
-    pending_pipe_process->ConnectMessagePipe(
-        pipe_id, pipe_process->GetProcessId());
-    pipe_process->ConnectMessagePipe(
-        pipe_id, pending_pipe_process->GetProcessId());
+    if (pending_pipe_process && pending_pipe_process->channel()) {
+      EnsureProcessesConnected(pipe_process->GetProcessId(),
+                               pending_pipe_process->GetProcessId());
+      pending_pipe_process->ConnectMessagePipe(
+          pipe_id, pipe_process->GetProcessId());
+      pipe_process->ConnectMessagePipe(
+          pipe_id, pending_pipe_process->GetProcessId());
+    } else {
+      pipe_process->PeerDied(pipe_id);
+    }
     pending_child_connects_.erase(pipe_id);
     return;
   }
 
   if (pending_connects_.find(pipe_id) != pending_connects_.end()) {
     // This parent process is the other side of the given pipe.
     MessagePipeDispatcher* pending_pipe = pending_connects_[pipe_id];
     AttachMessagePipe(pending_pipe, pipe_id, pipe_process->channel());
     pipe_process->ConnectMessagePipe(pipe_id, 0);
     pending_connects_.erase(pipe_id);
@@ skipping 59 matching lines @@
   // then when it's read it returns no messages because it doesn't have the
   // channel yet.
   message_pipe->GotNonTransferableChannel(raw_channel->channel());
   // The above call could have caused |CloseMessagePipe| to be called.
   if (connected_pipes_.find(message_pipe) != connected_pipes_.end())
     raw_channel->AddRoute(pipe_id, message_pipe);
 }
 
 }  // namespace edk
 }  // namespace mojo