Prevent a race condition with MidiHost IPC sending.

content/browser/media/midi_host.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/media/midi_host.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/process/process.h"
 #include "base/trace_event/trace_event.h"
@@ skipping 37 matching lines @@
 
 MidiHost::MidiHost(int renderer_process_id,
                    media::midi::MidiManager* midi_manager)
     : BrowserMessageFilter(MidiMsgStart),
       renderer_process_id_(renderer_process_id),
       has_sys_ex_permission_(false),
       is_session_requested_(false),
       midi_manager_(midi_manager),
       sent_bytes_in_flight_(0),
       bytes_sent_since_last_acknowledgement_(0),
-      output_port_count_(0) {
+      output_port_count_(0),
+      is_channel_closing_(false) {
   DCHECK(midi_manager_);
 }
 
 MidiHost::~MidiHost() {
   // Close an open session, or abort opening a session.
   if (is_session_requested_ && midi_manager_)
     midi_manager_->EndSession(this);
 }
 
+void MidiHost::OnChannelClosing() {
+  // If we get here the MidiHost is going to be destroyed soon. Prevent any

[Takashi Toyoshima, 2016/01/12 10:20:51]

Can we fix the problem by just calling midi_manager_->EndSession(this) and
setting is_session_requested_ false here?
After the EndSession call returns, no method calls not be called from the
MidiManager.

[Oliver Chang, 2016/01/12 16:38:11]

Good point, I changed this to EndSession instead. I had thought previously that
that wasn't sufficient, but thinking about it again it appears to be fine.

+  // subsequent Send() calls.
+  // If Send() is called from a different thread (e.g. a separate thread owned
+  // by the MidiManager implementation), it will get posted to the IO thread.
+  // There is a race condition here if our refcount is 0 and we're about to or
+  // have already entered OnDestruct().
+  base::AutoLock auto_lock(is_channel_closing_lock_);
+  is_channel_closing_ = true;
+}
+
 void MidiHost::OnDestruct() const {
   BrowserThread::DeleteOnIOThread::Destruct(this);
 }
 
 // IPC Messages handler
 bool MidiHost::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(MidiHost, message)
     IPC_MESSAGE_HANDLER(MidiHostMsg_StartSession, OnStartSession)
     IPC_MESSAGE_HANDLER(MidiHostMsg_SendData, OnSendData)
     IPC_MESSAGE_HANDLER(MidiHostMsg_EndSession, OnEndSession)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
   return handled;
 }
 
+bool MidiHost::Send(IPC::Message* msg) {
+  base::AutoLock auto_lock(is_channel_closing_lock_);
+  if (!is_channel_closing_)
+    return BrowserMessageFilter::Send(msg);
+
+  return false;
+}
+
 void MidiHost::OnStartSession() {
   is_session_requested_ = true;
   if (midi_manager_)
     midi_manager_->StartSession(this);
 }
 
 void MidiHost::OnSendData(uint32_t port,
                           const std::vector<uint8_t>& data,
                           double timestamp) {
   {
@@ skipping 154 matching lines @@
     }
     waiting_data_length = media::midi::GetMidiMessageLength(current);
     if (waiting_data_length == 0)
       return false;  // Error: |current| should have been a valid status byte.
     --waiting_data_length;  // Found status byte
   }
   return waiting_data_length == 0 && !in_sysex;
 }
 
 }  // namespace content