Prevent a race condition with MidiHost IPC sending.

content/browser/media/midi_host.cc

Index: content/browser/media/midi_host.cc
diff --git a/content/browser/media/midi_host.cc b/content/browser/media/midi_host.cc
index 1e6de1e234f1b6b5eebdf01a97c68de307b3a139..e8fa2feb869d119f74b515a3a27449740f03f703 100644
--- a/content/browser/media/midi_host.cc
+++ b/content/browser/media/midi_host.cc
@@ -55,7 +55,8 @@ MidiHost::MidiHost(int renderer_process_id,
       midi_manager_(midi_manager),
       sent_bytes_in_flight_(0),
       bytes_sent_since_last_acknowledgement_(0),
-      output_port_count_(0) {
+      output_port_count_(0),
+      is_channel_closing_(false) {
   DCHECK(midi_manager_);
 }
 
@@ -65,6 +66,17 @@ MidiHost::~MidiHost() {
     midi_manager_->EndSession(this);
 }
 
+void MidiHost::OnChannelClosing() {
+  // If we get here the MidiHost is going to be destroyed soon. Prevent any

[Takashi Toyoshima, 2016/01/12 10:20:51]

Can we fix the problem by just calling midi_manager_->EndSession(this) and
setting is_session_requested_ false here?
After the EndSession call returns, no method calls not be called from the
MidiManager.

[Oliver Chang, 2016/01/12 16:38:11]

Good point, I changed this to EndSession instead. I had thought previously that
that wasn't sufficient, but thinking about it again it appears to be fine.

+  // subsequent Send() calls.
+  // If Send() is called from a different thread (e.g. a separate thread owned
+  // by the MidiManager implementation), it will get posted to the IO thread.
+  // There is a race condition here if our refcount is 0 and we're about to or
+  // have already entered OnDestruct().
+  base::AutoLock auto_lock(is_channel_closing_lock_);
+  is_channel_closing_ = true;
+}
+
 void MidiHost::OnDestruct() const {
   BrowserThread::DeleteOnIOThread::Destruct(this);
 }
@@ -82,6 +94,14 @@ bool MidiHost::OnMessageReceived(const IPC::Message& message) {
   return handled;
 }
 
+bool MidiHost::Send(IPC::Message* msg) {
+  base::AutoLock auto_lock(is_channel_closing_lock_);
+  if (!is_channel_closing_)
+    return BrowserMessageFilter::Send(msg);
+
+  return false;
+}
+
 void MidiHost::OnStartSession() {
   is_session_requested_ = true;
   if (midi_manager_)