Fix a logical race when adding an awakable to a wait set.

mojo/edk/system/wait_set_dispatcher.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/wait_set_dispatcher.h"
 
 #include <stdint.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 228 matching lines @@
   if (!awoken_queue_.empty() || !processed_dispatchers_.empty())
     rv.satisfied_signals = MOJO_HANDLE_SIGNAL_READABLE;
   return rv;
 }
 
 MojoResult WaitSetDispatcher::AddAwakable(Awakable* awakable,
                                           MojoHandleSignals signals,
                                           uintptr_t context,
                                           HandleSignalsState* signals_state) {
   base::AutoLock lock(lock_);
+  // |awakable_lock_| is acquired here instead of immediately before adding to
+  // |awakable_list_| because we need to check the signals state and add to
+  // |awakable_list_| as an atomic operation. If the pair isn't atomic, it is
+  // possible for the signals state to change after it is checked, but before
+  // the awakable is added. In that case, the added awakable won't be signalled.
+  base::AutoLock awakable_locker(awakable_lock_);
   HandleSignalsState state(GetHandleSignalsStateNoLock());
   if (state.satisfies(signals)) {
     if (signals_state)
       *signals_state = state;
     return MOJO_RESULT_ALREADY_EXISTS;
   }
   if (!state.can_satisfy(signals)) {
     if (signals_state)
       *signals_state = state;
     return MOJO_RESULT_FAILED_PRECONDITION;
   }
 
-  base::AutoLock locker(awakable_lock_);
   awakable_list_.Add(awakable, signals, context);
   return MOJO_RESULT_OK;
 }
 
 void WaitSetDispatcher::RemoveAwakable(Awakable* awakable,
                                        HandleSignalsState* signals_state) {
   {
     base::AutoLock locker(awakable_lock_);
     awakable_list_.Remove(awakable);
   }
@@ skipping 24 matching lines @@
 
   base::AutoLock locker(awakable_lock_);
   HandleSignalsState signals_state;
   signals_state.satisfiable_signals = MOJO_HANDLE_SIGNAL_READABLE;
   signals_state.satisfied_signals = MOJO_HANDLE_SIGNAL_READABLE;
   awakable_list_.AwakeForStateChange(signals_state);
 }
 
 }  // namespace edk
 }  // namespace mojo