TCPSocket/UDPSocket: don't update internal state or access user buffers after Close().

ppapi/proxy/udp_socket_resource_base.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/udp_socket_resource_base.h"
 
 #include <algorithm>
 #include <cstring>
 
 #include "base/logging.h"
@@ skipping 194 matching lines @@
     return;
 
   bound_ = false;
   closed_ = true;
 
   Post(BROWSER, PpapiHostMsg_UDPSocket_Close());
 
   PostAbortIfNecessary(&bind_callback_);
   PostAbortIfNecessary(&recvfrom_callback_);
   PostAbortIfNecessary(&sendto_callback_);
+
+  read_buffer_ = NULL;
+  bytes_to_read_ = -1;
 }
 
 void UDPSocketResourceBase::PostAbortIfNecessary(
     scoped_refptr<TrackedCallback>* callback) {
   if (TrackedCallback::IsPending(*callback))
     (*callback)->PostAbort();
 }
 
 void UDPSocketResourceBase::OnPluginMsgSetOptionReply(
     scoped_refptr<TrackedCallback> callback,
     const ResourceMessageReplyParams& params) {
   if (TrackedCallback::IsPending(callback))
     callback->Run(ConvertPPError(params.result(), private_api_));
 }
 
 void UDPSocketResourceBase::OnPluginMsgBindReply(
     const ResourceMessageReplyParams& params,
     const PP_NetAddress_Private& bound_addr) {
-  if (!TrackedCallback::IsPending(bind_callback_)) {
-    NOTREACHED();
+  // It is possible that |bind_callback_| is pending while |closed_| is true:
+  // CloseImpl() has been called, but a BindReply came earlier than the task to
+  // abort |bind_callback_|. We don't want to update |bound_| or |bound_addr_|
+  // in that case.
+  if (!TrackedCallback::IsPending(bind_callback_) || closed_)
     return;
-  }
+
   if (params.result() == PP_OK)
     bound_ = true;
   bound_addr_ = bound_addr;
   bind_callback_->Run(ConvertPPError(params.result(), private_api_));
 }
 
 void UDPSocketResourceBase::OnPluginMsgRecvFromReply(
     PP_Resource* output_addr,
     const ResourceMessageReplyParams& params,
     const std::string& data,
     const PP_NetAddress_Private& addr) {
-  if (!TrackedCallback::IsPending(recvfrom_callback_)) {
-    NOTREACHED();
+  // It is possible that |recvfrom_callback_| is pending while |read_buffer_| is
+  // NULL: CloseImpl() has been called, but a RecvFromReply came earlier than
+  // the task to abort |recvfrom_callback_|. We shouldn't access the buffer in
+  // that case. The user may have released it.
+  if (!TrackedCallback::IsPending(recvfrom_callback_) || !read_buffer_)
     return;
-  }
+
   int32_t result = params.result();
   if (result == PP_OK && output_addr) {
     thunk::EnterResourceCreationNoLock enter(pp_instance());
     if (enter.succeeded()) {
       *output_addr = enter.functions()->CreateNetAddressFromNetAddressPrivate(
           pp_instance(), addr);
     } else {
       result = PP_ERROR_FAILED;
     }
   }
@@ skipping 10 matching lines @@
 
   if (result == PP_OK)
     recvfrom_callback_->Run(static_cast<int32_t>(data.size()));
   else
     recvfrom_callback_->Run(ConvertPPError(result, private_api_));
 }
 
 void UDPSocketResourceBase::OnPluginMsgSendToReply(
     const ResourceMessageReplyParams& params,
     int32_t bytes_written) {
-  if (!TrackedCallback::IsPending(sendto_callback_)) {
-    NOTREACHED();
+  if (!TrackedCallback::IsPending(sendto_callback_))
     return;
-  }
+
   if (params.result() == PP_OK)
     sendto_callback_->Run(bytes_written);
   else
     sendto_callback_->Run(ConvertPPError(params.result(), private_api_));
 }
 
 }  // namespace proxy
 }  // namespace ppapi