IPC: Fix attachment brokering race condition.

remoting/host/win/wts_session_process_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file implements the Windows service controlling Me2Me host processes
 // running within user sessions.
 
 #include "remoting/host/win/wts_session_process_delegate.h"
 
 #include <utility>
@@ skipping 364 matching lines @@
 
   // Create the server end of the IPC channel.
   std::string channel_name = IPC::Channel::GenerateUniqueRandomChannelID();
   ScopedHandle pipe;
   if (!CreateIpcChannel(channel_name, channel_security_, &pipe)) {
     ReportFatalError();
     return;
   }
 
   // Wrap the pipe into an IPC channel.
-  std::unique_ptr<IPC::ChannelProxy> channel(IPC::ChannelProxy::Create(
-      IPC::ChannelHandle(pipe.Get()), IPC::Channel::MODE_SERVER, this,
-      io_task_runner_));
+  std::unique_ptr<IPC::ChannelProxy> channel(
+      new IPC::ChannelProxy(this, io_task_runner_));
+  IPC::AttachmentBroker::GetGlobal()->RegisterCommunicationChannel(
+      channel.get(), io_task_runner_);
+  channel->Init(IPC::ChannelHandle(pipe.Get()), IPC::Channel::MODE_SERVER,
+                true);
 
   // Pass the name of the IPC channel to use.
   command_line.AppendSwitchNative(kDaemonPipeSwitchName,
                                   base::UTF8ToWide(channel_name));
 
   // Try to launch the process.
   ScopedHandle worker_process;
   ScopedHandle worker_thread;
   if (!LaunchProcessWithToken(command_line.GetProgram(),
                               command_line.GetCommandLineString(),
@@ skipping 19 matching lines @@
 
   if (!ResumeThread(worker_thread.Get())) {
     PLOG(ERROR) << "Failed to resume the worker thread";
     ReportFatalError();
     return;
   }
 
   channel_ = std::move(channel);
   pipe_ = std::move(pipe);
 
-  IPC::AttachmentBroker::GetGlobal()->RegisterCommunicationChannel(
-      channel_.get(), io_task_runner_);
-
   // Report success if the worker process is lauched directly. Otherwise, PID of
   // the client connected to the pipe will be used later. See
   // OnChannelConnected().
   if (!launch_elevated_)
     ReportProcessLaunched(std::move(worker_process));
 }
 
 void WtsSessionProcessDelegate::Core::DrainJobNotifications() {
   DCHECK(io_task_runner_->BelongsToCurrentThread());
 
@@ skipping 113 matching lines @@
 
 void WtsSessionProcessDelegate::CloseChannel() {
   core_->CloseChannel();
 }
 
 void WtsSessionProcessDelegate::KillProcess() {
   core_->KillProcess();
 }
 
 }  // namespace remoting