Avoid incrementing an invalid iterator in the utility process client.

chrome/utility/chrome_content_utility_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/utility/chrome_content_utility_client.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 157 matching lines @@
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_AnalyzeDmgFileForDownloadProtection,
                         OnAnalyzeDmgFileForDownloadProtection)
 #endif  // defined(OS_MACOSX)
 #endif  // defined(FULL_SAFE_BROWSING)
 #if defined(OS_CHROMEOS)
     IPC_MESSAGE_HANDLER(ChromeUtilityMsg_CreateZipFile, OnCreateZipFile)
 #endif
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
   for (Handlers::iterator it = handlers_.begin();

[jochen (gone - plz use gerrit), 2016/05/06 10:32:30]

why not:

if (handled) return true;

for (auto& handler : handlers_)
  if (handler->OnMessageReceived(message)) return true;

return false;

[Anand Mistry (off Chromium), 2016/05/09 02:32:14]

I was just trying to minimise the change. I've changed the logic, but kept the
comment (mostly).

        !handled && it != handlers_.end(); ++it) {
     handled = (*it)->OnMessageReceived(message);
+
+    // Warning, this is a hack! At least one of the utility process handlers
+    // adds a new handler to |handlers_| when it handles a message. This causes
+    // |it| to become invalid and hence the increment, which happens before
+    // checking the loop condition, is an invalid operation. For now, just
+    // early-out of this loop and avoid incrementing the iterator. Eventually,
+    // this will be fixed by moving everything to Mojo.
+    if (handled)
+      return true;
   }
 
   return handled;
 }
 
 void ChromeContentUtilityClient::RegisterMojoServices(
     content::ServiceRegistry* registry) {
   // When the utility process is running with elevated privileges, we need to
   // filter messages so that only a whitelist of IPCs can run. In Mojo, there's
   // no way of filtering individual messages. Instead, we can avoid adding
@@ skipping 105 matching lines @@
   safe_browsing::zip_analyzer::Results results;
   safe_browsing::dmg::AnalyzeDMGFile(
       IPC::PlatformFileForTransitToFile(dmg_file), &results);
   Send(new ChromeUtilityHostMsg_AnalyzeDmgFileForDownloadProtection_Finished(
       results));
   ReleaseProcessIfNeeded();
 }
 #endif  // defined(OS_MACOSX)
 
 #endif  // defined(FULL_SAFE_BROWSING)