Fix data race in ChannelAssociatedGroupController

ipc/ipc_mojo_bootstrap.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ipc/ipc_mojo_bootstrap.h"
 
 #include <stdint.h>
 
 #include <map>
 #include <memory>
 #include <utility>
 #include <vector>
 
+#include "base/atomicops.h"
 #include "base/callback.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
 #include "ipc/ipc_message_utils.h"
@@ skipping 34 matching lines @@
         control_message_proxy_(&control_message_proxy_thunk_) {
     thread_checker_.DetachFromThread();
     control_message_handler_.SetDescription(
         "IPC::mojom::Bootstrap [master] PipeControlMessageHandler");
   }
 
   void Bind(mojo::ScopedMessagePipeHandle handle) {
     DCHECK(thread_checker_.CalledOnValidThread());
     DCHECK(task_runner_->BelongsToCurrentThread());
     thread_task_runner_ = base::ThreadTaskRunnerHandle::Get();
+    base::subtle::Release_Store(&is_thread_task_runner_set_, 1);
+
     connector_.reset(new mojo::Connector(
         std::move(handle), mojo::Connector::SINGLE_THREADED_SEND,
         task_runner_));
     connector_->set_incoming_receiver(&header_validator_);
     connector_->set_connection_error_handler(
         base::Bind(&ChannelAssociatedGroupController::OnPipeError,
                    base::Unretained(this)));
 
     std::vector<std::unique_ptr<mojo::Message>> outgoing_messages;
     std::swap(outgoing_messages, outgoing_messages_);
@@ skipping 274 matching lines @@
     }
 
     DCHECK(endpoints_.empty());
   }
 
   bool IsRunningOnIPCThread() {
     // |task_runner_| is always non-null but may incorrectly report that
     // BelongsToCurrentThread() == false during shutdown. By the time shutdown
     // occurs, |thread_task_runner_| will be non-null and is guaranteed to run
     // tasks on the same thread as |task_runner_|.
-    return task_runner_->BelongsToCurrentThread() ||
-        (thread_task_runner_ && thread_task_runner_->BelongsToCurrentThread());
+    base::subtle::Atomic32 has_thread_task_runner =
+        base::subtle::Acquire_Load(&is_thread_task_runner_set_);
+    if (has_thread_task_runner)
+      return thread_task_runner_->BelongsToCurrentThread();
+    return task_runner_->BelongsToCurrentThread();
   }
 
   bool SendMessage(mojo::Message* message) {
     if (IsRunningOnIPCThread()) {
       DCHECK(thread_checker_.CalledOnValidThread());
       if (!connector_) {
         // Pipe may not be bound yet, so we queue the message.
         std::unique_ptr<mojo::Message> queued_message(new mojo::Message);
         message->MoveTo(queued_message.get());
         outgoing_messages_.emplace_back(std::move(queued_message));
@@ skipping 230 matching lines @@
   base::ThreadChecker thread_checker_;
 
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
   // A TaskRunner that runs tasks on the same thread as |task_runner_| but which
   // is used exclusively to do thread safety checking. This is an unfortunate
   // consequence of bad interaction between some TaskRunner implementations and
   // MessageLoop destruction which may cause the user-provided |task_runner_| to
   // incorrectly report that BelongsToCurrentThread() == false during shutdown.
   scoped_refptr<base::SingleThreadTaskRunner> thread_task_runner_;
+  base::subtle::Atomic32 is_thread_task_runner_set_ = 0;
 
   scoped_refptr<base::SingleThreadTaskRunner> proxy_task_runner_;
   const bool set_interface_id_namespace_bit_;
   std::unique_ptr<mojo::Connector> connector_;
   mojo::MessageHeaderValidator header_validator_;
   mojo::PipeControlMessageHandler control_message_handler_;
   ControlMessageProxyThunk control_message_proxy_thunk_;
   mojo::PipeControlMessageProxy control_message_proxy_;
 
   // Outgoing messages that were sent before this controller was bound to a
@@ skipping 62 matching lines @@
     Channel::Mode mode,
     Delegate* delegate,
     const scoped_refptr<base::SingleThreadTaskRunner>& ipc_task_runner) {
   return base::MakeUnique<MojoBootstrapImpl>(
       std::move(handle), delegate,
       new ChannelAssociatedGroupController(mode == Channel::MODE_SERVER,
                                            ipc_task_runner));
 }
 
 }  // namespace IPC