Fixes leaking transfer objects due to improper USB handle closure.

chrome/browser/usb/usb_device_handle.h

Index: chrome/browser/usb/usb_device_handle.h
diff --git a/chrome/browser/usb/usb_device_handle.h b/chrome/browser/usb/usb_device_handle.h
index a7288884ce7c8b13d50f24147f73105eae9267c3..8bb72151b1b7433be08dba9402f16a42a8e57146 100644
--- a/chrome/browser/usb/usb_device_handle.h
+++ b/chrome/browser/usb/usb_device_handle.h
@@ -25,7 +25,14 @@ typedef libusb_device_handle* PlatformUsbDeviceHandle;
 typedef libusb_iso_packet_descriptor* PlatformUsbIsoPacketDescriptor;
 typedef libusb_transfer* PlatformUsbTransferHandle;
 
+class UsbContext;
+class UsbConfigDescriptor;
 class UsbDevice;
+class UsbInterface;
+
+namespace base {
+  class MessageLoopProxy;
+}  // namespace base
 
 namespace net {
 class IOBuffer;
@@ -54,7 +61,11 @@ class UsbDeviceHandle : public base::RefCountedThreadSafe<UsbDeviceHandle> {
   scoped_refptr<UsbDevice> device() const;
   PlatformUsbDeviceHandle handle() const { return handle_; }
 
-  // Close the USB device and release the underlying platform device.
+  // Notifies UsbDevice to drop the reference of this object; cancels all the
+  // flying transfers.
+  // It is possible that the object has no other reference after this call. So
+  // if it is called using a raw pointer, it could be invalidated.
+  // The platform device handle will be closed when UsbDeviceHandle destructs.
   virtual void Close();
 
   // Device manipulation operations. These methods are blocking and must be
@@ -65,7 +76,7 @@ class UsbDeviceHandle : public base::RefCountedThreadSafe<UsbDeviceHandle> {
       const int interface_number,
       const int alternate_setting);
   virtual bool ResetDevice();
-  bool GetSerial(base::string16* serial);
+  virtual bool GetSerial(base::string16* serial);
 
   // Async IO. Can be called on any thread.
   virtual void ControlTransfer(const UsbEndpointDirection direction,
@@ -102,18 +113,13 @@ class UsbDeviceHandle : public base::RefCountedThreadSafe<UsbDeviceHandle> {
                                    const unsigned int timeout,
                                    const UsbTransferCallback& callback);
 
-  // Normal code should not call this function. It is called by the platform's
-  // callback mechanism in such a way that it cannot be made private. Invokes
-  // the callbacks associated with a given transfer, and removes it from the
-  // in-flight transfer set.
-  void TransferComplete(PlatformUsbTransferHandle transfer);
-
  protected:
   friend class base::RefCountedThreadSafe<UsbDeviceHandle>;
   friend class UsbDevice;
 
   // This constructor is called by UsbDevice.
-  UsbDeviceHandle(UsbDevice* device, PlatformUsbDeviceHandle handle);
+  UsbDeviceHandle(scoped_refptr<UsbContext> context,
+                  UsbDevice* device, PlatformUsbDeviceHandle handle);
 
   // This constructor variant is for use in testing only.
   UsbDeviceHandle();
@@ -122,15 +128,14 @@ class UsbDeviceHandle : public base::RefCountedThreadSafe<UsbDeviceHandle> {
   UsbDevice* device_;
 
  private:
-  struct Transfer {
-    Transfer();
-    ~Transfer();
+  friend void HandleTransferCompletion(PlatformUsbTransferHandle handle);
 
-    UsbTransferType transfer_type;
-    scoped_refptr<net::IOBuffer> buffer;
-    size_t length;
-    UsbTransferCallback callback;
-  };
+  class InterfaceClaimer;
+  struct Transfer;
+
+  // Refresh endpoint_map_ after ClaimInterface, ReleaseInterface and
+  // SetInterfaceAlternateSetting.
+  void RefreshEndpointMap();
 
   // Submits a transfer and starts tracking it. Retains the buffer and copies
   // the completion callback until the transfer finishes, whereupon it invokes
@@ -139,18 +144,33 @@ class UsbDeviceHandle : public base::RefCountedThreadSafe<UsbDeviceHandle> {
                       UsbTransferType transfer_type,
                       net::IOBuffer* buffer,
                       const size_t length,
+                      scoped_refptr<base::MessageLoopProxy> message_loop_proxy,
                       const UsbTransferCallback& callback);
 
-  // Close the current device handle without inform the corresponding UsbDevice.
+  // Invokes the callbacks associated with a given transfer, and removes it from
+  // the in-flight transfer set.
+  void TransferComplete(PlatformUsbTransferHandle transfer);
+
+  // Informs the object to drop internal references.
   void InternalClose();
 
   PlatformUsbDeviceHandle handle_;
 
-  // transfers_ tracks all in-flight transfers associated with this device,
-  // allowing the device to retain the buffer and callback associated with a
-  // transfer until such time that it completes. It is protected by lock_.
-  base::Lock lock_;
-  std::map<PlatformUsbTransferHandle, Transfer> transfers_;
+  scoped_refptr<UsbConfigDescriptor> interfaces_;
+
+  typedef std::map<int, scoped_refptr<InterfaceClaimer> > ClaimedInterfaceMap;
+  ClaimedInterfaceMap claimed_interfaces_;
+
+  typedef std::map<PlatformUsbTransferHandle, Transfer> TransferMap;
+  TransferMap transfers_;
+
+  // A map from endpoints to interfaces
+  typedef std::map<int, int> EndpointMap;
+  EndpointMap endpoint_map_;
+
+  // Retain the UsbContext so that the platform context will not be destroyed
+  // before this handle.
+  scoped_refptr<UsbContext> context_;
 
   base::ThreadChecker thread_checker_;