HTML MessagePort as mojo::MessagePipeHandle

content/renderer/shared_worker/embedded_shared_worker_stub.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/shared_worker/embedded_shared_worker_stub.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/threading/thread_task_runner_handle.h"
@@ skipping 174 matching lines @@
   Send(new WorkerHostMsg_WorkerReadyForInspection(route_id_));
 }
 
 void EmbeddedSharedWorkerStub::workerScriptLoaded() {
   Send(new WorkerHostMsg_WorkerScriptLoaded(route_id_));
   running_ = true;
   // Process any pending connections.
   for (PendingChannelList::const_iterator iter = pending_channels_.begin();
        iter != pending_channels_.end();
        ++iter) {
-    ConnectToChannel(*iter);
+    ConnectToChannel(iter->first, iter->second);
   }
   pending_channels_.clear();
 }
 
 void EmbeddedSharedWorkerStub::workerScriptLoadFailed() {
   Send(new WorkerHostMsg_WorkerScriptLoadFailed(route_id_));
   for (PendingChannelList::const_iterator iter = pending_channels_.begin();
        iter != pending_channels_.end();
        ++iter) {
-    blink::WebMessagePortChannel* channel = *iter;
-    channel->destroy();
+    delete iter->second;
   }
   pending_channels_.clear();
   Shutdown();
 }
 
 void EmbeddedSharedWorkerStub::workerContextClosed() {
   Send(new WorkerHostMsg_WorkerContextClosed(route_id_));
 }
 
 void EmbeddedSharedWorkerStub::workerContextDestroyed() {
@@ skipping 73 matching lines @@
   // when this is called.
   impl_ = nullptr;
   delete this;
 }
 
 bool EmbeddedSharedWorkerStub::Send(IPC::Message* message) {
   return RenderThreadImpl::current()->Send(message);
 }
 
 void EmbeddedSharedWorkerStub::ConnectToChannel(
+    int connection_request_id,
     WebMessagePortChannelImpl* channel) {
   impl_->connect(channel);

[Ken Rockot(use gerrit already), 2017/01/23 23:20:41]

I think we should send the WorkerConnected message first, or at least cache the
message_port_id locally first. Unless I'm misunderstanding something, connect()
appears to take ownership of |channel| and pass it to another thread, which
could in theory then free |channel| before our next (totally unsafe) access
below.

-  Send(
-      new WorkerHostMsg_WorkerConnected(channel->message_port_id(), route_id_));
+  Send(new WorkerHostMsg_WorkerConnected(connection_request_id, route_id_));
 }
 
-void EmbeddedSharedWorkerStub::OnConnect(int port,
-                                         int routing_id) {
-  WebMessagePortChannelImpl* channel = new WebMessagePortChannelImpl(
-      routing_id, port, base::ThreadTaskRunnerHandle::Get().get());
+void EmbeddedSharedWorkerStub::OnConnect(int connection_request_id,
+                                         const MessagePort& port) {
+  WebMessagePortChannelImpl* channel = new WebMessagePortChannelImpl(port);
   if (running_) {
-    ConnectToChannel(channel);
+    ConnectToChannel(connection_request_id, channel);
   } else {
     // If two documents try to load a SharedWorker at the same time, the
     // WorkerMsg_Connect for one of the documents can come in before the
     // worker is started. Just queue up the connect and deliver it once the
     // worker starts.
-    pending_channels_.push_back(channel);
+    pending_channels_.push_back(std::make_pair(connection_request_id, channel));
   }
 }
 
 void EmbeddedSharedWorkerStub::OnTerminateWorkerContext() {
   // After this we wouldn't get any IPC for this stub.
   running_ = false;
   impl_->terminateWorkerContext();
 }
 
 }  // namespace content