bluetooth: Require frame to be connected for writValue to succeed.

third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTCharacteristic.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/bluetooth/BluetoothRemoteGATTCharacteristic.h"
 
 #include "bindings/core/v8/CallbackPromiseAdapter.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "core/dom/DOMDataView.h"
@@ skipping 178 matching lines @@
   webbluetooth->readValue(m_webCharacteristic->characteristicInstanceID,
                           new ReadValueCallback(this, resolver));
 
   return promise;
 }
 
 class WriteValueCallback : public WebBluetoothWriteValueCallbacks {
  public:
   WriteValueCallback(BluetoothRemoteGATTCharacteristic* characteristic,
                      ScriptPromiseResolver* resolver)
-      : m_webCharacteristic(characteristic), m_resolver(resolver) {}
+      : m_characteristic(characteristic), m_resolver(resolver) {
+    // We always check that the device is connected before constructing this
+    // object.
+    CHECK(m_characteristic->gatt()->connected());
+    m_characteristic->gatt()->AddToActiveAlgorithms(m_resolver.get());
+  }
 
   void onSuccess(const WebVector<uint8_t>& value) override {
     if (!m_resolver->getExecutionContext() ||
         m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
       return;
 
-    if (m_webCharacteristic) {
-      m_webCharacteristic->setValue(ConvertWebVectorToDataView(value));
+    if (!m_characteristic->gatt()->RemoveFromActiveAlgorithms(
+            m_resolver.get())) {
+      m_resolver->reject(
+          DOMException::create(NetworkError, kGATTServerDisconnected));
+      return;
+    }
+
+    if (m_characteristic) {
+      m_characteristic->setValue(ConvertWebVectorToDataView(value));
     }
     m_resolver->resolve();
   }
 
   void onError(
       int32_t
           error /* Corresponds to WebBluetoothResult in web_bluetooth.mojom */)
       override {
     if (!m_resolver->getExecutionContext() ||
         m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
       return;
+
+    if (!m_characteristic->gatt()->RemoveFromActiveAlgorithms(
+            m_resolver.get())) {
+      m_resolver->reject(
+          DOMException::create(NetworkError, kGATTServerDisconnected));
+      return;
+    }
+
     m_resolver->reject(BluetoothError::take(m_resolver, error));
   }
 
  private:
-  WeakPersistent<BluetoothRemoteGATTCharacteristic> m_webCharacteristic;
+  WeakPersistent<BluetoothRemoteGATTCharacteristic> m_characteristic;
   Persistent<ScriptPromiseResolver> m_resolver;
 };
 
 ScriptPromise BluetoothRemoteGATTCharacteristic::writeValue(
     ScriptState* scriptState,
     const DOMArrayPiece& value) {
+  if (!gatt()->connected()) {
+    return ScriptPromise::rejectWithDOMException(
+        scriptState,
+        DOMException::create(NetworkError, kGATTServerNotConnected));
+  }
+
   WebBluetooth* webbluetooth =
       BluetoothSupplement::fromScriptState(scriptState);
   // Partial implementation of writeValue algorithm:
   // https://webbluetoothchrome.github.io/web-bluetooth/#dom-bluetoothgattcharacteristic-writevalue
 
   // If bytes is more than 512 bytes long (the maximum length of an attribute
   // value, per Long Attribute Values) return a promise rejected with an
   // InvalidModificationError and abort.
   if (value.byteLength() > 512)
     return ScriptPromise::rejectWithDOMException(
@@ skipping 74 matching lines @@
 
 DEFINE_TRACE(BluetoothRemoteGATTCharacteristic) {
   visitor->trace(m_service);
   visitor->trace(m_properties);
   visitor->trace(m_value);
   EventTargetWithInlineData::trace(visitor);
   ActiveDOMObject::trace(visitor);
 }
 
 }  // namespace blink