Mojo Bindings: Fix lock-order inversion in associated controllers

mojo/public/cpp/bindings/lib/multiplex_router.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/public/cpp/bindings/lib/multiplex_router.h"
 
 #include <stdint.h>
 
 #include <utility>
 
@@ skipping 384 matching lines @@
   if (!IsValidInterfaceId(id))
     return;
 
   MayAutoLock locker(lock_.get());
 
   if (!is_local) {
     DCHECK(base::ContainsKey(endpoints_, id));
     DCHECK(!IsMasterInterfaceId(id));
 
     // We will receive a NotifyPeerEndpointClosed message from the other side.
+    MayAutoUnlock unlocker(lock_.get());
     control_message_proxy_.NotifyEndpointClosedBeforeSent(id);
 
     return;
   }
 
   DCHECK(base::ContainsKey(endpoints_, id));
   InterfaceEndpoint* endpoint = endpoints_[id].get();
   DCHECK(!endpoint->client());
   DCHECK(!endpoint->closed());
   UpdateEndpointStateMayRemove(endpoint, ENDPOINT_CLOSED);
 
-  if (!IsMasterInterfaceId(id))
+  if (!IsMasterInterfaceId(id)) {
+    MayAutoUnlock unlocker(lock_.get());
     control_message_proxy_.NotifyPeerEndpointClosed(id);
+  }
 
   ProcessTasks(NO_DIRECT_CLIENT_CALLS, nullptr);
 }
 
 InterfaceEndpointController* MultiplexRouter::AttachEndpointClient(
     const ScopedInterfaceEndpointHandle& handle,
     InterfaceEndpointClient* client,
     scoped_refptr<base::SingleThreadTaskRunner> runner) {
   const InterfaceId id = handle.id();
 
@@ skipping 161 matching lines @@
 bool MultiplexRouter::OnAssociatedEndpointClosedBeforeSent(InterfaceId id) {
   AssertLockAcquired();
 
   if (IsMasterInterfaceId(id))
     return false;
 
   InterfaceEndpoint* endpoint = FindOrInsertEndpoint(id, nullptr);
   DCHECK(!endpoint->closed());
   UpdateEndpointStateMayRemove(endpoint, ENDPOINT_CLOSED);
 
+  MayAutoUnlock unlocker(lock_.get());
   control_message_proxy_.NotifyPeerEndpointClosed(id);
 
   return true;
 }
 
 void MultiplexRouter::OnPipeConnectionError() {
   DCHECK(thread_checker_.CalledOnValidThread());
 
   scoped_refptr<MultiplexRouter> protector(this);
   MayAutoLock locker(lock_.get());
@@ skipping 165 matching lines @@
     UpdateEndpointStateMayRemove(endpoint, ENDPOINT_CLOSED);
 
     // It is also possible that this newly-inserted endpoint is the master
     // endpoint. When the master InterfacePtr/Binding goes away, the message
     // pipe is closed and we explicitly trigger a pipe connection error. The
     // error updates all the endpoints, including the master endpoint, with
     // PEER_ENDPOINT_CLOSED and removes the master endpoint from the
     // registration. We continue to process remaining tasks in the queue, as
     // long as there are refs keeping the router alive. If there are remaining
     // messages for the master endpoint, we will get here.
+    MayAutoUnlock unlocker(lock_.get());
     if (!IsMasterInterfaceId(id))
       control_message_proxy_.NotifyPeerEndpointClosed(id);
     return true;
   }
 
   if (endpoint->closed())
     return true;
 
   if (!endpoint->client()) {
     // We need to wait until a client is attached in order to dispatch further
@@ skipping 105 matching lines @@
 
 void MultiplexRouter::AssertLockAcquired() {
 #if DCHECK_IS_ON()
   if (lock_)
     lock_->AssertAcquired();
 #endif
 }
 
 }  // namespace internal
 }  // namespace mojo