Fix potential teardown race conditions with TCPEngineTransport's PostTasks.

blimp/net/tcp_engine_transport.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "blimp/net/tcp_engine_transport.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/callback.h"
 #include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/memory/ptr_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "blimp/net/message_port.h"
 #include "blimp/net/tcp_connection.h"
 #include "net/log/net_log_source.h"
 #include "net/socket/stream_socket.h"
 #include "net/socket/tcp_server_socket.h"
 
 namespace blimp {
 
 TCPEngineTransport::TCPEngineTransport(const net::IPEndPoint& address,
                                        net::NetLog* net_log)
-    : address_(address), net_log_(net_log) {}
+    : address_(address), net_log_(net_log), weak_factory_(this) {}
 
 TCPEngineTransport::~TCPEngineTransport() {}
 
 void TCPEngineTransport::Connect(const net::CompletionCallback& callback) {
   DCHECK(!accepted_socket_);
   DCHECK(!callback.is_null());
 
   if (!server_socket_) {
     server_socket_.reset(
         new net::TCPServerSocket(net_log_, net::NetLogSource()));
     int result = server_socket_->Listen(address_, 5);
     if (result != net::OK) {
       server_socket_.reset();
       base::ThreadTaskRunnerHandle::Get()->PostTask(
           FROM_HERE, base::Bind(callback, result));
       return;
     }
   }
 
   net::CompletionCallback accept_callback = base::Bind(
-      &TCPEngineTransport::OnTCPConnectAccepted, base::Unretained(this));
+      &TCPEngineTransport::OnTCPConnectAccepted, weak_factory_.GetWeakPtr());
 
+  connect_callback_ = callback;

[perumaal, 2016/11/17 22:44:22]

Could you just pass the connect_callback_ as a parameter to OnTCPConnectAccepted
using base::Bind? This gets rid of this temporary yet permanent member variable.
You could remove the weak pointer in this case.

(Case in point:
https://codereview.chromium.org/2509163002/diff/20001/blimp/net/tcp_engine_tr...)

[Kevin M, 2016/11/17 23:02:49]

From the bug:
"TCPEngineTransport::Connect() uses PostTask to complete asynchronously in the
case of the underlying TCP Accept() call completely synchronously, but posts the
completion-callback directly as the task.  This means that tearing down the
Transport may still leave the completion callback in-flight, which callers would
not typically expect to be the case."

[Kevin M, 2016/11/17 23:05:41]

Sorry, I misread. Yes, I can move the callback as a bound param. Can't remove
the weak pointer, though - it guarantees that the callback is only invoked if
|this| is alive.

   int result = server_socket_->Accept(&accepted_socket_, accept_callback);
   if (result == net::ERR_IO_PENDING) {
-    connect_callback_ = callback;
     return;
   }
 
-  if (result != net::OK) {
-    server_socket_.reset();
-  }
-
-  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
-                                                base::Bind(callback, result));
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE, base::Bind(&TCPEngineTransport::OnTCPConnectAccepted,
+                            weak_factory_.GetWeakPtr(), result));
 }
 
 std::unique_ptr<MessagePort> TCPEngineTransport::TakeMessagePort() {
   DCHECK(connect_callback_.is_null());
   DCHECK(accepted_socket_);
   return MessagePort::CreateForStreamSocketWithCompression(
       std::move(accepted_socket_));
 }
 
 std::unique_ptr<BlimpConnection> TCPEngineTransport::MakeConnection() {
   return base::MakeUnique<TCPConnection>(TakeMessagePort());
 }
 
 const char* TCPEngineTransport::GetName() const {
   return "TCP";
 }
 
 void TCPEngineTransport::GetLocalAddress(net::IPEndPoint* address) const {
   DCHECK(server_socket_);
   server_socket_->GetLocalAddress(address);
 }
 
 void TCPEngineTransport::OnTCPConnectAccepted(int result) {
   DCHECK_NE(net::ERR_IO_PENDING, result);
   DCHECK(accepted_socket_);
   if (result != net::OK) {
+    server_socket_.reset();
     accepted_socket_.reset();
   }
   base::ResetAndReturn(&connect_callback_).Run(result);
 }
 
 }  // namespace blimp