Mojo EDK: Work around Nexus 9 hardware bug

mojo/edk/system/ports/node.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/ports/node.h"
 
 #include <string.h>
 
 #include <utility>
 
@@ skipping 608 matching lines @@
     port->remove_proxy_on_last_message = true;
     port->last_sequence_num_to_receive = last_sequence_num;
   }
   TryRemoveProxy(PortRef(port_name, port));
   return OK;
 }
 
 int Node::OnObserveClosure(const PortName& port_name,
                            uint64_t last_sequence_num) {
   // OK if the port doesn't exist, as it may have been closed already.
-  scoped_refptr<Port> port = GetPort(port_name);
-  if (!port)
+  scoped_refptr<Port> closed_port = GetPort(port_name);
+  if (!closed_port)
     return OK;
 
   // This message tells the port that it should no longer expect more messages
   // beyond last_sequence_num. This message is forwarded along until we reach
   // the receiving end, and this message serves as an equivalent to
   // ObserveProxyAck.
 
   bool notify_delegate = false;
   ObserveClosureEventData forwarded_data;
   NodeName peer_node_name;
   PortName peer_port_name;
+
+  // NOTE: This redundant copy of the scoped_refptr is here as a workaround for
+  // https://crbug.com/665869. Without it a code sequence is generated which
+  // under certain conditions can tickle a Tegra K1 erratum, causing the lock
+  // acquisition below to segfault.
+  scoped_refptr<Port> port = closed_port;

[Torne, 2016/11/18 11:59:56]

Doing this here isn't sufficient - there are also crashes occurring in the other
functions in this file that call GetPort, so whatever weird hack we introduce
should probably be inside GetPort.

It's weird that adding another scoped_refptr here works. I guess it's just
spreading things out enough that the out-of-order execution engine isn't making
whatever mistake it was making any more due to the changed input.

You might find that it's more efficient to add a MemoryBarrier() call somewhere
instead of making an extra refptr. My comment in the bug about creating the
scoped_refptr including a barrier is wrong - incrementing a refcount doesn't use
a barrier, only decrementing does, which doesn't happen until after the bug was
observed - so adding a barrier might be enough.

   bool try_remove_proxy = false;
   {
     base::AutoLock lock(port->lock);
 
     port->peer_closed = true;
     port->last_sequence_num_to_receive = last_sequence_num;
 
     DVLOG(2) << "ObserveClosure at " << port_name << "@" << name_
              << " (state=" << port->state << ") pointing to "
              << port->peer_port_name << "@" << port->peer_node_name
@@ skipping 720 matching lines @@
 
   if (num_data_bytes)
     memcpy(header + 1, data, num_data_bytes);
 
   return message;
 }
 
 }  // namespace ports
 }  // namespace edk
 }  // namespace mojo