Fix ThreadSafeAssociatedInterfacePtrProvider raciness.

content/renderer/mojo/thread_safe_associated_interface_ptr_provider.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_RENDERER_MOJO_THREAD_SAFE_ASSOCIATED_INTERFACE_PTR_PROVIDER_H_
 #define CONTENT_RENDERER_MOJO_THREAD_SAFE_ASSOCIATED_INTERFACE_PTR_PROVIDER_H_
 
 #include "base/bind.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ skipping 11 matching lines @@
   // Note that this does not take ownership of |channel_proxy|. It's the
   // caller responsibility to ensure |channel_proxy| outlives this object.
   explicit ThreadSafeAssociatedInterfacePtrProvider(
       IPC::ChannelProxy* channel_proxy)
       : channel_proxy_(channel_proxy) {}
 
   template <typename Interface>
   scoped_refptr<mojo::ThreadSafeAssociatedInterfacePtr<Interface>>
   CreateInterfacePtr() {
     scoped_refptr<mojo::ThreadSafeAssociatedInterfacePtr<Interface>> ptr =
-        mojo::ThreadSafeAssociatedInterfacePtr<Interface>::CreateUnbound();
+        mojo::ThreadSafeAssociatedInterfacePtr<Interface>::CreateUnbound(
+            channel_proxy_->ipc_task_runner());
     channel_proxy_->RetrieveAssociatedInterfaceOnIOThread<Interface>(base::Bind(

[leonhsl(Using Gerrit), 2016/12/30 06:53:15]

I'm not sure I fully understand,, would you please help to clarify this
question? Thanks.
With changes of thread_safe_interface_ptr.h in this CL, here I suppose
ChannelProxy::RetrieveAssociatedInterfaceOnIOThread() is required to post a task
A to ipc task runner, and task A MUST call
ThreadSafeAssociatedInterfacePtrProvider::BindInterfacePtr() *directly* there,
and such scenario is not allowed? : "Task A posts to the same ipc task runner
another task B to call BindInterfacePtr()."

[Jay Civelli, 2017/01/03 16:40:56]

I am not sure I fully understand the question.
The IPC task runner runs on the IO thread, so posting the bind to the IPC task
runner guarantees any calls made on the ThreadSafeAssociatedInterfacePtr (once
it has been returned) will be posted to the same task runner and will happen
after the bind, on the IO thread.

[leonhsl(Using Gerrit), 2017/01/04 03:35:03]

So I suppose the following scenario maybe is not allowed.
After CreateUnbound returned, post a task A to the ipc task runner, but task A
does not execute BindInterfacePtr directly, instead it posts task B to the same
ipc task runner to execute BindInterfacePtr. In such case the returned
ThreadSafeAssociatedInterfacePtr from CreateUnbound() still can not be used to
make any calls at once, is my understanding correct? If so I think it'd better
add some explicit comments about this restriction around CreateUnbound().

         &ThreadSafeAssociatedInterfacePtrProvider::BindInterfacePtr<Interface>,
         ptr));
     return ptr;
   }
 
  private:
   template <typename Interface>
   static void BindInterfacePtr(
       const scoped_refptr<mojo::ThreadSafeAssociatedInterfacePtr<Interface>>&
           ptr,
       mojo::AssociatedInterfacePtr<Interface> interface_ptr) {
     bool success = ptr->Bind(std::move(interface_ptr));
     DCHECK(success);
   }
 
   IPC::ChannelProxy* channel_proxy_;
 
   DISALLOW_COPY_AND_ASSIGN(ThreadSafeAssociatedInterfacePtrProvider);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_RENDERER_MOJO_THREAD_SAFE_ASSOCIATED_INTERFACE_PTR_PROVIDER_H_