Protect RefCount manipulation of InterfaceEndpoint with MultiplexRouter lock

mojo/public/cpp/bindings/lib/multiplex_router.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/public/cpp/bindings/lib/multiplex_router.h"
 
 #include <stdint.h>
 
 #include <utility>
 
@@ skipping 156 matching lines @@
     router_->AssertLockAcquired();
 
     DCHECK(!client_);
     DCHECK(closed_);
     DCHECK(peer_closed_);
     DCHECK(!sync_watcher_);
   }
 
   void OnHandleReady(MojoResult result) {
     DCHECK(task_runner_->BelongsToCurrentThread());
-    scoped_refptr<InterfaceEndpoint> self_protector(this);
     scoped_refptr<MultiplexRouter> router_protector(router_);
 
     // Because we never close |sync_message_event_{sender,receiver}_| before
     // destruction or set a deadline, |result| should always be MOJO_RESULT_OK.
     DCHECK_EQ(MOJO_RESULT_OK, result);
-    bool reset_sync_watcher = false;
-    {
-      MayAutoLock locker(router_->lock_.get());
 
-      bool more_to_process = router_->ProcessFirstSyncMessageForEndpoint(id_);
+    MayAutoLock locker(router_->lock_.get());
+    scoped_refptr<InterfaceEndpoint> self_protector(this);
 
-      if (!more_to_process)
-        ResetSyncMessageSignal();
+    bool more_to_process = router_->ProcessFirstSyncMessageForEndpoint(id_);
 
-      // Currently there are no queued sync messages and the peer has closed so
-      // there won't be incoming sync messages in the future.
-      reset_sync_watcher = !more_to_process && peer_closed_;
-    }
-    if (reset_sync_watcher) {
+    if (!more_to_process)
+      ResetSyncMessageSignal();
+
+    // Currently there are no queued sync messages and the peer has closed so
+    // there won't be incoming sync messages in the future.
+    if (!more_to_process && peer_closed_) {
       // If a SyncWatch() call (or multiple ones) of this interface endpoint is
       // on the call stack, resetting the sync watcher will allow it to exit
       // when the call stack unwinds to that frame.
       sync_watcher_.reset();
     }
   }
 
   void EnsureSyncWatcherExists() {
     DCHECK(task_runner_->BelongsToCurrentThread());
     if (sync_watcher_)
@@ skipping 785 matching lines @@
 
 void MultiplexRouter::AssertLockAcquired() {
 #if DCHECK_IS_ON()
   if (lock_)
     lock_->AssertAcquired();
 #endif
 }
 
 }  // namespace internal
 }  // namespace mojo