Make HidConnection::Read reentrancy safe

device/hid/hid_connection_mac.cc

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "device/hid/hid_connection_mac.h"
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/mac/foundation_util.h"
 #include "base/numerics/safe_math.h"
@@ skipping 134 matching lines @@
     buffer->data()[0] = 0;
     memcpy(buffer->data() + 1, report_bytes, report_length);
   }
 
   connection->ProcessInputReport(buffer);
 }
 
 void HidConnectionMac::ProcessInputReport(
     scoped_refptr<net::IOBufferWithSize> buffer) {
   DCHECK(thread_checker().CalledOnValidThread());
+  DCHECK_GE(buffer->size(), 1);
+
+  uint8_t report_id = buffer->data()[0];
+  if (IsReportIdProtected(report_id))
+    return;
+
   PendingHidReport report;
   report.buffer = buffer;
   report.size = buffer->size();
   pending_reports_.push(report);
   ProcessReadQueue();
 }
 
 void HidConnectionMac::ProcessReadQueue() {
   DCHECK(thread_checker().CalledOnValidThread());
+
+  // Hold a reference to |this| to prevent a callback from freeing this object
+  // during the loop.
+  scoped_refptr<HidConnectionMac> self(this);
   while (pending_reads_.size() && pending_reports_.size()) {
     PendingHidRead read = pending_reads_.front();
     PendingHidReport report = pending_reports_.front();
 
+    pending_reads_.pop();
     pending_reports_.pop();
-    if (CompleteRead(report.buffer, report.size, read.callback)) {
-      pending_reads_.pop();
-    }
+    read.callback.Run(true, report.buffer, report.size);
   }
 }
 
 void HidConnectionMac::GetFeatureReportAsync(uint8_t report_id,
                                              const ReadCallback& callback) {
   scoped_refptr<net::IOBufferWithSize> buffer(
       new net::IOBufferWithSize(device_info()->max_feature_report_size() + 1));
   CFIndex report_size = buffer->size();
 
   // The IOHIDDevice object is shared with the UI thread and so this function
@@ skipping 55 matching lines @@
                                       this,
                                       base::Bind(callback, false)));
   }
 }
 
 void HidConnectionMac::ReturnAsyncResult(const base::Closure& callback) {
   callback.Run();
 }
 
 }  // namespace device