bluetooth: Fix crash when a notification arrives during a write

device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "device/bluetooth/bluetooth_remote_gatt_characteristic_mac.h"
 
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ skipping 52 matching lines @@
     result |= BluetoothGattCharacteristic::PROPERTY_INDICATE;
   }
   return result;
 }
 }  // namespace
 
 BluetoothRemoteGattCharacteristicMac::BluetoothRemoteGattCharacteristicMac(
     BluetoothRemoteGattServiceMac* gatt_service,
     CBCharacteristic* cb_characteristic)
     : gatt_service_(gatt_service),
-      cb_characteristic_(cb_characteristic, base::scoped_policy::RETAIN),
-      characteristic_value_read_or_write_in_progress_(false) {
+      cb_characteristic_(cb_characteristic, base::scoped_policy::RETAIN) {
   uuid_ = BluetoothAdapterMac::BluetoothUUIDWithCBUUID(
       [cb_characteristic_.get() UUID]);
   identifier_ = base::SysNSStringToUTF8(
       [NSString stringWithFormat:@"%s-%p", uuid_.canonical_value().c_str(),
                                  (void*)cb_characteristic_]);
 }
 
 BluetoothRemoteGattCharacteristicMac::~BluetoothRemoteGattCharacteristicMac() {
-  if (!read_characteristic_value_callbacks_.first.is_null()) {
+  if (HasPendingRead()) {
     std::pair<ValueCallback, ErrorCallback> callbacks;
     callbacks.swap(read_characteristic_value_callbacks_);
     callbacks.second.Run(BluetoothGattService::GATT_ERROR_FAILED);
   }
-  if (!write_characteristic_value_callbacks_.first.is_null()) {
+  if (HasPendingWrite()) {
     std::pair<base::Closure, ErrorCallback> callbacks;
     callbacks.swap(write_characteristic_value_callbacks_);
     callbacks.second.Run(BluetoothGattService::GATT_ERROR_FAILED);
   }
 }
 
 std::string BluetoothRemoteGattCharacteristicMac::GetIdentifier() const {
   return identifier_;
 }
 
@@ skipping 53 matching lines @@
     const ValueCallback& callback,
     const ErrorCallback& error_callback) {
   if (!IsReadable()) {
     VLOG(1) << *this << ": Characteristic not readable.";
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE,
         base::Bind(error_callback,
                    BluetoothRemoteGattService::GATT_ERROR_NOT_SUPPORTED));
     return;
   }
-  if (characteristic_value_read_or_write_in_progress_) {
+  if (HasPendingRead() || HasPendingWrite()) {
     VLOG(1) << *this << ": Characteristic read already in progress.";
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE,
         base::Bind(error_callback,
                    BluetoothRemoteGattService::GATT_ERROR_IN_PROGRESS));
     return;
   }
   VLOG(1) << *this << ": Read characteristic.";
-  characteristic_value_read_or_write_in_progress_ = true;
   read_characteristic_value_callbacks_ =
       std::make_pair(callback, error_callback);
   [GetCBPeripheral() readValueForCharacteristic:cb_characteristic_];
 }
 
 void BluetoothRemoteGattCharacteristicMac::WriteRemoteCharacteristic(
     const std::vector<uint8_t>& value,
     const base::Closure& callback,
     const ErrorCallback& error_callback) {
   if (!IsWritable()) {
     VLOG(1) << *this << ": Characteristic not writable.";
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE,
         base::Bind(error_callback,
                    BluetoothRemoteGattService::GATT_ERROR_NOT_PERMITTED));
     return;
   }
-  if (characteristic_value_read_or_write_in_progress_) {
+  if (HasPendingRead() || HasPendingWrite()) {
     VLOG(1) << *this << ": Characteristic write already in progress.";
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE,
         base::Bind(error_callback,
                    BluetoothRemoteGattService::GATT_ERROR_IN_PROGRESS));
     return;
   }
   VLOG(1) << *this << ": Write characteristic.";
-  characteristic_value_read_or_write_in_progress_ = true;
   write_characteristic_value_callbacks_ =
       std::make_pair(callback, error_callback);
   base::scoped_nsobject<NSData> nsdata_value(
       [[NSData alloc] initWithBytes:value.data() length:value.size()]);
   CBCharacteristicWriteType write_type = GetCBWriteType();
   [GetCBPeripheral() writeValue:nsdata_value
               forCharacteristic:cb_characteristic_
                            type:write_type];
   if (write_type == CBCharacteristicWriteWithoutResponse) {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ skipping 37 matching lines @@
   VLOG(1) << *this << ": Discover descriptors.";
   is_discovery_complete_ = false;
   [GetCBPeripheral()
       discoverDescriptorsForCharacteristic:cb_characteristic_.get()];
 }
 
 void BluetoothRemoteGattCharacteristicMac::DidUpdateValue(NSError* error) {
   CHECK_EQ(GetCBPeripheral().state, CBPeripheralStateConnected);
   // This method is called when the characteristic is read and when a
   // notification is received.
-  if (characteristic_value_read_or_write_in_progress_) {
+  if (HasPendingRead()) {
     std::pair<ValueCallback, ErrorCallback> callbacks;
     callbacks.swap(read_characteristic_value_callbacks_);
-    characteristic_value_read_or_write_in_progress_ = false;
     if (error) {
       BluetoothGattService::GattErrorCode error_code =
           BluetoothDeviceMac::GetGattErrorCodeFromNSError(error);
       VLOG(1) << *this
               << ": Bluetooth error while reading for characteristic, domain: "
               << BluetoothAdapterMac::String(error)
               << ", error code: " << error_code;
       callbacks.second.Run(error_code);
       return;
     }
@@ skipping 16 matching lines @@
 }
 
 void BluetoothRemoteGattCharacteristicMac::UpdateValue() {
   NSData* nsdata_value = cb_characteristic_.get().value;
   const uint8_t* buffer = static_cast<const uint8_t*>(nsdata_value.bytes);
   value_.assign(buffer, buffer + nsdata_value.length);
 }
 
 void BluetoothRemoteGattCharacteristicMac::DidWriteValue(NSError* error) {
   CHECK_EQ(GetCBPeripheral().state, CBPeripheralStateConnected);
-  if (!characteristic_value_read_or_write_in_progress_) {
+  if (!HasPendingWrite()) {
     // In case of buggy device, nothing should be done if receiving extra
     // write confirmation.
     VLOG(1) << *this
             << ": Write notification while no write operation pending.";
     return;
   }
   std::pair<base::Closure, ErrorCallback> callbacks;
   callbacks.swap(write_characteristic_value_callbacks_);
-  characteristic_value_read_or_write_in_progress_ = false;
   if (error) {
     BluetoothGattService::GattErrorCode error_code =
         BluetoothDeviceMac::GetGattErrorCodeFromNSError(error);
     VLOG(1) << *this
             << ": Bluetooth error while writing for characteristic, error: "
             << BluetoothAdapterMac::String(error)
             << ", error code: " << error_code;
     callbacks.second.Run(error_code);
     return;
   }
@@ skipping 131 matching lines @@
   const BluetoothRemoteGattServiceMac* service_mac =
       static_cast<const BluetoothRemoteGattServiceMac*>(
           characteristic.GetService());
   return out << "<BluetoothRemoteGattCharacteristicMac "
              << characteristic.GetUUID().canonical_value() << "/"
              << &characteristic
              << ", service: " << service_mac->GetUUID().canonical_value() << "/"
              << service_mac << ">";
 }
 }  // namespace device.