Web MIDI: MidiManager crashes if a session is ended while initializing

media/midi/midi_manager.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/midi/midi_manager.h"
 
 #include "base/bind.h"
 #include "base/debug/trace_event.h"
 #include "base/message_loop/message_loop.h"
 #include "base/message_loop/message_loop_proxy.h"
@@ skipping 25 matching lines @@
     session_is_ready = initialized_;
     if (!session_is_ready) {
       // Do not accept a new request if the pending client list contains too
       // many clients.
       too_many_pending_clients_exist =
           pending_clients_.size() >= kMaxPendingClientCount;
 
       if (!too_many_pending_clients_exist) {
         // Call StartInitialization() only for the first request.
         session_needs_initialization = pending_clients_.empty();
-        pending_clients_.insert(
-            std::pair<int, MidiManagerClient*>(client_id, client));
+        pending_clients_.insert(std::make_pair(client, client_id));
       }
     }
   }
 
   // Lazily initialize the MIDI back-end.
   if (!session_is_ready) {
     if (session_needs_initialization) {
       TRACE_EVENT0("midi", "MidiManager::StartInitialization");
       session_thread_runner_ =
           base::MessageLoop::current()->message_loop_proxy();
@@ skipping 16 matching lines @@
     base::AutoLock auto_lock(lock_);
     if (result_ == MIDI_OK)
       clients_.insert(client);
     result = result_;
   }
   client->CompleteStartSession(client_id, result);
 }
 
 void MidiManager::EndSession(MidiManagerClient* client) {
   base::AutoLock auto_lock(lock_);
-  ClientList::iterator i = clients_.find(client);
-  if (i != clients_.end())
-    clients_.erase(i);
+  clients_.erase(client);
+  pending_clients_.erase(client);
 }
 
 void MidiManager::DispatchSendMidiData(MidiManagerClient* client,
                                        uint32 port_index,
                                        const std::vector<uint8>& data,
                                        double timestamp) {
   NOTREACHED();
 }
 
 void MidiManager::StartInitialization() {
@@ skipping 28 matching lines @@
 
   for (ClientList::iterator i = clients_.begin(); i != clients_.end(); ++i)
     (*i)->ReceiveMidiData(port_index, data, length, timestamp);
 }
 
 void MidiManager::CompleteInitializationInternal(MidiResult result) {
   TRACE_EVENT0("midi", "MidiManager::CompleteInitialization");
 
   base::AutoLock auto_lock(lock_);
   DCHECK(clients_.empty());
-  DCHECK(!pending_clients_.empty());
   DCHECK(!initialized_);
   initialized_ = true;
   result_ = result;
 
   for (PendingClientMap::iterator it = pending_clients_.begin();
        it != pending_clients_.end();
        ++it) {
     if (result_ == MIDI_OK)
-      clients_.insert(it->second);
-    it->second->CompleteStartSession(it->first, result_);
+      clients_.insert(it->first);
+    it->first->CompleteStartSession(it->second, result_);
   }
   pending_clients_.clear();
 }
 
 }  // namespace media