Fix a use after free crasher in the ReadAsync task initiated on Windows by the FileStream::Context:…

net/base/file_stream_context_win.cc

Index: net/base/file_stream_context_win.cc
diff --git a/net/base/file_stream_context_win.cc b/net/base/file_stream_context_win.cc
index d225ee33a7604887b00963578233271df24191d3..fd1289df52e4f20a5d1cc05eef7e229641605a8b 100644
--- a/net/base/file_stream_context_win.cc
+++ b/net/base/file_stream_context_win.cc
@@ -41,7 +41,10 @@ FileStream::Context::Context(const scoped_refptr<base::TaskRunner>& task_runner)
       async_in_progress_(false),
       orphaned_(false),
       task_runner_(task_runner),
-      weak_ptr_factory_(this) {
+      async_read_initiated_(false),
+      async_read_completed_(false),
+      io_complete_for_read_received_(false),
+      result_(0) {
   io_context_.handler = this;
   memset(&io_context_.overlapped, 0, sizeof(io_context_.overlapped));
 }
@@ -53,7 +56,10 @@ FileStream::Context::Context(base::File file,
       async_in_progress_(false),
       orphaned_(false),
       task_runner_(task_runner),
-      weak_ptr_factory_(this) {
+      async_read_initiated_(false),
+      async_read_completed_(false),
+      io_complete_for_read_received_(false),
+      result_(0) {
   io_context_.handler = this;
   memset(&io_context_.overlapped, 0, sizeof(io_context_.overlapped));
   if (file_.IsValid()) {
@@ -72,24 +78,29 @@ int FileStream::Context::Read(IOBuffer* buf,
   tracked_objects::ScopedTracker tracking_profile(
       FROM_HERE_WITH_EXPLICIT_FUNCTION("423948 FileStream::Context::Read"));
 
-  DCHECK(!async_in_progress_);
+  CHECK(!async_in_progress_);
+  DCHECK(!async_read_initiated_);
+  DCHECK(!async_read_completed_);
+  DCHECK(!io_complete_for_read_received_);
 
   IOCompletionIsPending(callback, buf);
 
-  base::WorkerPool::PostTask(
-      FROM_HERE,
-      base::Bind(&FileStream::Context::ReadAsync,
-                 weak_ptr_factory_.GetWeakPtr(), file_.GetPlatformFile(),
-                 make_scoped_refptr(buf), buf_len, &io_context_.overlapped,
-                 base::MessageLoop::current()->message_loop_proxy()),
-      false);
+  async_read_initiated_ = true;
 
+  task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(&FileStream::Context::ReadAsync, base::Unretained(this),
+                 file_.GetPlatformFile(), make_scoped_refptr(buf), buf_len,
+                 &io_context_.overlapped,
+                 base::MessageLoop::current()->message_loop_proxy()));
   return ERR_IO_PENDING;
 }
 
 int FileStream::Context::Write(IOBuffer* buf,
                                int buf_len,
                                const CompletionCallback& callback) {
+  CHECK(!async_in_progress_);
+
   DWORD bytes_written = 0;
   if (!WriteFile(file_.GetPlatformFile(), buf->data(), buf_len,
                  &bytes_written, &io_context_.overlapped)) {
@@ -140,49 +151,72 @@ void FileStream::Context::OnIOCompleted(
   DCHECK(!callback_.is_null());
   DCHECK(async_in_progress_);
 
-  async_in_progress_ = false;
+  if (!async_read_initiated_)
+    async_in_progress_ = false;
+
   if (orphaned_) {
+    async_in_progress_ = false;
     callback_.Reset();
     in_flight_buf_ = NULL;
     CloseAndDelete();
     return;
   }
 
-  int result;
   if (error == ERROR_HANDLE_EOF) {
-    result = 0;
+    result_ = 0;
   } else if (error) {
     IOResult error_result = IOResult::FromOSError(error);
-    result = static_cast<int>(error_result.result);
+    result_ = static_cast<int>(error_result.result);
   } else {
-    result = bytes_read;
+    result_ = bytes_read;
     IncrementOffset(&io_context_.overlapped, bytes_read);
   }
 
+  if (async_read_initiated_)
+    io_complete_for_read_received_ = true;
+
+  InvokeUserCallback();
+}
+
+void FileStream::Context::InvokeUserCallback() {
+  // For an asynchonous Read operation don't invoke the user callback until
+  // we receive the IO completion notification and the asynchronous Read
+  // completion notification.
+  if (async_read_initiated_) {
+    if (!io_complete_for_read_received_ || !async_read_completed_)
+      return;
+    async_read_initiated_ = false;
+    io_complete_for_read_received_ = false;
+    async_read_completed_ = false;
+    async_in_progress_ = false;
+  }
   CompletionCallback temp_callback = callback_;
   callback_.Reset();
   scoped_refptr<IOBuffer> temp_buf = in_flight_buf_;
   in_flight_buf_ = NULL;
-  temp_callback.Run(result);
+  temp_callback.Run(result_);
 }
 
 // static
 void FileStream::Context::ReadAsync(
-    const base::WeakPtr<FileStream::Context>& context,
+    FileStream::Context* context,
     HANDLE file,
     scoped_refptr<net::IOBuffer> buf,
     int buf_len,
     OVERLAPPED* overlapped,
     scoped_refptr<base::MessageLoopProxy> origin_thread_loop) {
   DWORD bytes_read = 0;
-  if (!ReadFile(file, buf->data(), buf_len, &bytes_read, overlapped)) {
-    origin_thread_loop->PostTask(
-        FROM_HERE, base::Bind(&FileStream::Context::ReadAsyncResult, context,
-                              ::GetLastError()));
-  }
+  BOOL ret = ::ReadFile(file, buf->data(), buf_len, &bytes_read, overlapped);
+  origin_thread_loop->PostTask(
+      FROM_HERE, base::Bind(&FileStream::Context::ReadAsyncResult,
+                            base::Unretained(context), ret ? bytes_read : 0,
+                            ret ? 0 : ::GetLastError()));
 }
 
-void FileStream::Context::ReadAsyncResult(DWORD os_error) {
+void FileStream::Context::ReadAsyncResult(DWORD bytes_read, DWORD os_error) {
+  if (!os_error)
+    result_ = bytes_read;
+
   IOResult error = IOResult::FromOSError(os_error);
   if (error.os_error == ERROR_HANDLE_EOF) {
     // Report EOF by returning 0 bytes read.
@@ -190,10 +224,13 @@ void FileStream::Context::ReadAsyncResult(DWORD os_error) {
   } else if (error.os_error != ERROR_IO_PENDING) {
     // We don't need to inform the caller about ERROR_PENDING_IO as that was
     // already done when the ReadFile call was queued to the worker pool.
-    if (error.os_error)
+    if (error.os_error) {
       LOG(WARNING) << "ReadFile failed: " << error.os_error;
-    OnIOCompleted(&io_context_, 0, error.os_error);
+      OnIOCompleted(&io_context_, 0, error.os_error);
+    }
   }
+  async_read_completed_ = true;
+  InvokeUserCallback();
 }
 
 }  // namespace net