Fix a race between Channel::Shutdown() and Channel::DetachEndpoint().
commit317a93a4df02f269127cb4267df2555bc19fe12a
authoramistry <amistry@chromium.org>
Wed, 16 Sep 2015 00:13:30 +0000 (15 17:13 -0700)
committerCommit bot <commit-bot@chromium.org>
Wed, 16 Sep 2015 00:14:37 +0000 (16 00:14 +0000)
treefee31a05b8b2da053b389918a789c53b389a45fb
parent5369ffb6cbbbfe8946b75f2312df112693d19a53
Fix a race between Channel::Shutdown() and Channel::DetachEndpoint().

This is a roll of
https://github.com/domokit/mojo/commit/457228e6bee9614d80ee04a98b296f96090304de

Original commit message:
The race is between shutdown and message pipe closing. Closing a message pipe
results in Channel::DetachEndpoint being called. The racing sequence is:
 IO Thread                            Other Thread
                               Channel::DetachEndpoint (return from
                               DetachEndpointInternal)
                               Channel::local_id_to_endpoint_map_ no
                               longer contains the message pipe's
                               endpoint, preventing Channel::Shutdown from
                               blocking on ChannelEndpoint::mutex_ in
                               ChannelEndpoint::DetachFromChannel().
Channel::Shutdown()
delete Channel
                               Channel::SendControlMessage
                               use-after-free

Review URL: https://codereview.chromium.org/1342073002

Cr-Commit-Position: refs/heads/master@{#349040}
third_party/mojo/src/mojo/edk/embedder/embedder_unittest.cc
third_party/mojo/src/mojo/edk/system/channel.cc
third_party/mojo/src/mojo/edk/system/channel_test_base.cc
third_party/mojo/src/mojo/edk/system/channel_test_base.h
third_party/mojo/src/mojo/edk/system/channel_unittest.cc