TCPSocket/UDPSocket: don't update internal state or access user buffers after Close().

ppapi/shared_impl/tcp_socket_shared.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/shared_impl/tcp_socket_shared.h"
 
 #include <string.h>
 
 #include <algorithm>
 
@@ skipping 26 matching lines @@
   Init(socket_id);
 }
 
 TCPSocketShared::~TCPSocketShared() {
 }
 
 void TCPSocketShared::OnConnectCompleted(
     int32_t result,
     const PP_NetAddress_Private& local_addr,
     const PP_NetAddress_Private& remote_addr) {
+  // It is possible that |connect_callback_| is pending while
+  // |connection_state_| is not BEFORE_CONNECT: DisconnectImpl() has been
+  // called, but a ConnectCompleted notification came earlier than the task to
+  // abort |connect_callback_|. We don't want to update |connection_state_| or
+  // other members in that case.
   if (connection_state_ != BEFORE_CONNECT ||
       !TrackedCallback::IsPending(connect_callback_)) {
-    NOTREACHED();
     return;
   }
 
   result = OverridePPError(result);
   if (result == PP_OK) {
     local_addr_ = local_addr;
     remote_addr_ = remote_addr;
     connection_state_ = CONNECTED;
   }
   connect_callback_->Run(result);
 }
 
 void TCPSocketShared::OnSSLHandshakeCompleted(
     bool succeeded,
     const PPB_X509Certificate_Fields& certificate_fields) {
+  // It is possible that |ssl_handshake_callback_| is pending while
+  // |connection_state_| is not CONNECT: DisconnectImpl() has been
+  // called, but a SSLHandshakeCompleted notification came earlier than the task
+  // to abort |ssl_handshake_callback_|. We don't want to update
+  // |connection_state_| or other members in that case.
   if (connection_state_ != CONNECTED ||
       !TrackedCallback::IsPending(ssl_handshake_callback_)) {
-    NOTREACHED();
     return;
   }
 
   if (succeeded) {
     connection_state_ = SSL_CONNECTED;
     server_certificate_ = new PPB_X509Certificate_Private_Shared(
         resource_type_,
         GetOwnerResource()->pp_instance(),
         certificate_fields);
     ssl_handshake_callback_->Run(PP_OK);
   } else {
     // The resource might be released in the callback so we need to hold
     // a reference so we can Disconnect() first.
     GetOwnerResource()->AddRef();
     ssl_handshake_callback_->Run(PP_ERROR_FAILED);
     DisconnectImpl();
     GetOwnerResource()->Release();
   }
 }
 
 void TCPSocketShared::OnReadCompleted(int32_t result,
                                       const std::string& data) {
-  if (!TrackedCallback::IsPending(read_callback_) || !read_buffer_) {
-    NOTREACHED();
+  // It is possible that |read_callback_| is pending while |read_buffer_| is
+  // NULL: DisconnectImpl() has been called, but a ReadCompleted notification
+  // came earlier than the task to abort |read_callback_|. We shouldn't access
+  // the buffer in that case. The user may have released it.
+  if (!TrackedCallback::IsPending(read_callback_) || !read_buffer_)
     return;
-  }
 
   result = OverridePPError(result);
   bool succeeded = result == PP_OK;
   if (succeeded) {
     CHECK_LE(static_cast<int32_t>(data.size()), bytes_to_read_);
     if (!data.empty())
       memcpy(read_buffer_, data.c_str(), data.size());
   }
   read_buffer_ = NULL;
   bytes_to_read_ = -1;
 
   read_callback_->Run(
       succeeded ? static_cast<int32_t>(data.size()) : result);
 }
 
 void TCPSocketShared::OnWriteCompleted(int32_t result) {
-  if (!TrackedCallback::IsPending(write_callback_)) {
-    NOTREACHED();
+  if (!TrackedCallback::IsPending(write_callback_))
     return;
-  }
 
   result = OverridePPError(result);
   write_callback_->Run(result);
 }
 
 void TCPSocketShared::OnSetOptionCompleted(int32_t result) {
   if (set_option_callbacks_.empty()) {
     NOTREACHED();
     return;
   }
@@ skipping 231 matching lines @@
   return connection_state_ == CONNECTED || connection_state_ == SSL_CONNECTED;
 }
 
 void TCPSocketShared::PostAbortIfNecessary(
     scoped_refptr<TrackedCallback>* callback) {
   if (TrackedCallback::IsPending(*callback))
     (*callback)->PostAbort();
 }
 
 }  // namespace ppapi