MessagePumpAuraX11: Make root_window_dispatchers_ an ObserverList.

Using std::vector caused crashes in cases where a Dispatch call resulted in a Dispatcher being added and that addition provoked reallocation of the vector's storage.  This resulted in a bad iterator dereference in the dispatch loop.

BUG=chrome-os-partner:15544
TEST=Monitor unplugging/power removal still works.  The crash case no longer crashes.

Review URL: https://chromiumcodereview.appspot.com/11593015

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@175452 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 13 insertions, 20 deletions

diff --git a/base/message_pump_aurax11.cc b/base/message_pump_aurax11.cc
index f0eb726..9ba7989 100644
--- a/base/message_pump_aurax11.cc
+++ b/base/message_pump_aurax11.cc
@@ -169,19 +169,12 @@ void MessagePumpAuraX11::RemoveDispatcherForWindow(unsigned long xid) {
 
 void MessagePumpAuraX11::AddDispatcherForRootWindow(
     MessagePumpDispatcher* dispatcher) {
-  DCHECK(std::find(root_window_dispatchers_.begin(),
-                   root_window_dispatchers_.end(),
-                   dispatcher) ==
-         root_window_dispatchers_.end());
-  root_window_dispatchers_.push_back(dispatcher);
+  root_window_dispatchers_.AddObserver(dispatcher);
 }
 
 void MessagePumpAuraX11::RemoveDispatcherForRootWindow(
     MessagePumpDispatcher* dispatcher) {
-  root_window_dispatchers_.erase(
-      std::remove(root_window_dispatchers_.begin(),
-                  root_window_dispatchers_.end(),
-                  dispatcher));
+  root_window_dispatchers_.RemoveObserver(dispatcher);
 }
 
 bool MessagePumpAuraX11::DispatchXEvents() {
@@ -303,11 +296,8 @@ bool MessagePumpAuraX11::Dispatch(const base::NativeEvent& xev) {
   }
 
   if (FindEventTarget(xev) == x_root_window_) {
-    for (Dispatchers::const_iterator it = root_window_dispatchers_.begin();
-         it != root_window_dispatchers_.end();
-         ++it) {
-      (*it)->Dispatch(xev);
-    }
+    FOR_EACH_OBSERVER(MessagePumpDispatcher, root_window_dispatchers_,
+                      Dispatch(xev));
     return true;
   }
   MessagePumpDispatcher* dispatcher = GetDispatcherForXEvent(xev);
diff --git a/base/message_pump_aurax11.h b/base/message_pump_aurax11.h
index 3dbf1a1..486de4f 100644
--- a/base/message_pump_aurax11.h
+++ b/base/message_pump_aurax11.h
@@ -5,15 +5,15 @@
 #ifndef BASE_MESSAGE_PUMP_AURAX11_H
 #define BASE_MESSAGE_PUMP_AURAX11_H
 
+#include <bitset>
+#include <map>
+
 #include "base/memory/scoped_ptr.h"
 #include "base/message_pump.h"
 #include "base/message_pump_glib.h"
 #include "base/message_pump_dispatcher.h"
 #include "base/message_pump_observer.h"
-
-#include <bitset>
-#include <map>
-#include <vector>
+#include "base/observer_list.h"
 
 // It would be nice to include the X11 headers here so that we use Window
 // instead of its typedef of unsigned long, but we can't because everything in
@@ -77,7 +77,6 @@ class BASE_EXPORT MessagePumpAuraX11 : public MessagePumpGlib,
 
  private:
   typedef std::map<unsigned long, MessagePumpDispatcher*> DispatchersMap;
-  typedef std::vector<MessagePumpDispatcher*> Dispatchers;
 
   // Initializes the glib event source for X.
   void InitXSource();
@@ -106,7 +105,11 @@ class BASE_EXPORT MessagePumpAuraX11 : public MessagePumpGlib,
   scoped_ptr<GPollFD> x_poll_;
 
   DispatchersMap dispatchers_;
-  Dispatchers root_window_dispatchers_;
+
+  // Dispatch calls can cause addition of new dispatchers as we iterate
+  // through them. Use ObserverList to ensure the iterator remains valid across
+  // additions.
+  ObserverList<MessagePumpDispatcher> root_window_dispatchers_;
 
   unsigned long x_root_window_;