Fix a race in the creation of HidConnectionLinux::Helper.

The creation of this object on the FILE thread races with the possible
destruction of the object on the UI thread. The scoped_ptr<> that owns
the pointer may try to destroy the object on the UI thread if the
connection is closed before the helper is started. Generally, updating
the helper_ pointer from the FILE thread is a bad idea.

This patch moves creation of the helper to the UI thread, it is then
detached from that thread when it is started. The HidConnectionLinux no
longer uses a scoped_ptr<> to hold it and instead must always free it
explicitly with DeleteSoon.

BUG=

Review URL: https://codereview.chromium.org/786343003

Cr-Commit-Position: refs/heads/master@{#307850}

1 files changed, 2 insertions, 6 deletions

diff --git a/device/hid/hid_connection_linux.h b/device/hid/hid_connection_linux.h
index d6befe4..13a7165 100644
--- a/device/hid/hid_connection_linux.h
+++ b/device/hid/hid_connection_linux.h
@@ -20,7 +20,7 @@ namespace device {
 class HidConnectionLinux : public HidConnection {
  public:
   HidConnectionLinux(
-      HidDeviceInfo device_info,
+      const HidDeviceInfo& device_info,
       base::File device_file,
       scoped_refptr<base::SingleThreadTaskRunner> file_thread_runner);
 
@@ -56,10 +56,6 @@ class HidConnectionLinux : public HidConnection {
                               int result);
   void FinishSendFeatureReport(const WriteCallback& callback, int result);
 
-  // Starts the FileDescriptorWatcher that reads input events from the device.
-  // Must be called on a thread that has a base::MessageLoopForIO.
-  void StartHelper(base::WeakPtr<HidConnectionLinux> weak_ptr);
-
   // Writes to the device. This operation may block.
   static void BlockingWrite(
       base::PlatformFile platform_file,
@@ -82,7 +78,7 @@ class HidConnectionLinux : public HidConnection {
   void ProcessReadQueue();
 
   base::File device_file_;
-  scoped_ptr<Helper> helper_;
+  Helper* helper_;
 
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   scoped_refptr<base::SingleThreadTaskRunner> file_task_runner_;