Pass reference to matching dictionary in device::HidServiceMac::Connect.

IORegistryGetMatchingService consumes a reference to the matching
dictionary passed to it. Call release() on the ScopedCFTypeRef holding
the dictionary so that the reference is passed to the callee so that it
is not released later causing a crash.

BUG=474820

Review URL: https://codereview.chromium.org/1070423002

Cr-Commit-Position: refs/heads/master@{#324893}

1 files changed, 10 insertions, 2 deletions

diff --git a/device/hid/hid_service_mac.cc b/device/hid/hid_service_mac.cc
index fb12d96..081e668 100644
--- a/device/hid/hid_service_mac.cc
+++ b/device/hid/hid_service_mac.cc
@@ -142,9 +142,17 @@ void HidServiceMac::Connect(const HidDeviceId& device_id,
 
   base::ScopedCFTypeRef<CFDictionaryRef> matching_dict(
       IORegistryEntryIDMatching(device_id));
+  if (!matching_dict.get()) {
+    HID_LOG(EVENT) << "Failed to create matching dictionary for ID: "
+                   << device_id;
+    task_runner_->PostTask(FROM_HERE, base::Bind(callback, nullptr));
+    return;
+  }
 
-  base::mac::ScopedIOObject<io_service_t> service(
-      IOServiceGetMatchingService(kIOMasterPortDefault, matching_dict.get()));
+  // IOServiceGetMatchingService consumes a reference to the matching dictionary
+  // passed to it.
+  base::mac::ScopedIOObject<io_service_t> service(IOServiceGetMatchingService(
+      kIOMasterPortDefault, matching_dict.release()));
   if (!service.get()) {
     HID_LOG(EVENT) << "IOService not found for ID: " << device_id;
     task_runner_->PostTask(FROM_HERE, base::Bind(callback, nullptr));