7 files changed, 21 insertions, 30 deletions

diff --git a/base/debug/debugger_posix.cc b/base/debug/debugger_posix.cc
index a5ab066..2df3c4c 100644
--- a/base/debug/debugger_posix.cc
+++ b/base/debug/debugger_posix.cc
@@ -159,6 +159,9 @@ bool DebugUtil::BeingDebugged() {
 
 void BreakDebugger() {
   DEBUG_BREAK();
+#if defined(NDEBUG)
+  _exit(1);
+#endif
 }
 
 }  // namespace debug
diff --git a/base/debug/debugger_win.cc b/base/debug/debugger_win.cc
index d1d47cd..51a067e 100644
--- a/base/debug/debugger_win.cc
+++ b/base/debug/debugger_win.cc
@@ -106,6 +106,9 @@ void BreakDebugger() {
   if (DebugUtil::AreDialogsSuppressed())
     _exit(1);
   __debugbreak();
+#if defined(NDEBUG)
+  _exit(1);
+#endif
 }
 
 }  // namespace debug
diff --git a/base/pickle.cc b/base/pickle.cc
index 3f376e3..7745527 100644
--- a/base/pickle.cc
+++ b/base/pickle.cc
@@ -406,6 +406,9 @@ const char* Pickle::FindNext(size_t header_size,
   DCHECK(header_size == AlignInt(header_size, sizeof(uint32)));
   DCHECK(header_size <= static_cast<size_t>(kPayloadUnit));
 
+  if (static_cast<size_t>(end - start) < sizeof(Header))
+    return NULL;
+
   const Header* hdr = reinterpret_cast<const Header*>(start);
   const char* payload_base = start + header_size;
   const char* payload_end = payload_base + hdr->payload_size;
diff --git a/base/pickle.h b/base/pickle.h
index 6006e62..03f0af1 100644
--- a/base/pickle.h
+++ b/base/pickle.h
@@ -236,6 +236,7 @@ class Pickle {
 
   FRIEND_TEST_ALL_PREFIXES(PickleTest, Resize);
   FRIEND_TEST_ALL_PREFIXES(PickleTest, FindNext);
+  FRIEND_TEST_ALL_PREFIXES(PickleTest, FindNextWithIncompleteHeader);
   FRIEND_TEST_ALL_PREFIXES(PickleTest, IteratorHasRoom);
 };
 
diff --git a/base/pickle_unittest.cc b/base/pickle_unittest.cc
index fdc0664..39eaa1b 100644
--- a/base/pickle_unittest.cc
+++ b/base/pickle_unittest.cc
@@ -171,6 +171,17 @@ TEST(PickleTest, FindNext) {
   EXPECT_TRUE(end == Pickle::FindNext(pickle.header_size_, start, end + 1));
 }
 
+TEST(PickleTest, FindNextWithIncompleteHeader) {
+  size_t header_size = sizeof(Pickle::Header);
+  scoped_array<char> buffer(new char[header_size - 1]);
+  memset(buffer.get(), 0x1, header_size - 1);
+
+  const char* start = buffer.get();
+  const char* end = start + header_size - 1;
+
+  EXPECT_TRUE(NULL == Pickle::FindNext(header_size, start, end));
+}
+
 TEST(PickleTest, IteratorHasRoom) {
   Pickle pickle;
   EXPECT_TRUE(pickle.WriteInt(1));
diff --git a/base/thread.cc b/base/thread.cc
index e9b2bd6..bc715f0 100644
--- a/base/thread.cc
+++ b/base/thread.cc
@@ -81,16 +81,7 @@ bool Thread::StartWithOptions(const Options& options) {
   SetThreadWasQuitProperly(false);
 
   StartupData startup_data(options);
-#ifdef ANDROID
-  {
-    // Use a lock to issue a cpu barrier and force the new thread to load
-    // startup_data_.
-    AutoLock lock(startup_data_lock_);
-    startup_data_ = &startup_data;
-  }
-#else
   startup_data_ = &startup_data;
-#endif
 
   if (!PlatformThread::Create(options.stack_size, this, &thread_)) {
     DLOG(ERROR) << "failed to create thread";
@@ -151,19 +142,8 @@ void Thread::Run(MessageLoop* message_loop) {
 
 void Thread::ThreadMain() {
   {
-#ifdef ANDROID
-    StartupData* startup_data = NULL;
-    {
-      // Use a lock to ensure startup_data_ has been written.
-      AutoLock lock(startup_data_lock_);
-      startup_data = startup_data_;
-    }
-    // The message loop for this thread.
-    MessageLoop message_loop(startup_data->options.message_loop_type);
-#else
     // The message loop for this thread.
     MessageLoop message_loop(startup_data_->options.message_loop_type);
-#endif
 
     // Complete the initialization of our Thread object.
     thread_id_ = PlatformThread::CurrentId();
@@ -177,11 +157,7 @@ void Thread::ThreadMain() {
     // Let's do this before signaling we are started.
     Init();
 
-#ifdef ANDROID
-    startup_data->event.Signal();
-#else
     startup_data_->event.Signal();
-#endif
     // startup_data_ can't be touched anymore since the starting thread is now
     // unlocked.
 
diff --git a/base/thread.h b/base/thread.h
index 45b7ead..fc542f0 100644
--- a/base/thread.h
+++ b/base/thread.h
@@ -8,9 +8,6 @@
 
 #include <string>
 
-#ifdef ANDROID
-#include "base/lock.h"
-#endif
 #include "base/message_loop.h"
 #include "base/message_loop_proxy.h"
 #include "base/platform_thread.h"
@@ -168,9 +165,6 @@ class Thread : PlatformThread::Delegate {
   bool stopping_;
 
   // Used to pass data to ThreadMain.
-#ifdef ANDROID
-  Lock startup_data_lock_;  // protects startup_data_
-#endif
   struct StartupData;
   StartupData* startup_data_;