Fix pending_broker_clients handling am: 743df24d9d am: 7fd4f70940 am: 22d0600745 am: c23d2e6ce4

Original change: https://android-review.googlesource.com/c/platform/external/libchrome/+/1428189

Change-Id: Iae9f037e7a1c81e7e59cf3fd05d91a0414026cba

3 files changed, 49 insertions, 5 deletions

diff --git a/libchrome_tools/patches/0001-Fix-pending_broker_clients-handling.patch b/libchrome_tools/patches/0001-Fix-pending_broker_clients-handling.patch
new file mode 100644
index 0000000000..2402a1097b
--- /dev/null
+++ b/libchrome_tools/patches/0001-Fix-pending_broker_clients-handling.patch
@@ -0,0 +1,44 @@
+From 6a4ab3d6429ec13e8c875ebc611683bb26453770 Mon Sep 17 00:00:00 2001
+From: Lepton Wu <lepton@chromium.org>
+Date: Tue, 15 Sep 2020 16:58:14 +0000
+Subject: [PATCH] Fix pending_broker_clients handling
+
+We always remove invitee from pending_invitations_ before adding it to
+pending_broker_clients, so the old code actually is buggy and invitees
+in pending_broker_clients_ will never be added as a broker client. Fix
+it by checking peers_ instead of pending_invitations_.
+
+BUG=b:146518063,b:150661600,b:168250032,chromium:1121709
+TEST=manual - Keep running arc.Boot.vm with updated mojo code.
+
+Change-Id: Ib0353944e7d5b9edc04947f8bd2db1442a4ed78d
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2411560
+Commit-Queue: Ken Rockot <rockot@google.com>
+Reviewed-by: Ken Rockot <rockot@google.com>
+Auto-Submit: Lepton Wu <lepton@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#807076}
+---
+ mojo/core/node_controller.cc | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/mojo/core/node_controller.cc b/mojo/core/node_controller.cc
+index 298079f4e234..029bd350b08b 100644
+--- a/mojo/core/node_controller.cc
++++ b/mojo/core/node_controller.cc
+@@ -993,11 +993,8 @@ void NodeController::OnAcceptBrokerClient(const ports::NodeName& from_node,
+   // Feed the broker any pending invitees of our own.
+   while (!pending_broker_clients.empty()) {
+     const ports::NodeName& invitee_name = pending_broker_clients.front();
+-    auto it = pending_invitations_.find(invitee_name);
+-    // If for any reason we don't have a pending invitation for the invitee,
+-    // there's nothing left to do: we've already swapped the relevant state into
+-    // the stack.
+-    if (it != pending_invitations_.end()) {
++    auto it = peers_.find(invitee_name);
++    if (it != peers_.end()) {
+       broker->AddBrokerClient(invitee_name,
+                               it->second->CloneRemoteProcessHandle());
+     }
+-- 
+2.28.0.618.gf4bc123cb7-goog
+
diff --git a/libchrome_tools/patches/patches b/libchrome_tools/patches/patches
index eef1769ac0..e27bc7afc7 100644
--- a/libchrome_tools/patches/patches
+++ b/libchrome_tools/patches/patches
@@ -70,3 +70,6 @@ r680000-forward-compatibility-patch-part-2.patch
 
 # Add base/{check_op,notreached}.h for cbor
 Add-header-files-base-check_op-notreached-h.patch
+
+# Remove after uprev to r807076
+0001-Fix-pending_broker_clients-handling.patch
diff --git a/mojo/core/node_controller.cc b/mojo/core/node_controller.cc
index fc65c4d5b6..56b67464fa 100644
--- a/mojo/core/node_controller.cc
+++ b/mojo/core/node_controller.cc
@@ -933,11 +933,8 @@ void NodeController::OnAcceptBrokerClient(const ports::NodeName& from_node,
   // Feed the broker any pending invitees of our own.
   while (!pending_broker_clients.empty()) {
     const ports::NodeName& invitee_name = pending_broker_clients.front();
-    auto it = pending_invitations_.find(invitee_name);
-    // If for any reason we don't have a pending invitation for the invitee,
-    // there's nothing left to do: we've already swapped the relevant state into
-    // the stack.
-    if (it != pending_invitations_.end()) {
+    auto it = peers_.find(invitee_name);
+    if (it != peers_.end()) {
       broker->AddBrokerClient(invitee_name,
                               it->second->CloneRemoteProcessHandle());
     }