Add lock annotation to MessageQuotaChecker.

Also CHECK on the result of setting the quota on the message pipe,
as well as on the set quota on query.

Bug: 1011441
Change-Id: If256de260ede9613b84296cc8edc0277bfba57ee
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2022926
Commit-Queue: Sigurður Ásgeirsson <siggi@chromium.org>
Reviewed-by: Ken Rockot <rockot@google.com>
Cr-Commit-Position: refs/heads/master@{#735511}

mojo/public/cpp/bindings/lib/message_quota_checker.cc

@@ -133,7 +133,8 @@ void MessageQuotaChecker::SetMessagePipe(MessagePipeHandle message_pipe) {
   MojoResult rv =
       MojoSetQuota(message_pipe.value(), MOJO_QUOTA_TYPE_UNREAD_MESSAGE_COUNT,
                    config_->unread_message_count_quota, nullptr);
-  DCHECK_EQ(MOJO_RESULT_OK, rv);
+  // TODO(https://crbug.com/1011441): Revert this to a DCHECK.
+  CHECK_EQ(MOJO_RESULT_OK, rv);
 }
 
 size_t MessageQuotaChecker::GetCurrentQuotaStatusForTesting() {
@@ -203,6 +204,8 @@ base::Optional<size_t> MessageQuotaChecker::GetCurrentMessagePipeQuota() {
   MojoResult rv = MojoQueryQuota(message_pipe_.value(),
                                  MOJO_QUOTA_TYPE_UNREAD_MESSAGE_COUNT, nullptr,
                                  &limit, &usage);
+  // TODO(https://crbug.com/1011441): Change to a DCHECK.
+  CHECK_NE(MOJO_QUOTA_LIMIT_NONE, limit);
   return rv == MOJO_RESULT_OK ? usage : 0u;
 }
 

mojo/public/cpp/bindings/lib/message_quota_checker.h

@@ -12,6 +12,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/optional.h"
 #include "base/synchronization/lock.h"
+#include "base/thread_annotations.h"
 #include "base/time/time.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 
@@ -113,8 +114,6 @@ class COMPONENT_EXPORT(MOJO_CPP_BINDINGS) MessageQuotaChecker
   // The time ticks when this instance was created.
   const base::TimeTicks creation_time_;
 
-  // Locks all local state.
-  base::Lock lock_;
 
   // Cumulative counts for the number of messages enqueued with
   // |BeforeMessagesEnqueued()| and dequeued with |BeforeMessagesDequeued()|.
@@ -122,16 +121,19 @@ class COMPONENT_EXPORT(MOJO_CPP_BINDINGS) MessageQuotaChecker
   std::atomic<uint64_t> messages_dequeued_{0};
   std::atomic<uint64_t> messages_written_{0};
 
+  // Guards all state below here.
+  base::Lock lock_;
+
   // A decaying average of the rate of call to BeforeWrite per second.
-  DecayingRateAverage write_rate_average_;
+  DecayingRateAverage write_rate_average_ GUARDED_BY(lock_);
 
   // The locally consumed quota, e.g. the difference between the counts passed
   // to |BeforeMessagesEnqueued()| and |BeforeMessagesDequeued()|.
-  size_t consumed_quota_ = 0u;
+  size_t consumed_quota_ GUARDED_BY(lock_) = 0u;
   // The high watermark consumed quota observed.
-  size_t max_consumed_quota_ = 0u;
+  size_t max_consumed_quota_ GUARDED_BY(lock_) = 0u;
   // The message pipe this instance observes, if any.
-  MessagePipeHandle message_pipe_;
+  MessagePipeHandle message_pipe_ GUARDED_BY(lock_);
 };
 
 struct MessageQuotaChecker::Configuration {