[CrOS MultiDevice] Fix crash in BleConnectionManagerImpl.

When a SecureChannel disconnects due to authentication failures,
BleConnectionManagerImpl invokes the relevant failure callback, which
then causes ConnectionAttemptBase to cancel the connection attempt.

When the attempt is cancelled, the SecureChannel object is deleted via
BleConnectionManagerImpl::ProcessPotentialLingeringChannel(), but
BleConnectionManagerImpl::HandleSecureChannelDisconnection() assumed
that the object was still valid and tried to to remove itself as an
observer, causing a segfault.

The fix is to check whether the object has been deleted before
attempting to call RemoveObserver().

Bug: 905904
Change-Id: Ic593ef4047ff481e218c89028324eb0863131cdc
Reviewed-on: https://chromium-review.googlesource.com/c/1352855Reviewed-by: Ryan Hansberry <hansberry@chromium.org>
Commit-Queue: Kyle Horimoto <khorimoto@chromium.org>
Cr-Commit-Position: refs/heads/master@{#611781}

chromeos/services/secure_channel/ble_connection_manager_impl.cc

@@ -503,6 +503,15 @@ void BleConnectionManagerImpl::HandleSecureChannelDisconnection(
   // connection's latency should be reset and started anew.
   remote_device_id_to_timestamps_map_[remote_device_id]->Reset();
 
+  if (!DoesAuthenticatingChannelExist(remote_device_id)) {
+    PA_LOG(ERROR) << "BleConnectionManagerImpl::"
+                  << "HandleSecureChannelDisconnection(): Disconnected channel "
+                  << "not present in map. Remote device ID: "
+                  << cryptauth::RemoteDeviceRef::TruncateDeviceIdForLogs(
+                         remote_device_id);
+    NOTREACHED();
+  }
+
   for (const auto& details : GetDetailsForRemoteDevice(remote_device_id)) {
     switch (details.connection_role()) {
       // Initiator role devices are notified of authentication errors as well as
@@ -525,10 +534,19 @@ void BleConnectionManagerImpl::HandleSecureChannelDisconnection(
     }
   }
 
+  // It is possible that the NotifyBle*Failure() calls above resulted in
+  // observers responding to the failure by canceling the connection attempt.
+  // If all attempts to |remote_device_id| were cancelled, the disconnected
+  // channel will have already been cleaned up via
+  // ProcessPotentialLingeringChannel().
+  auto it = remote_device_id_to_secure_channel_map_.find(remote_device_id);
+  if (it == remote_device_id_to_secure_channel_map_.end())
+    return;
+
   // Stop observing the disconnected channel and remove it from the map.
-  remote_device_id_to_secure_channel_map_[remote_device_id]
-      .first->RemoveObserver(this);
-  remote_device_id_to_secure_channel_map_.erase(remote_device_id);
+  SecureChannelWithRole& secure_channel_with_role = it->second;
+  secure_channel_with_role.first->RemoveObserver(this);
+  remote_device_id_to_secure_channel_map_.erase(it);
 
   // Since the previous connection failed, the connection attempts that were
   // paused in SetAuthenticatingChannel() need to be started up again. Note