android: Null check launcher ref on client thread

It is possible to call GetTerminationStatus on the client thread
before start runs on launcher thread. Fix by waiting for post task
to client thread after java launcher reference is set.

Bug: 726426
Change-Id: Ibd999ef7798a7ddf635e58bb0a847cc825f98517
Reviewed-on: https://chromium-review.googlesource.com/668116
Commit-Queue: Bo <boliu@chromium.org>
Reviewed-by: Yaron Friedman <yfriedman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#502871}

content/browser/child_process_launcher_helper.h

@@ -195,6 +195,12 @@ class ChildProcessLauncherHelper :
   static void ForceNormalProcessTerminationSync(
       ChildProcessLauncherHelper::Process process);
 
+#if defined(OS_ANDROID)
+  void set_java_peer_available_on_client_thread() {
+    java_peer_avaiable_on_client_thread_ = true;
+  }
+#endif
+
   const int child_process_id_;
   const BrowserThread::ID client_thread_id_;
   base::TimeTicks begin_launch_time_;
@@ -211,6 +217,7 @@ class ChildProcessLauncherHelper :
 
 #if defined(OS_ANDROID)
   base::android::ScopedJavaGlobalRef<jobject> java_peer_;
+  bool java_peer_avaiable_on_client_thread_ = false;
 #endif
 };
 

content/browser/child_process_launcher_helper_android.cc

@@ -132,6 +132,11 @@ ChildProcessLauncherHelper::LaunchProcessOnLauncherThread(
   java_peer_.Reset(Java_ChildProcessLauncherHelper_createAndStart(
       env, reinterpret_cast<intptr_t>(this), param_key, j_argv, j_file_infos));
   AddRef();  // Balanced by OnChildProcessStarted.
+  BrowserThread::PostTask(
+      client_thread_id_, FROM_HERE,
+      base::Bind(
+          &ChildProcessLauncherHelper::set_java_peer_available_on_client_thread,
+          this));
 
   return Process();
 }
@@ -145,7 +150,8 @@ base::TerminationStatus ChildProcessLauncherHelper::GetTerminationStatus(
     const ChildProcessLauncherHelper::Process& process,
     bool known_dead,
     int* exit_code) {
-  if (Java_ChildProcessLauncherHelper_isOomProtected(AttachCurrentThread(),
+  if (java_peer_avaiable_on_client_thread_ &&
+      Java_ChildProcessLauncherHelper_isOomProtected(AttachCurrentThread(),
                                                      java_peer_)) {
     return base::TERMINATION_STATUS_OOM_PROTECTED;
   }