Ensure that queued IPC messages can't leak

Assuming based on a small amount of evidence that there may be a bug
causing some ChannelAssociatedGroupController instances to leak, this CL
ensures that in such cases, the object's outgoing message queue will not
also leak.

Bug: 808725
Change-Id: I256dd264b811f9ccb8e8e3ee86f2b58f916f1560
Reviewed-on: https://chromium-review.googlesource.com/902813Reviewed-by: Yuzhu Shen <yzshen@chromium.org>
Commit-Queue: Ken Rockot <rockot@chromium.org>
Cr-Commit-Position: refs/heads/master@{#534693}

ipc/ipc_mojo_bootstrap.cc

@@ -123,9 +123,11 @@ class ChannelAssociatedGroupController
 
   void ShutDown() {
     DCHECK(thread_checker_.CalledOnValidThread());
+    shut_down_ = true;
     connector_->CloseMessagePipe();
     OnPipeError();
     connector_.reset();
+    outgoing_messages_.clear();
   }
 
   // mojo::AssociatedGroupController:
@@ -585,7 +587,8 @@ class ChannelAssociatedGroupController
     if (task_runner_->BelongsToCurrentThread()) {
       DCHECK(thread_checker_.CalledOnValidThread());
       if (!connector_ || paused_) {
-        outgoing_messages_.emplace_back(std::move(*message));
+        if (!shut_down_)
+          outgoing_messages_.emplace_back(std::move(*message));
         return true;
       }
       return connector_->Accept(message);
@@ -869,6 +872,7 @@ class ChannelAssociatedGroupController
   base::Lock lock_;
 
   bool encountered_error_ = false;
+  bool shut_down_ = false;
 
   // ID #1 is reserved for the mojom::Channel interface.
   uint32_t next_interface_id_ = 2;