[Cast Streaming] Fix crash in RemotingSender.

Ensure that queued read tasks don't make use of a null
MojoDataPipeReader.  Also ensure that error_callback_ is invoked at
most once per RemotingSender.

Bug: 1081111
Change-Id: I75d808bf2c7e747d6306543aedcac5ce26acfa97
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2446992
Commit-Queue: mark a. foltz <mfoltz@chromium.org>
Reviewed-by: Yuri Wiitala <miu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#816667}

components/mirroring/service/remoting_sender.cc

@@ -104,6 +104,10 @@ void RemotingSender::ProcessNextInputTask() {
 void RemotingSender::ReadFrame(uint32_t size) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(!is_reading_);
+
+  if (HadError()) {
+    return;
+  }
   if (!data_pipe_reader_->IsPipeValid()) {
     VLOG(1) << "Data pipe handle no longer valid.";
     OnRemotingDataStreamError();
@@ -206,10 +210,16 @@ void RemotingSender::OnInputTaskComplete() {
 }
 
 void RemotingSender::OnRemotingDataStreamError() {
+  // NOTE: This method must be idemptotent as it may be called more than once.
   data_pipe_reader_.reset();
   stream_sender_.reset();
   if (!error_callback_.is_null())
     std::move(error_callback_).Run();
 }
 
+bool RemotingSender::HadError() const {
+  DCHECK_EQ(!data_pipe_reader_, !stream_sender_.is_bound());
+  return !data_pipe_reader_;
+}
+
 }  // namespace mirroring

components/mirroring/service/remoting_sender.h

@@ -81,6 +81,9 @@ class COMPONENT_EXPORT(MIRRORING_SERVICE) RemotingSender final
 
   void OnRemotingDataStreamError();
 
+  // Returns true if OnRemotingDataStreamError was called.
+  bool HadError() const;
+
   SEQUENCE_CHECKER(sequence_checker_);
 
   const base::TickClock* clock_;