Fix FD leak in mojo::DataPipeProducer

data_source_ should be guaranteed to be release after
DataPipeProducer::Cancel() triggered,
This ensures that DataPipeProducer destruction eventually leads to
teardown of the corresponding SequenceState object.

Bug: 1095883
Change-Id: Ibf1d5787a57ae5da9eaa24e25e1e72c1a3a9907c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2245987
Commit-Queue: Ken Rockot <rockot@google.com>
Reviewed-by: Ken Rockot <rockot@google.com>
Cr-Commit-Position: refs/heads/master@{#780053}

AUTHORS

@@ -311,6 +311,7 @@ Francois Marier <francois@brave.com>
 Francois Rauch <leopardb@gmail.com>
 Frankie Dintino <fdintino@theatlantic.com>
 Franklin Ta <fta2012@gmail.com>
+Fred Ranking <luliang14@huawei.com>
 Frédéric Jacob <frederic.jacob.78@gmail.com>
 Frédéric Wang <fred.wang@free.fr>
 Fu Junwei <junwei.fu@intel.com>

mojo/public/cpp/system/data_pipe_producer.cc

@@ -53,6 +53,8 @@ class DataPipeProducer::SequenceState
   void Cancel() {
     base::AutoLock lock(lock_);
     is_cancelled_ = true;
+    owning_task_runner()->PostTask(
+        FROM_HERE, base::BindOnce(&SequenceState::CancelOnSequence, this));
   }
 
   void Start(std::unique_ptr<DataSource> data_source) {
@@ -151,6 +153,13 @@ class DataPipeProducer::SequenceState
                                   std::move(producer_handle_), result));
   }
 
+  void CancelOnSequence() {
+    if (!data_source_)
+      return;
+    data_source_->Abort();
+    Finish(MOJO_RESULT_CANCELLED);
+  }
+
   const scoped_refptr<base::SequencedTaskRunner> callback_task_runner_;
 
   // State which is effectively owned and used only on the file sequence.