Reland "mac: Simplify the local_discovery ServiceWatcher and ServiceResolver."

This is a reland of f4240b29

This fixes two issues:

- A real UAF in ServiceResolverImplMac::OnResolveComplete, where the
  callback can delete |this|, so StopResolving() is now called before
  the callback.
- A test-only UAF caused by the background thread outliving the object.
  The thread is now flushed and joined. The -stop methods for both
  NetServiceBrowser and NetServiceResolver are now called in their
  respective -deallocs, in case the Stop posted task does not run.

Original change's description:
> mac: Simplify the local_discovery ServiceWatcher and ServiceResolver.
>
> This removes the inner Container classes by moving the logic into the
> ObjC classes that already exist.
>
> Bug: 1072841
> Change-Id: If22d2d90ce3235ce160a0b740337fd71353a7ef7
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2243995
> Commit-Queue: Robert Sesek <rsesek@chromium.org>
> Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#778341}

Bug: 1072841
Change-Id: Ice53eb92d6c73c75ad6f276b301eaa1841536c8d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2248076Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org>
Commit-Queue: Robert Sesek <rsesek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#779350}

chrome/browser/local_discovery/service_discovery_client_mac.h

@@ -15,19 +15,15 @@
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "chrome/browser/local_discovery/service_discovery_shared_client.h"
-#include "content/public/browser/browser_thread.h"
 
 namespace base {
 class Thread;
 }
 
-namespace local_discovery {
+@class NetServiceBrowser;
+@class NetServiceResolver;
 
-template <class T>
-class ServiceDiscoveryThreadDeleter {
- public:
-  inline void operator()(T* t) { t->DeleteSoon(); }
-};
+namespace local_discovery {
 
 // Implementation of ServiceDiscoveryClient that uses the Bonjour SDK.
 // https://developer.apple.com/library/mac/documentation/Networking/Conceptual/
@@ -37,6 +33,8 @@ class ServiceDiscoveryClientMac : public ServiceDiscoverySharedClient {
   ServiceDiscoveryClientMac();
 
  private:
+  friend class ServiceDiscoveryClientMacTest;
+
   ~ServiceDiscoveryClientMac() override;
 
   // ServiceDiscoveryClient implementation.
@@ -60,42 +58,6 @@ class ServiceDiscoveryClientMac : public ServiceDiscoverySharedClient {
 
 class ServiceWatcherImplMac : public ServiceWatcher {
  public:
-  class NetServiceBrowserContainer {
-   public:
-    NetServiceBrowserContainer(
-        const std::string& service_type,
-        ServiceWatcher::UpdatedCallback callback,
-        scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner);
-    ~NetServiceBrowserContainer();
-
-    void Start();
-    void DiscoverNewServices();
-
-    void OnServicesUpdate(ServiceWatcher::UpdateType update,
-                          const std::string& service);
-
-    void DeleteSoon();
-
-   private:
-    void StartOnDiscoveryThread();
-    void DiscoverOnDiscoveryThread();
-
-    bool IsOnServiceDiscoveryThread() {
-      return base::ThreadTaskRunnerHandle::Get() ==
-             service_discovery_runner_.get();
-    }
-
-    std::string service_type_;
-    ServiceWatcher::UpdatedCallback callback_;
-
-    scoped_refptr<base::SingleThreadTaskRunner> callback_runner_;
-    scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner_;
-
-    base::scoped_nsobject<id> delegate_;
-    base::scoped_nsobject<NSNetServiceBrowser> browser_;
-    base::WeakPtrFactory<NetServiceBrowserContainer> weak_factory_;
-  };
-
   ServiceWatcherImplMac(
       const std::string& service_type,
       ServiceWatcher::UpdatedCallback callback,
@@ -112,57 +74,28 @@ class ServiceWatcherImplMac : public ServiceWatcher {
   void SetActivelyRefreshServices(bool actively_refresh_services) override;
   std::string GetServiceType() const override;
 
-  std::string service_type_;
+  void StartOnDiscoveryThread(
+      ServiceWatcher::UpdatedCallback callback,
+      scoped_refptr<base::SingleThreadTaskRunner> callback_runner);
+  void DiscoverOnDiscoveryThread();
+
+  // These members should only be accessed on the object creator's sequence.
+  const std::string service_type_;
   ServiceWatcher::UpdatedCallback callback_;
-  bool started_;
+  bool started_ = false;
+
+  scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner_;
+  // |browser_| lives on the |service_discovery_runner_|. It is released
+  // by move()ing it to StopServiceBrowser().
+  base::scoped_nsobject<NetServiceBrowser> browser_;
 
-  std::unique_ptr<NetServiceBrowserContainer,
-                  ServiceDiscoveryThreadDeleter<NetServiceBrowserContainer>>
-      container_;
-  base::WeakPtrFactory<ServiceWatcherImplMac> weak_factory_;
+  base::WeakPtrFactory<ServiceWatcherImplMac> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ServiceWatcherImplMac);
 };
 
 class ServiceResolverImplMac : public ServiceResolver {
  public:
-  class NetServiceContainer {
-   public:
-    NetServiceContainer(
-        const std::string& service_name,
-        ServiceResolver::ResolveCompleteCallback callback,
-        scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner);
-
-    virtual ~NetServiceContainer();
-
-    void StartResolving();
-
-    void OnResolveUpdate(RequestStatus);
-
-    void SetServiceForTesting(base::scoped_nsobject<NSNetService> service);
-
-    void DeleteSoon();
-
-   private:
-    void StartResolvingOnDiscoveryThread();
-
-    bool IsOnServiceDiscoveryThread() {
-      return base::ThreadTaskRunnerHandle::Get() ==
-             service_discovery_runner_.get();
-    }
-
-    const std::string service_name_;
-    ServiceResolver::ResolveCompleteCallback callback_;
-
-    scoped_refptr<base::SingleThreadTaskRunner> callback_runner_;
-    scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner_;
-
-    base::scoped_nsobject<id> delegate_;
-    base::scoped_nsobject<NSNetService> service_;
-    ServiceDescription service_description_;
-    base::WeakPtrFactory<NetServiceContainer> weak_factory_;
-  };
-
   ServiceResolverImplMac(
       const std::string& service_name,
       ServiceResolver::ResolveCompleteCallback callback,
@@ -170,29 +103,37 @@ class ServiceResolverImplMac : public ServiceResolver {
 
   ~ServiceResolverImplMac() override;
 
-  // Testing methods.
-  NetServiceContainer* GetContainerForTesting();
-
  private:
-
   void StartResolving() override;
   std::string GetName() const override;
 
   void OnResolveComplete(RequestStatus status,
                          const ServiceDescription& description);
 
+  void StartResolvingOnDiscoveryThread(
+      ServiceResolver::ResolveCompleteCallback callback,
+      scoped_refptr<base::SingleThreadTaskRunner> callback_runner);
+  void StopResolving();
+
+  // These members should only be accessed on the object creator's sequence.
   const std::string service_name_;
   ServiceResolver::ResolveCompleteCallback callback_;
-  bool has_resolved_;
+  bool has_resolved_ = false;
 
-  std::unique_ptr<NetServiceContainer,
-                  ServiceDiscoveryThreadDeleter<NetServiceContainer>>
-      container_;
-  base::WeakPtrFactory<ServiceResolverImplMac> weak_factory_;
+  scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner_;
+  // |resolver_| lives on the |service_discovery_runner_|. It is released
+  // by move()ing it to StopServiceResolver().
+  base::scoped_nsobject<NetServiceResolver> resolver_;
+
+  base::WeakPtrFactory<ServiceResolverImplMac> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ServiceResolverImplMac);
 };
 
+// Parses the data out of the |service|, updating the |description| with the
+// results.
+void ParseNetService(NSNetService* service, ServiceDescription& description);
+
 }  // namespace local_discovery
 
 #endif  // CHROME_BROWSER_LOCAL_DISCOVERY_SERVICE_DISCOVERY_CLIENT_MAC_H_

chrome/browser/local_discovery/service_discovery_client_mac.mm

@@ -11,10 +11,8 @@
 #include <stdint.h>
 
 #include "base/bind.h"
-#include "base/debug/dump_without_crashing.h"
-#include "base/memory/singleton.h"
+#include "base/mac/foundation_util.h"
 #include "base/message_loop/message_pump_type.h"
-#include "base/metrics/histogram_macros.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/threading/thread.h"
@@ -22,30 +20,39 @@
 #include "net/base/ip_address.h"
 #include "net/base/ip_endpoint.h"
 
-using local_discovery::ServiceWatcherImplMac;
-using local_discovery::ServiceResolverImplMac;
-
-@interface NetServiceBrowserDelegate
-    : NSObject<NSNetServiceBrowserDelegate, NSNetServiceDelegate> {
- @private
-  ServiceWatcherImplMac::NetServiceBrowserContainer* _container;  // weak.
-  base::scoped_nsobject<NSMutableArray> _services;
-}
-
-- (id)initWithContainer:
-        (ServiceWatcherImplMac::NetServiceBrowserContainer*)serviceWatcherImpl;
-- (void)clearDiscoveredServices;
-
+using local_discovery::ServiceWatcher;
+using local_discovery::ServiceResolver;
+using local_discovery::ServiceDescription;
+
+@interface NetServiceBrowser
+    : NSObject <NSNetServiceBrowserDelegate, NSNetServiceDelegate>
+// Creates a new NSNetServiceBrowser and starts listening for discovery
+// notifications. Calls the |callback| on the |callbackRunner| when
+// changes are detected.
+- (instancetype)initWithServiceType:(const std::string&)serviceType
+                           callback:(ServiceWatcher::UpdatedCallback)callback
+                     callbackRunner:
+                         (scoped_refptr<base::SingleThreadTaskRunner>)
+                             callbackRunner;
+
+// Forces a new scan for services.
+- (void)discoverServices;
+
+// Stops listening for discovery notifications.
+- (void)stop;
 @end
 
-@interface NetServiceDelegate : NSObject <NSNetServiceDelegate> {
-  @private
-   ServiceResolverImplMac::NetServiceContainer* _container;
-}
-
-- (id)initWithContainer:
-        (ServiceResolverImplMac::NetServiceContainer*)serviceResolverImpl;
-
+@interface NetServiceResolver : NSObject <NSNetServiceDelegate>
+// Begins resolving the local service named |name|. Calls the |callback|
+// on the |callbackRunner| when done or an error occurs.
+- (instancetype)
+    initWithServiceName:(const std::string&)name
+       resolvedCallback:(ServiceResolver::ResolveCompleteCallback)callback
+         callbackRunner:
+             (scoped_refptr<base::SingleThreadTaskRunner>)callbackRunner;
+
+// Stops any in-flight resolve operation.
+- (void)stop;
 @end
 
 namespace local_discovery {
@@ -56,6 +63,16 @@ const char kServiceDiscoveryThreadName[] = "Service Discovery Thread";
 
 const NSTimeInterval kResolveTimeout = 10.0;
 
+// Takes ownership of |browser| and tells it to stop.
+void StopServiceBrowser(base::scoped_nsobject<NetServiceBrowser> browser) {
+  [browser stop];
+}
+
+// Takes ownership of |resolver| and tells it to stop.
+void StopServiceResolver(base::scoped_nsobject<NetServiceResolver> resolver) {
+  [resolver stop];
+}
+
 // Extracts the instance name, name type and domain from a full service name or
 // the service type and domain from a service type. Returns true if successful.
 // TODO(justinlin): This current only handles service names with format
@@ -133,8 +150,8 @@ void ParseTxtRecord(NSData* record, std::vector<std::string>* output) {
 
 }  // namespace
 
-ServiceDiscoveryClientMac::ServiceDiscoveryClientMac() {}
-ServiceDiscoveryClientMac::~ServiceDiscoveryClientMac() {}
+ServiceDiscoveryClientMac::ServiceDiscoveryClientMac() = default;
+ServiceDiscoveryClientMac::~ServiceDiscoveryClientMac() = default;
 
 std::unique_ptr<ServiceWatcher> ServiceDiscoveryClientMac::CreateServiceWatcher(
     const std::string& service_type,
@@ -177,80 +194,7 @@ void ServiceDiscoveryClientMac::StartThreadIfNotStarted() {
   }
 }
 
-ServiceWatcherImplMac::NetServiceBrowserContainer::NetServiceBrowserContainer(
-    const std::string& service_type,
-    ServiceWatcher::UpdatedCallback callback,
-    scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner)
-    : service_type_(service_type),
-      callback_(std::move(callback)),
-      callback_runner_(base::ThreadTaskRunnerHandle::Get()),
-      service_discovery_runner_(service_discovery_runner),
-      weak_factory_(this) {}
-
-ServiceWatcherImplMac::NetServiceBrowserContainer::
-    ~NetServiceBrowserContainer() {
-  DCHECK(IsOnServiceDiscoveryThread());
-
-  // Work around a 10.12 bug: NSNetServiceBrowser doesn't lose interest in its
-  // weak delegate during deallocation, so a subsequently-deallocated delegate
-  // attempts to clear the pointer to itself in an NSNetServiceBrowser that's
-  // already gone.
-  // https://crbug.com/657495, https://openradar.appspot.com/28943305
-  [browser_ setDelegate:nil];
-
-  // Ensure the delegate clears all references to itself, which it had added as
-  // discovered services were reported to it.
-  [delegate_ clearDiscoveredServices];
-}
-
-void ServiceWatcherImplMac::NetServiceBrowserContainer::Start() {
-  service_discovery_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&NetServiceBrowserContainer::StartOnDiscoveryThread,
-                     weak_factory_.GetWeakPtr()));
-}
-
-void ServiceWatcherImplMac::NetServiceBrowserContainer::DiscoverNewServices() {
-  service_discovery_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&NetServiceBrowserContainer::DiscoverOnDiscoveryThread,
-                     weak_factory_.GetWeakPtr()));
-}
-
-void
-ServiceWatcherImplMac::NetServiceBrowserContainer::StartOnDiscoveryThread() {
-  DCHECK(IsOnServiceDiscoveryThread());
-
-  delegate_.reset([[NetServiceBrowserDelegate alloc] initWithContainer:this]);
-  browser_.reset([[NSNetServiceBrowser alloc] init]);
-  [browser_ setDelegate:delegate_];
-}
-
-void
-ServiceWatcherImplMac::NetServiceBrowserContainer::DiscoverOnDiscoveryThread() {
-  DCHECK(IsOnServiceDiscoveryThread());
-  base::scoped_nsobject<NSString> instance, type, domain;
-
-  if (!ExtractServiceInfo(service_type_, false, &instance, &type, &domain))
-    return;
-
-  DCHECK(![instance length]);
-  DVLOG(1) << "Listening for service type '" << [type UTF8String]
-           << "' on domain '" << [domain UTF8String] << "'";
-
-  [browser_ searchForServicesOfType:type inDomain:domain];
-}
-
-void ServiceWatcherImplMac::NetServiceBrowserContainer::OnServicesUpdate(
-    ServiceWatcher::UpdateType update,
-    const std::string& service) {
-  callback_runner_->PostTask(FROM_HERE,
-                             base::BindOnce(callback_, update, service));
-}
-
-void ServiceWatcherImplMac::NetServiceBrowserContainer::DeleteSoon() {
-  service_discovery_runner_->DeleteSoon(FROM_HERE, this);
-}
+// Service Watcher /////////////////////////////////////////////////////////////
 
 ServiceWatcherImplMac::ServiceWatcherImplMac(
     const std::string& service_type,
@@ -258,28 +202,33 @@ ServiceWatcherImplMac::ServiceWatcherImplMac(
     scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner)
     : service_type_(service_type),
       callback_(std::move(callback)),
-      started_(false),
-      weak_factory_(this) {
-  container_.reset(new NetServiceBrowserContainer(
-      service_type,
-      base::BindRepeating(&ServiceWatcherImplMac::OnServicesUpdate,
-                          weak_factory_.GetWeakPtr()),
-      service_discovery_runner));
-}
+      service_discovery_runner_(service_discovery_runner) {}
 
-ServiceWatcherImplMac::~ServiceWatcherImplMac() {}
+ServiceWatcherImplMac::~ServiceWatcherImplMac() {
+  service_discovery_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&StopServiceBrowser, std::move(browser_)));
+}
 
 void ServiceWatcherImplMac::Start() {
   DCHECK(!started_);
   VLOG(1) << "ServiceWatcherImplMac::Start";
-  container_->Start();
+  service_discovery_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&ServiceWatcherImplMac::StartOnDiscoveryThread,
+                                base::Unretained(this),
+                                base::BindRepeating(
+                                    &ServiceWatcherImplMac::OnServicesUpdate,
+                                    weak_factory_.GetWeakPtr()),
+                                base::ThreadTaskRunnerHandle::Get()));
   started_ = true;
 }
 
 void ServiceWatcherImplMac::DiscoverNewServices() {
   DCHECK(started_);
   VLOG(1) << "ServiceWatcherImplMac::DiscoverNewServices";
-  container_->DiscoverNewServices();
+  service_discovery_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(&ServiceWatcherImplMac::DiscoverOnDiscoveryThread,
+                     base::Unretained(this)));
 }
 
 void ServiceWatcherImplMac::SetActivelyRefreshServices(
@@ -299,177 +248,166 @@ void ServiceWatcherImplMac::OnServicesUpdate(ServiceWatcher::UpdateType update,
   callback_.Run(update, service + "." + service_type_);
 }
 
-ServiceResolverImplMac::NetServiceContainer::NetServiceContainer(
+void ServiceWatcherImplMac::StartOnDiscoveryThread(
+    ServiceWatcher::UpdatedCallback callback,
+    scoped_refptr<base::SingleThreadTaskRunner> callback_runner) {
+  DCHECK(service_discovery_runner_->RunsTasksInCurrentSequence());
+
+  browser_.reset([[NetServiceBrowser alloc]
+      initWithServiceType:service_type_
+                 callback:std::move(callback)
+           callbackRunner:callback_runner]);
+}
+
+void ServiceWatcherImplMac::DiscoverOnDiscoveryThread() {
+  DCHECK(service_discovery_runner_->RunsTasksInCurrentSequence());
+  [browser_ discoverServices];
+}
+
+// Service Resolver ////////////////////////////////////////////////////////////
+
+ServiceResolverImplMac::ServiceResolverImplMac(
     const std::string& service_name,
     ServiceResolver::ResolveCompleteCallback callback,
     scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner)
     : service_name_(service_name),
       callback_(std::move(callback)),
-      callback_runner_(base::ThreadTaskRunnerHandle::Get()),
-      service_discovery_runner_(service_discovery_runner),
-      weak_factory_(this) {}
-
-ServiceResolverImplMac::NetServiceContainer::~NetServiceContainer() {
-  DCHECK(IsOnServiceDiscoveryThread());
+      service_discovery_runner_(service_discovery_runner) {}
 
-  // Work around a 10.12 bug: NSNetService doesn't lose interest in its weak
-  // delegate during deallocation, so a subsequently-deallocated delegate
-  // attempts to clear the pointer to itself in an NSNetService that's already
-  // gone.
-  // https://crbug.com/657495, https://openradar.appspot.com/28943305
-  [service_ setDelegate:nil];
+ServiceResolverImplMac::~ServiceResolverImplMac() {
+  StopResolving();
 }
 
-void ServiceResolverImplMac::NetServiceContainer::StartResolving() {
+void ServiceResolverImplMac::StartResolving() {
+  VLOG(1) << "Resolving service " << service_name_;
   service_discovery_runner_->PostTask(
       FROM_HERE,
-      base::BindOnce(&NetServiceContainer::StartResolvingOnDiscoveryThread,
-                     weak_factory_.GetWeakPtr()));
+      base::BindOnce(&ServiceResolverImplMac::StartResolvingOnDiscoveryThread,
+                     base::Unretained(this),
+                     base::BindOnce(&ServiceResolverImplMac::OnResolveComplete,
+                                    weak_factory_.GetWeakPtr()),
+                     base::ThreadTaskRunnerHandle::Get()));
 }
 
-void ServiceResolverImplMac::NetServiceContainer::DeleteSoon() {
-  service_discovery_runner_->DeleteSoon(FROM_HERE, this);
+std::string ServiceResolverImplMac::GetName() const {
+  return service_name_;
 }
 
-void
-ServiceResolverImplMac::NetServiceContainer::StartResolvingOnDiscoveryThread() {
-  DCHECK(IsOnServiceDiscoveryThread());
-  base::scoped_nsobject<NSString> instance, type, domain;
-
-  // The service object is set ahead of time by tests.
-  if (service_)
-    return;
-
-  if (!ExtractServiceInfo(service_name_, true, &instance, &type, &domain))
-    return OnResolveUpdate(ServiceResolver::STATUS_KNOWN_NONEXISTENT);
+void ServiceResolverImplMac::OnResolveComplete(
+    RequestStatus status,
+    const ServiceDescription& description) {
+  VLOG(1) << "ServiceResolverImplMac::OnResolveComplete: " << service_name_
+          << ", " << status;
 
-  VLOG(1) << "ServiceResolverImplMac::ServiceResolverImplMac::"
-          << "StartResolvingOnDiscoveryThread: Success";
-  delegate_.reset([[NetServiceDelegate alloc] initWithContainer:this]);
-  service_.reset(
-      [[NSNetService alloc] initWithDomain:domain type:type name:instance]);
-  [service_ setDelegate:delegate_];
+  has_resolved_ = true;
 
-  [service_ resolveWithTimeout:kResolveTimeout];
+  StopResolving();
 
-  VLOG(1) << "ServiceResolverImplMac::NetServiceContainer::"
-          << "StartResolvingOnDiscoveryThread: " << service_name_
-          << ", instance: " << [instance UTF8String]
-          << ", type: " << [type UTF8String]
-          << ", domain: " << [domain UTF8String];
+  // The |callback_| can delete this.
+  if (!callback_.is_null())
+    std::move(callback_).Run(status, description);
 }
 
-void ServiceResolverImplMac::NetServiceContainer::OnResolveUpdate(
-    RequestStatus status) {
-  if (callback_.is_null())
-    return;
+void ServiceResolverImplMac::StartResolvingOnDiscoveryThread(
+    ServiceResolver::ResolveCompleteCallback callback,
+    scoped_refptr<base::SingleThreadTaskRunner> callback_runner) {
+  DCHECK(service_discovery_runner_->RunsTasksInCurrentSequence());
 
-  if (status != STATUS_SUCCESS) {
-    callback_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(std::move(callback_), status, ServiceDescription()));
-    return;
-  }
+  resolver_.reset([[NetServiceResolver alloc]
+      initWithServiceName:service_name_
+         resolvedCallback:std::move(callback)
+           callbackRunner:callback_runner]);
+}
 
-  service_description_.service_name = service_name_;
+void ServiceResolverImplMac::StopResolving() {
+  service_discovery_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&StopServiceResolver, std::move(resolver_)));
+}
 
-  for (NSData* address in [service_ addresses]) {
+void ParseNetService(NSNetService* service, ServiceDescription& description) {
+  for (NSData* address in [service addresses]) {
     const void* bytes = [address bytes];
     int length = [address length];
     const sockaddr* socket = static_cast<const sockaddr*>(bytes);
     net::IPEndPoint end_point;
     if (end_point.FromSockAddr(socket, length)) {
-      service_description_.address =
-          net::HostPortPair::FromIPEndPoint(end_point);
-      service_description_.ip_address = end_point.address();
+      description.address = net::HostPortPair::FromIPEndPoint(end_point);
+      description.ip_address = end_point.address();
       break;
     }
   }
 
-  if (service_description_.address.host().empty()) {
-    VLOG(1) << "Service IP is not resolved: " << service_name_;
-    callback_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(std::move(callback_), STATUS_KNOWN_NONEXISTENT,
-                       ServiceDescription()));
-    return;
-  }
-
-  ParseTxtRecord([service_ TXTRecordData], &service_description_.metadata);
-
-  // TODO(justinlin): Implement last_seen.
-  service_description_.last_seen = base::Time::Now();
-  callback_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(std::move(callback_), status, service_description_));
+  ParseTxtRecord([service TXTRecordData], &description.metadata);
 }
 
-void ServiceResolverImplMac::NetServiceContainer::SetServiceForTesting(
-    base::scoped_nsobject<NSNetService> service) {
-  service_ = service;
-}
+}  // namespace local_discovery
 
-ServiceResolverImplMac::ServiceResolverImplMac(
-    const std::string& service_name,
-    ServiceResolver::ResolveCompleteCallback callback,
-    scoped_refptr<base::SingleThreadTaskRunner> service_discovery_runner)
-    : service_name_(service_name),
-      callback_(std::move(callback)),
-      has_resolved_(false),
-      weak_factory_(this) {
-  container_.reset(new NetServiceContainer(
-      service_name,
-      base::BindOnce(&ServiceResolverImplMac::OnResolveComplete,
-                     weak_factory_.GetWeakPtr()),
-      service_discovery_runner));
-}
+// Service Watcher /////////////////////////////////////////////////////////////
 
-ServiceResolverImplMac::~ServiceResolverImplMac() {}
+@implementation NetServiceBrowser {
+  std::string _serviceType;
 
-void ServiceResolverImplMac::StartResolving() {
-  container_->StartResolving();
+  ServiceWatcher::UpdatedCallback _callback;
+  scoped_refptr<base::SingleThreadTaskRunner> _callbackRunner;
 
-  VLOG(1) << "Resolving service " << service_name_;
+  base::scoped_nsobject<NSNetServiceBrowser> _browser;
+  base::scoped_nsobject<NSMutableArray<NSNetService*>> _services;
 }
 
-std::string ServiceResolverImplMac::GetName() const { return service_name_; }
-
-void ServiceResolverImplMac::OnResolveComplete(
-    RequestStatus status,
-    const ServiceDescription& description) {
-  VLOG(1) << "ServiceResolverImplMac::OnResolveComplete: " << service_name_
-          << ", " << status;
+- (instancetype)initWithServiceType:(const std::string&)serviceType
+                           callback:(ServiceWatcher::UpdatedCallback)callback
+                     callbackRunner:
+                         (scoped_refptr<base::SingleThreadTaskRunner>)
+                             callbackRunner {
+  if ((self = [super init])) {
+    _serviceType = serviceType;
 
-  has_resolved_ = true;
+    _callback = std::move(callback);
+    _callbackRunner = callbackRunner;
 
-  if (!callback_.is_null())
-    std::move(callback_).Run(status, description);
+    _services.reset([[NSMutableArray alloc] initWithCapacity:1]);
+    _browser.reset([[NSNetServiceBrowser alloc] init]);
+    [_browser setDelegate:self];
+  }
+  return self;
 }
 
-ServiceResolverImplMac::NetServiceContainer*
-ServiceResolverImplMac::GetContainerForTesting() {
-  return container_.get();
+- (void)dealloc {
+  [self stop];
+  [super dealloc];
 }
 
-}  // namespace local_discovery
+- (void)discoverServices {
+  base::scoped_nsobject<NSString> instance, type, domain;
+  if (!local_discovery::ExtractServiceInfo(_serviceType, false, &instance,
+                                           &type, &domain)) {
+    return;
+  }
 
-@implementation NetServiceBrowserDelegate
+  DCHECK(![instance length]);
+  DVLOG(1) << "Listening for service type '" << type << "' on domain '"
+           << domain << "'";
 
-- (id)initWithContainer:
-          (ServiceWatcherImplMac::NetServiceBrowserContainer*)container {
-  if ((self = [super init])) {
-    _container = container;
-    _services.reset([[NSMutableArray alloc] initWithCapacity:1]);
-  }
-  return self;
+  [_browser searchForServicesOfType:type inDomain:domain];
 }
 
-- (void)clearDiscoveredServices {
+- (void)stop {
+  // Work around a 10.12 bug: NSNetServiceBrowser doesn't lose interest in its
+  // weak delegate during deallocation, so a subsequently-deallocated delegate
+  // attempts to clear the pointer to itself in an NSNetServiceBrowser that's
+  // already gone.
+  // https://crbug.com/657495, https://openradar.appspot.com/28943305
+  [_browser setDelegate:nil];
+
+  // Ensure the delegate clears all references to itself, which it had added as
+  // discovered services were reported to it.
   for (NSNetService* netService in _services.get()) {
     [netService stopMonitoring];
     [netService setDelegate:nil];
   }
   [_services removeAllObjects];
+
+  _browser.reset();
 }
 
 - (void)netServiceBrowser:(NSNetServiceBrowser*)netServiceBrowser
@@ -480,8 +418,9 @@ ServiceResolverImplMac::GetContainerForTesting() {
   [netService startMonitoring];
   [_services addObject:netService];
 
-  _container->OnServicesUpdate(local_discovery::ServiceWatcher::UPDATE_ADDED,
-                               base::SysNSStringToUTF8([netService name]));
+  _callbackRunner->PostTask(
+      FROM_HERE, base::BindOnce(_callback, ServiceWatcher::UPDATE_ADDED,
+                                base::SysNSStringToUTF8([netService name])));
 }
 
 - (void)netServiceBrowser:(NSNetServiceBrowser*)netServiceBrowser
@@ -489,9 +428,9 @@ ServiceResolverImplMac::GetContainerForTesting() {
                moreComing:(BOOL)moreServicesComing {
   NSUInteger index = [_services indexOfObject:netService];
   if (index != NSNotFound) {
-    _container->OnServicesUpdate(
-        local_discovery::ServiceWatcher::UPDATE_REMOVED,
-        base::SysNSStringToUTF8([netService name]));
+    _callbackRunner->PostTask(
+        FROM_HERE, base::BindOnce(_callback, ServiceWatcher::UPDATE_REMOVED,
+                                  base::SysNSStringToUTF8([netService name])));
 
     // Stop monitoring this service for updates.
     DCHECK_EQ(netService, [_services objectAtIndex:index]);
@@ -503,30 +442,108 @@ ServiceResolverImplMac::GetContainerForTesting() {
 
 - (void)netService:(NSNetService*)sender
     didUpdateTXTRecordData:(NSData*)data {
-  _container->OnServicesUpdate(local_discovery::ServiceWatcher::UPDATE_CHANGED,
-                               base::SysNSStringToUTF8([sender name]));
+  _callbackRunner->PostTask(
+      FROM_HERE, base::BindOnce(_callback, ServiceWatcher::UPDATE_CHANGED,
+                                base::SysNSStringToUTF8([sender name])));
 }
 
 @end
 
-@implementation NetServiceDelegate
+// Service Resolver ////////////////////////////////////////////////////////////
+
+@implementation NetServiceResolver {
+  std::string _serviceName;
+
+  ServiceResolver::ResolveCompleteCallback _callback;
+  scoped_refptr<base::SingleThreadTaskRunner> _callbackRunner;
+
+  ServiceDescription _serviceDescription;
+  base::scoped_nsobject<NSNetService> _service;
+}
 
-- (id)initWithContainer:
-          (ServiceResolverImplMac::NetServiceContainer*)container {
+- (instancetype)
+    initWithServiceName:(const std::string&)serviceName
+       resolvedCallback:(ServiceResolver::ResolveCompleteCallback)callback
+         callbackRunner:
+             (scoped_refptr<base::SingleThreadTaskRunner>)callbackRunner {
   if ((self = [super init])) {
-    _container = container;
+    _serviceName = serviceName;
+    _callback = std::move(callback);
+    _callbackRunner = callbackRunner;
+
+    base::scoped_nsobject<NSString> instance, type, domain;
+    if (!local_discovery::ExtractServiceInfo(_serviceName, true, &instance,
+                                             &type, &domain)) {
+      [self updateServiceDescription:ServiceResolver::STATUS_KNOWN_NONEXISTENT];
+      return self;
+    }
+
+    VLOG(1) << "ServiceResolverImplMac::"
+            << "StartResolvingOnDiscoveryThread: " << serviceName
+            << ", instance: " << instance << ", type: " << type
+            << ", domain: " << domain;
+
+    _service.reset([[NSNetService alloc] initWithDomain:domain
+                                                   type:type
+                                                   name:instance]);
+    [_service setDelegate:self];
+    [_service resolveWithTimeout:local_discovery::kResolveTimeout];
   }
   return self;
 }
 
+- (void)dealloc {
+  [self stop];
+  [super dealloc];
+}
+
+- (void)stop {
+  // Work around a 10.12 bug: NSNetService doesn't lose interest in its weak
+  // delegate during deallocation, so a subsequently-deallocated delegate
+  // attempts to clear the pointer to itself in an NSNetService that's already
+  // gone.
+  // https://crbug.com/657495, https://openradar.appspot.com/28943305
+  [_service setDelegate:nil];
+  _service.reset();
+}
+
 - (void)netServiceDidResolveAddress:(NSNetService*)sender {
-  _container->OnResolveUpdate(local_discovery::ServiceResolver::STATUS_SUCCESS);
+  [self updateServiceDescription:ServiceResolver::STATUS_SUCCESS];
 }
 
 - (void)netService:(NSNetService*)sender
         didNotResolve:(NSDictionary*)errorDict {
-  _container->OnResolveUpdate(
-      local_discovery::ServiceResolver::STATUS_REQUEST_TIMEOUT);
+  [self updateServiceDescription:ServiceResolver::STATUS_REQUEST_TIMEOUT];
+}
+
+- (void)updateServiceDescription:(ServiceResolver::RequestStatus)status {
+  if (_callback.is_null())
+    return;
+
+  if (status != ServiceResolver::STATUS_SUCCESS) {
+    _callbackRunner->PostTask(
+        FROM_HERE,
+        base::BindOnce(std::move(_callback), status, ServiceDescription()));
+    return;
+  }
+
+  _serviceDescription.service_name = _serviceName;
+  ParseNetService(_service.get(), _serviceDescription);
+
+  if (_serviceDescription.address.host().empty()) {
+    VLOG(1) << "Service IP is not resolved: " << _serviceName;
+    _callbackRunner->PostTask(
+        FROM_HERE, base::BindOnce(std::move(_callback),
+                                  ServiceResolver::STATUS_KNOWN_NONEXISTENT,
+                                  ServiceDescription()));
+    return;
+  }
+
+  // TODO(justinlin): Implement last_seen.
+  _serviceDescription.last_seen = base::Time::Now();
+  _callbackRunner->PostTask(
+      FROM_HERE,
+      base::BindOnce(std::move(_callback), status, _serviceDescription));
 }
 
 @end

chrome/browser/local_discovery/service_discovery_client_mac_unittest.mm

@@ -10,6 +10,7 @@
 #include "base/mac/scoped_nsobject.h"
 #include "base/run_loop.h"
 #include "base/stl_util.h"
+#include "base/threading/thread.h"
 #include "chrome/browser/local_discovery/service_discovery_client.h"
 #include "chrome/browser/local_discovery/service_discovery_client_mac.h"
 #import "chrome/browser/ui/cocoa/test/cocoa_test_helper.h"
@@ -76,6 +77,11 @@ class ServiceDiscoveryClientMacTest : public CocoaTest {
     num_resolves_++;
   }
 
+  void StopDiscoveryThread() {
+    client_->service_discovery_thread_->FlushForTesting();
+    client_->service_discovery_thread_.reset();
+  }
+
   ServiceDiscoveryClient* client() { return client_.get(); }
 
  protected:
@@ -113,15 +119,13 @@ TEST_F(ServiceDiscoveryClientMacTest, ServiceWatcher) {
       ServiceWatcher::UPDATE_REMOVED, test_service_name);
   EXPECT_EQ(last_service_name_, test_service_name + "." + test_service_type);
   EXPECT_EQ(num_updates_, 3);
-}
 
-TEST_F(ServiceDiscoveryClientMacTest, ServiceResolver) {
-  const std::string test_service_name = "Test.123._testing._tcp.local";
-  std::unique_ptr<ServiceResolver> resolver = client()->CreateServiceResolver(
-      test_service_name,
-      base::BindOnce(&ServiceDiscoveryClientMacTest::OnResolveComplete,
-                     base::Unretained(this)));
+  // Explicitly flush and stop the thread that |watcher| is using before
+  // |watcher| goes out of scope.
+  StopDiscoveryThread();
+}
 
+TEST_F(ServiceDiscoveryClientMacTest, ParseServiceRecord) {
   const uint8_t record_bytes[] = {2, 'a', 'b', 3, 'd', '=', 'e'};
   base::scoped_nsobject<TestNSNetService> test_service([[TestNSNetService alloc]
       initWithData:[NSData dataWithBytes:record_bytes
@@ -139,38 +143,21 @@ TEST_F(ServiceDiscoveryClientMacTest, ServiceResolver) {
   NSArray* addresses = @[ discoveryHost ];
   [test_service setAddresses:addresses];
 
-  ServiceResolverImplMac* resolver_impl =
-      static_cast<ServiceResolverImplMac*>(resolver.get());
-  resolver_impl->GetContainerForTesting()->SetServiceForTesting(
-      base::scoped_nsobject<NSNetService>(test_service));
-  resolver->StartResolving();
-
-  resolver_impl->GetContainerForTesting()->OnResolveUpdate(
-      ServiceResolver::STATUS_SUCCESS);
+  ServiceDescription description;
+  ParseNetService(test_service.get(), description);
 
-  base::RunLoop().RunUntilIdle();
-
-  EXPECT_EQ(1, num_resolves_);
-
-  const std::vector<std::string>& metadata =
-      last_service_description_.metadata;
+  const std::vector<std::string>& metadata = description.metadata;
   EXPECT_EQ(2u, metadata.size());
   EXPECT_TRUE(base::Contains(metadata, "ab"));
   EXPECT_TRUE(base::Contains(metadata, "d=e"));
 
-  EXPECT_EQ(ip_address, last_service_description_.ip_address);
-  EXPECT_EQ(kPort, last_service_description_.address.port());
-  EXPECT_EQ(kIp, last_service_description_.address.host());
+  EXPECT_EQ(ip_address, description.ip_address);
+  EXPECT_EQ(kPort, description.address.port());
+  EXPECT_EQ(kIp, description.address.host());
 }
 
 // https://crbug.com/586628
-TEST_F(ServiceDiscoveryClientMacTest, ResolveInvalidUnicodeRecord) {
-  const std::string test_service_name = "Test.123._testing._tcp.local";
-  std::unique_ptr<ServiceResolver> resolver = client()->CreateServiceResolver(
-      test_service_name,
-      base::BindOnce(&ServiceDiscoveryClientMacTest::OnResolveComplete,
-                     base::Unretained(this)));
-
+TEST_F(ServiceDiscoveryClientMacTest, ParseInvalidUnicodeRecord) {
   const uint8_t record_bytes[] = {
     3, 'a', '=', 'b',
     // The bytes after name= are the UTF-8 encoded representation of
@@ -194,28 +181,17 @@ TEST_F(ServiceDiscoveryClientMacTest, ResolveInvalidUnicodeRecord) {
   NSArray* addresses = @[ discovery_host ];
   [test_service setAddresses:addresses];
 
-  ServiceResolverImplMac* resolver_impl =
-      static_cast<ServiceResolverImplMac*>(resolver.get());
-  resolver_impl->GetContainerForTesting()->SetServiceForTesting(
-      base::scoped_nsobject<NSNetService>(test_service));
-  resolver->StartResolving();
-
-  resolver_impl->GetContainerForTesting()->OnResolveUpdate(
-      ServiceResolver::STATUS_SUCCESS);
-
-  base::RunLoop().RunUntilIdle();
-
-  EXPECT_EQ(1, num_resolves_);
+  ServiceDescription description;
+  ParseNetService(test_service.get(), description);
 
-  const std::vector<std::string>& metadata =
-      last_service_description_.metadata;
+  const std::vector<std::string>& metadata = description.metadata;
   EXPECT_EQ(2u, metadata.size());
   EXPECT_TRUE(base::Contains(metadata, "a=b"));
   EXPECT_TRUE(base::Contains(metadata, "cd=e9"));
 
-  EXPECT_EQ(ip_address, last_service_description_.ip_address);
-  EXPECT_EQ(kPort, last_service_description_.address.port());
-  EXPECT_EQ(kIp, last_service_description_.address.host());
+  EXPECT_EQ(ip_address, description.ip_address);
+  EXPECT_EQ(kPort, description.address.port());
+  EXPECT_EQ(kIp, description.address.host());
 }
 
 TEST_F(ServiceDiscoveryClientMacTest, ResolveInvalidServiceName) {