[Nearby] Use EndpointDiscoveryListener on the same sequence it is bound on.

Nearby Connections invokes ::OnEndpointLost() and ::OnEndpointFound()
back-to-back. Without this change, these back-to-back calls cause a
crash in Mojo's message passing logic, within the Nearby utility
process.

Bug: 1145818
Change-Id: Iee297ccb4aadebb71072d6155a1eb6f7ddd63cdb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2523738
Commit-Queue: Ryan Hansberry <hansberry@chromium.org>
Reviewed-by: James Vecore <vecore@google.com>
Cr-Commit-Position: refs/heads/master@{#825422}

chrome/services/sharing/nearby/nearby_connections.cc

@@ -310,26 +310,40 @@ void NearbyConnections::StartDiscovery(
       .is_out_of_band_connection = options->is_out_of_band_connection,
       .fast_advertisement_service_uuid = fast_advertisement_service_uuid};
   mojo::SharedRemote<mojom::EndpointDiscoveryListener> remote(
-      std::move(listener));
+      std::move(listener), thread_task_runner_);
   DiscoveryListener discovery_listener{
       .endpoint_found_cb =
-          [remote](const std::string& endpoint_id,
-                   const ByteArray& endpoint_info,
-                   const std::string& service_id) {
+          [task_runner = thread_task_runner_, remote](
+              const std::string& endpoint_id, const ByteArray& endpoint_info,
+              const std::string& service_id) {
             if (!remote) {
               return;
             }
 
-            remote->OnEndpointFound(
-                endpoint_id, mojom::DiscoveredEndpointInfo::New(
-                                 ByteArrayToMojom(endpoint_info), service_id));
+            // This call must be posted to the same sequence that |remote| was
+            // bound on.
+            task_runner->PostTask(
+                FROM_HERE,
+                base::BindOnce(
+                    &mojom::EndpointDiscoveryListener::OnEndpointFound,
+                    base::Unretained(remote.get()), endpoint_id,
+                    mojom::DiscoveredEndpointInfo::New(
+                        ByteArrayToMojom(endpoint_info), service_id)));
           },
       .endpoint_lost_cb =
-          [remote](const std::string& endpoint_id) {
-            if (!remote)
+          [task_runner = thread_task_runner_,
+           remote](const std::string& endpoint_id) {
+            if (!remote) {
               return;
+            }
 
-            remote->OnEndpointLost(endpoint_id);
+            // This call must be posted to the same sequence that |remote| was
+            // bound on.
+            task_runner->PostTask(
+                FROM_HERE,
+                base::BindOnce(
+                    &mojom::EndpointDiscoveryListener::OnEndpointLost,
+                    base::Unretained(remote.get()), endpoint_id));
           },
   };
   ResultCallback result_callback = ResultCallbackFromMojom(std::move(callback));