Fix ResumableTCPSocket destruction.

ResumableTCPSocket sets a read_callback_ that points to
TCPSocketEventDispatcher::ReadCallback. This callback gets called
from ~TCPSocket, when ~ResumableTCPSocket already completed,
and it calls ResumableTCPSocket methods (which are already illegal to call).

The fix just calls Disconnect from ~ResumableTCPSocket which clears the
callback and all the state that relies on ResumableTCPSocket members.

This fixes a bug found with UBSan Vptr.

BUG=617199

Review-Url: https://codereview.chromium.org/2034233002
Cr-Commit-Position: refs/heads/master@{#397829}

extensions/browser/api/socket/tcp_socket.cc

@@ -358,6 +358,14 @@ ResumableTCPSocket::ResumableTCPSocket(
       buffer_size_(0),
       paused_(false) {}
 
+ResumableTCPSocket::~ResumableTCPSocket() {
+  // Despite ~TCPSocket doing basically the same, we need to disconnect
+  // before ResumableTCPSocket is destroyed, because we have some extra
+  // state that relies on the socket being ResumableTCPSocket, like
+  // read_callback_.
+  Disconnect();
+}
+
 bool ResumableTCPSocket::IsPersistent() const { return persistent(); }
 
 ResumableTCPServerSocket::ResumableTCPServerSocket(

extensions/browser/api/socket/tcp_socket.h

@@ -115,6 +115,8 @@ class ResumableTCPSocket : public TCPSocket {
       const std::string& owner_extension_id,
       bool is_connected);
 
+  ~ResumableTCPSocket() override;
+
   // Overriden from ApiResource
   bool IsPersistent() const override;