Fix PepperTCPSocketMessageFilter crashes.

When a PepperTCPSocketMessageFilter was torn down while it was waiting
on a callback that was passed to NetworkContext to be invoked, Chrome
would crash with a UAF once the callback was invoked. This CL fixes
that by using weak pointers, and fixes a similar issue with the
ServerSocket message filter as well.

Weak pointers are not used with callbacks that are passed to Mojo
pipes the classes own, as they won't be called on teardown, anyways.

This CL also adds a bunch of tests for tearing down the Pepper
MessageFilter while there's a live request in various states.

Bug: 893604
Change-Id: Ibc57ed116bf6b86df975d4dc4cc54fc5da16388d
Reviewed-on: https://chromium-review.googlesource.com/c/1272095
Commit-Queue: Matt Menke <mmenke@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Maks Orlovich <morlovich@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#598323}
Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src
Cr-Mirrored-Commit: 561d8efe60a0481e0b7cb3fe220476ae7569a618
8 files changed