From 4ca7ebefd5ae7d3b50df28865cb48fde4fb946fd Mon Sep 17 00:00:00 2001
From: Alexandre Lissy <lissyx+mozillians@lissyx.dyndns.org>
Date: Thu, 6 Apr 2023 08:04:29 +0000
Subject: [PATCH] Bug 1788173 - Force IPC channel error on timeout waiting for
 client connection r=ipc-reviewers,jld

Differential Revision: https://phabricator.services.mozilla.com/D173585
---
 .../src/chrome/common/ipc_channel_win.cc      | 19 +++++++++++++++++++
 .../src/chrome/common/ipc_channel_win.h       |  5 +++++
 2 files changed, 24 insertions(+)

diff --git a/ipc/chromium/src/chrome/common/ipc_channel_win.cc b/ipc/chromium/src/chrome/common/ipc_channel_win.cc
index 156d0bc6b552..5ce78898288f 100644
--- a/ipc/chromium/src/chrome/common/ipc_channel_win.cc
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.cc
@@ -115,6 +115,11 @@ void Channel::ChannelImpl::Close() {
 void Channel::ChannelImpl::CloseLocked() {
   chan_cap_.NoteExclusiveAccess();
 
+  if (connect_timeout_) {
+    connect_timeout_->Cancel();
+    connect_timeout_ = nullptr;
+  }
+
   // If we still have pending I/O, cancel it. The references inside
   // `input_state_` and `output_state_` will keep the buffers alive until they
   // complete.
@@ -316,9 +321,23 @@ bool Channel::ChannelImpl::ProcessConnection() {
   switch (err) {
     case ERROR_IO_PENDING:
       input_state_.is_pending = this;
+      NS_NewTimerWithCallback(
+          getter_AddRefs(connect_timeout_),
+          [self = RefPtr{this}](nsITimer* timer) {
+            CHROMIUM_LOG(ERROR) << "ConnectNamedPipe timed out!";
+            self->IOThread().AssertOnCurrentThread();
+            self->Close();
+            self->listener_->OnChannelError();
+          },
+          10000, nsITimer::TYPE_ONE_SHOT, "ChannelImpl::ProcessConnection",
+          IOThread().GetEventTarget());
       break;
     case ERROR_PIPE_CONNECTED:
       waiting_connect_ = false;
+      if (connect_timeout_) {
+        connect_timeout_->Cancel();
+        connect_timeout_ = nullptr;
+      }
       break;
     case ERROR_NO_DATA:
       // The pipe is being closed.
diff --git a/ipc/chromium/src/chrome/common/ipc_channel_win.h b/ipc/chromium/src/chrome/common/ipc_channel_win.h
index 91ada005282e..5c141ebe34e8 100644
--- a/ipc/chromium/src/chrome/common/ipc_channel_win.h
+++ b/ipc/chromium/src/chrome/common/ipc_channel_win.h
@@ -155,6 +155,11 @@ class Channel::ChannelImpl : public MessageLoopForIO::IOHandler {
   // buffers of this message.
   mozilla::UniquePtr<Message> incoming_message_ MOZ_GUARDED_BY(IOThread());
 
+  // Timer started when a MODE_SERVER channel begins waiting for a connection,
+  // and cancelled when the connection completes. Will produce an error if no
+  // connection occurs before the timeout.
+  nsCOMPtr<nsITimer> connect_timeout_ MOZ_GUARDED_BY(IOThread());
+
   // Will be set to `true` until `Connect()` has been called, and, if in
   // server-mode, the client has connected. The `input_state_` is used to wait
   // for the client to connect in overlapped mode.