POSIX: Don't allow onunload handlers to hang a renderer forever.

chrome/renderer/render_thread.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/render_thread.h"
 
 #include <algorithm>
 #include <vector>
 
 #include "base/command_line.h"
@@ skipping 84 matching lines @@
 }
 
 void RenderThread::SendHistograms() {
   return histogram_snapshots_->SendHistograms();
 }
 
 static WebAppCacheContext* CreateAppCacheContextForRenderer() {
   return new AppCacheContextImpl(RenderThread::current());
 }
 
+#if defined(OS_POSIX)
+class SuicideOnChannelErrorFilter : public IPC::ChannelProxy::MessageFilter {

[Evan Stade, 2009/04/30 21:40:43]

lol at this name

+  void OnChannelError() {
+    // On POSIX, at least, one can install an unload handler which loops
+    // forever and leave behind a renderer process which eats 100% CPU forever.
+    //
+    // This is because the terminate signals (ViewMsg_ShouldClose and the error
+    // from the IPC channel) are routed to the main message loop but never
+    // processed (because that message loop is stuck in V8).
+    //
+    // One could make the browser SIGKILL the renderers, but that leaves open a
+    // large window where a browser failure (or a user, manually terminating
+    // the browser because "it's stuck") will leave behind a process eating all
+    // the CPU.
+    //
+    // So, we install a filter on the channel so that we can process this event
+    // here and kill the process.
+    exit(0);
+  }
+};
+#endif
+
 void RenderThread::Init() {
 #if defined(OS_WIN)
   // If you are running plugins in this thread you need COM active but in
   // the normal case you don't.
   if (RenderProcess::InProcessPlugins())
     CoInitialize(0);
 #endif
 
   ChildThread::Init();
   notification_service_.reset(new NotificationService);
   cache_stats_factory_.reset(
       new ScopedRunnableMethodFactory<RenderThread>(this));
 
   visited_link_slave_.reset(new VisitedLinkSlave());
   user_script_slave_.reset(new UserScriptSlave());
   dns_master_.reset(new RenderDnsMaster());
   histogram_snapshots_.reset(new RendererHistogramSnapshots());
   app_cache_dispatcher_.reset(new AppCacheDispatcher());
   WebAppCacheContext::SetFactory(CreateAppCacheContextForRenderer);
   devtools_agent_filter_ = new DevToolsAgentFilter();
   AddFilter(devtools_agent_filter_.get());
+
+#if defined(OS_POSIX)
+  AddFilter(new SuicideOnChannelErrorFilter);
+#endif
 }
 
 void RenderThread::CleanUp() {
   // Shutdown in reverse of the initialization order.
   RemoveFilter(devtools_agent_filter_.get());
   devtools_agent_filter_ = NULL;
   WebAppCacheContext::SetFactory(NULL);
   app_cache_dispatcher_.reset();
   histogram_snapshots_.reset();
   dns_master_.reset();
@@ skipping 206 matching lines @@
 
 void RenderThread::OnPurgePluginListCache() {
   // The call below will cause a GetPlugins call with refresh=true, but at this
   // point we already know that the browser has refreshed its list, so disable
   // refresh temporarily to prevent each renderer process causing the list to be
   // regenerated.
   plugin_refresh_allowed_ = false;
   WebKit::resetPluginCache();
   plugin_refresh_allowed_ = true;
 }