Actually free plugin implement vars when running out of process when the

ppapi/proxy/plugin_var_tracker_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ipc/ipc_test_sink.h"
+#include "ppapi/c/dev/ppp_class_deprecated.h"
 #include "ppapi/proxy/plugin_var_tracker.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/proxy/ppapi_proxy_test.h"
+#include "ppapi/proxy/proxy_object_var.h"
 
 namespace ppapi {
 namespace proxy {
 
 namespace {
 
 PP_Var MakeObject(int32 object_id) {
   PP_Var ret;
   ret.type = PP_VARTYPE_OBJECT;
   ret.value.as_id = object_id;
   return ret;
 }
 
+// A Deallocate() function for PPP_Class that just writes 1 to the given
+// pointer so we know when Deallocate was called.
+void MarkOnDeallocate(void* object) {
+  *static_cast<int*>(object) = 1;
+}
+
+// A class that just implements MarkOnDeallocate on destruction.
+PPP_Class_Deprecated mark_on_deallocate_class = {
+  NULL,  // HasProperty,
+  NULL,  // HasMethod,
+  NULL,  // GetProperty,
+  NULL,  // GetAllPropertyNames,
+  NULL,  // SetProperty,
+  NULL,  // RemoveProperty,
+  NULL,  // Call,
+  NULL,  // Construct,
+  &MarkOnDeallocate
+};
+
 }  // namespace
 
 class PluginVarTrackerTest : public PluginProxyTest {
  public:
   PluginVarTrackerTest() {}
 
  protected:
   // Asserts that there is a unique "release object" IPC message in the test
   // sink. This will return the var ID from the message or -1 if none found.
   int32 GetObjectIDForUniqueReleaseObject() {
@@ skipping 121 matching lines @@
 
   // Now release those tracked items, the reference should be freed.
   var_tracker().StopTrackingObjectWithNoReference(plugin_var);
   EXPECT_EQ(1,
             var_tracker().GetTrackedWithNoReferenceCountForObject(plugin_var));
   var_tracker().StopTrackingObjectWithNoReference(plugin_var);
   EXPECT_EQ(-1,
             var_tracker().GetTrackedWithNoReferenceCountForObject(plugin_var));
 }
 
+// Tests that objects implemented by the plugin that have no references by
+// the plugin get their Deallocate function called on destruction.
+TEST_F(PluginVarTrackerTest, PluginObjectInstanceDeleted) {
+  PP_Var host_object = MakeObject(12345);
+  PP_Instance pp_instance = 0x12345;
+
+  int deallocate_called = 0;
+  void* user_data = &deallocate_called;
+
+  // Make a var with one reference.
+  scoped_refptr<ProxyObjectVar> object(
+      new ProxyObjectVar(plugin_dispatcher(), host_object.value.as_id));
+  PP_Var plugin_var = MakeObject(var_tracker().AddVar(object));
+  var_tracker().PluginImplementedObjectCreated(pp_instance,
+                                               plugin_var,
+                                               &mark_on_deallocate_class,
+                                               user_data);
+
+  // Release the plugin ref to the var. WebKit hasn't called destroy so
+  // we won't get a destroy call.
+  object = NULL;
+  var_tracker().ReleaseVar(plugin_var);
+  EXPECT_FALSE(deallocate_called);
+
+  // Synthesize an instance destuction, this should call Deallocate.
+  var_tracker().DidDeleteInstance(pp_instance);
+  EXPECT_TRUE(deallocate_called);
+}
+
+// Tests what happens when a plugin keeps a ref to a plugin-implemented
+// object var longer than the instance. We should not call the destructor until
+// the plugin releases its last ref.
+TEST_F(PluginVarTrackerTest, PluginObjectLeaked) {
+  PP_Var host_object = MakeObject(12345);
+  PP_Instance pp_instance = 0x12345;
+
+  int deallocate_called = 0;
+  void* user_data = &deallocate_called;
+
+  // Make a var with one reference.
+  scoped_refptr<ProxyObjectVar> object(
+      new ProxyObjectVar(plugin_dispatcher(), host_object.value.as_id));
+  PP_Var plugin_var = MakeObject(var_tracker().AddVar(object));
+  var_tracker().PluginImplementedObjectCreated(pp_instance,
+                                               plugin_var,
+                                               &mark_on_deallocate_class,
+                                               user_data);
+
+  // Destroy the innstance. This should not call deallocate since the plugin
+  // still has a ref.
+  var_tracker().DidDeleteInstance(pp_instance);
+  EXPECT_FALSE(deallocate_called);
+
+  // Release the plugin ref to the var. Since the instance is gone this should
+  // call deallocate.
+  object = NULL;
+  var_tracker().ReleaseVar(plugin_var);
+  EXPECT_TRUE(deallocate_called);
+}
+
 }  // namespace proxy
 }  // namespace ppapi