Generate dumps for relevant renderers when users kill a hung pepper plugin.

chrome/browser/ui/hung_plugin_tab_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/hung_plugin_tab_helper.h"
 
 #include "base/bind.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/process.h"
 #include "base/process_util.h"
+#include "base/rand_util.h"
 #include "build/build_config.h"
 #include "chrome/browser/api/infobars/confirm_infobar_delegate.h"
 #include "chrome/browser/infobars/infobar.h"
 #include "chrome/browser/infobars/infobar_tab_helper.h"
 #include "chrome/browser/ui/tab_contents/tab_contents.h"
 #include "chrome/common/chrome_notification_types.h"
+#include "chrome/common/chrome_version_info.h"
 #include "content/public/browser/browser_child_process_host_iterator.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_data.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/plugin_service.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/common/result_codes.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
 #include "grit/locale_settings.h"
 #include "grit/theme_resources.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 
 #if defined(OS_WIN)
 #include "chrome/browser/hang_monitor/hang_crash_dump_win.h"
@@ skipping 24 matching lines @@
       base::KillProcess(data.handle, content::RESULT_CODE_HUNG, false);
 #endif
       break;
     }
     ++iter;
   }
   // Ignore the case where we didn't find the plugin, it may have terminated
   // before this function could run.
 }
 
+#if defined(OS_WIN)
+class OwnedHandleVector {
+ public:
+  OwnedHandleVector() {}
+
+  ~OwnedHandleVector() {
+    for (std::vector<HANDLE>::const_iterator iter = data_.begin();
+         iter != data_.end(); ++iter) {
+      ::CloseHandle(*iter);
+    }
+  }
+
+  std::vector<HANDLE>& data() { return data_; }
+
+ private:
+  std::vector<HANDLE> data_;
+
+  DISALLOW_COPY_AND_ASSIGN(OwnedHandleVector);
+};
+
+void DumpRenderersOnIOThread(OwnedHandleVector* renderer_handles) {
+  for (std::vector<HANDLE>::const_iterator iter =
+           renderer_handles->data().begin();
+       iter != renderer_handles->data().end(); ++iter) {
+    CrashDumpIfProcessHandlingPepper(*iter);
+  }
+}
+#endif
+
 }  // namespace
 
 class HungPluginTabHelper::InfoBarDelegate : public ConfirmInfoBarDelegate {
  public:
   InfoBarDelegate(HungPluginTabHelper* helper,
                   InfoBarTabHelper* infobar_helper,
                   int plugin_child_id,
                   const string16& plugin_name);
   virtual ~InfoBarDelegate();
 
@@ skipping 156 matching lines @@
                      i->first));
 
       // Next time we do this, delay it twice as long to avoid being annoying.
       state->next_reshow_delay *= 2;
       return;
     }
   }
 }
 
 void HungPluginTabHelper::KillPlugin(int child_id) {
+#if defined(OS_WIN)
+  // Dump renderers that are sending or receiving pepper messages, in order to
+  // diagnose inter-process deadlocks.
+  // Only do that on the Canary channel, for 20% of pepper plugin hangs.
+  if (base::RandInt(0, 100) < 20) {
+    chrome::VersionInfo::Channel channel = chrome::VersionInfo::GetChannel();
+    if (channel == chrome::VersionInfo::CHANNEL_CANARY) {
+      scoped_ptr<OwnedHandleVector> renderer_handles(new OwnedHandleVector);
+      HANDLE current_process = ::GetCurrentProcess();
+      content::RenderProcessHost::iterator renderer_iter =
+          content::RenderProcessHost::AllHostsIterator();
+      for (; !renderer_iter.IsAtEnd(); renderer_iter.Advance()) {
+        content::RenderProcessHost* host = renderer_iter.GetCurrentValue();
+        HANDLE handle = NULL;
+        ::DuplicateHandle(current_process, host->GetHandle(), current_process,
+                          &handle, 0, FALSE, DUPLICATE_SAME_ACCESS);
+        renderer_handles->data().push_back(handle);
+      }
+      // If there are a lot of renderer processes, it is likely that we will
+      // generate too many crash dumps. They might not all be uploaded/recorded
+      // due to our crash dump uploading restrictions. So we just don't generate
+      // renderer crash dumps in that case.
+      if (renderer_handles->data().size() > 0 &&
+          renderer_handles->data().size() < 8) {
+        content::BrowserThread::PostTask(

[eroman, 2012/09/17 19:23:48]

Why is it necessary to duplicate the handles, and then post the task to the IO
thread?

Is your concern that dumping the child processes might block the UI thread for
too long?

At a maximum, it could be kGenerateDumpTimeoutMS * 7 = 1 minute 10 seconds.

If that is the concern though, blocking the IO thread isn't much better --
should post to a worker thread like FILE.

[yzshen1, 2012/09/17 20:11:03]

The reasons why I did it this way:
- I know that we forbid any blocking operations on the UI thread. Letting UI
stop responding for a minute is not okay. I didn't know that we strictly
disallow that on the IO thread as well.

- KillPluginOnIOThread() is called on the IO thread, since
BrowserChildProcessHostIterator should be used on that thread. I would like to
do renderer dumping on the same thread (before killing plugin). Otherwise, we
might kill the plugin first and change all the call stacks of the renderers.

- We could duplicate handle of the plugin as well and move all dumping/killing
to the FILE thread. Just more trouble. :)

Does it make sense? Thanks!

+            content::BrowserThread::IO, FROM_HERE,
+            base::Bind(&DumpRenderersOnIOThread,
+                       base::Owned(renderer_handles.release())));
+      }
+    }
+  }
+#endif
+
   PluginStateMap::iterator found = hung_plugins_.find(child_id);
   if (found == hung_plugins_.end()) {
     NOTREACHED();
     return;
   }
 
   content::BrowserThread::PostTask(content::BrowserThread::IO,
                                    FROM_HERE,
                                    base::Bind(&KillPluginOnIOThread, child_id));
   CloseBar(found->second.get());
@@ skipping 30 matching lines @@
     state->info_bar = NULL;
   }
 }
 
 InfoBarTabHelper* HungPluginTabHelper::GetInfoBarHelper() {
   TabContents* tab_contents = TabContents::FromWebContents(web_contents());
   if (!tab_contents)
     return NULL;
   return tab_contents->infobar_tab_helper();
 }