linux: fix renderer/plugin crash when loading multiple pages with plugins

chrome/common/ipc_channel_posix.cc

 // Copyright (c) 2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/ipc_channel_posix.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stddef.h>
 #include <sys/types.h>
@@ skipping 71 matching lines @@
     AutoLock locked(lock_);
 
     ChannelToFDMap::const_iterator i = map_.find(channel_id);
     if (i == map_.end())
       return -1;
     return i->second;
   }
 
   // Remove the mapping for the given channel id. No error is signaled if the
   // channel_id doesn't exist
-  void Remove(const std::string& channel_id) {
+  void RemoveAndClose(const std::string& channel_id) {
     AutoLock locked(lock_);
 
     ChannelToFDMap::iterator i = map_.find(channel_id);
-    if (i != map_.end())
+    if (i != map_.end()) {
+      HANDLE_EINTR(close(i->second));
       map_.erase(i);
+    }
   }
 
   // Insert a mapping from @channel_id to @fd. It's a fatal error to insert a
   // mapping if one already exists for the given channel_id
   void Insert(const std::string& channel_id, int fd) {
     AutoLock locked(lock_);
     DCHECK(fd != -1);
 
     ChannelToFDMap::const_iterator i = map_.find(channel_id);
     CHECK(i == map_.end()) << "Creating second IPC server (fd " << fd << ") "
@@ skipping 156 matching lines @@
                     " mode error(" << strerror(errno) << ").";
   }
 }
 
 // static
 void AddChannelSocket(const std::string& name, int socket) {
   Singleton<PipeMap>()->Insert(name, socket);
 }
 
 // static
+void RemoveAndCloseChannelSocket(const std::string& name) {
+  Singleton<PipeMap>()->RemoveAndClose(name);
+}
+
+// static
 bool SocketPair(int* fd1, int* fd2) {
   int pipe_fds[2];
   if (socketpair(AF_UNIX, SOCK_STREAM, 0, pipe_fds) != 0) {
     LOG(ERROR) << "socketpair(): " << strerror(errno);
     return false;
   }
 
   // Set both ends to be non-blocking.
   if (fcntl(pipe_fds[0], F_SETFL, O_NONBLOCK) == -1 ||
       fcntl(pipe_fds[1], F_SETFL, O_NONBLOCK) == -1) {
@@ skipping 132 matching lines @@
         }
       } else if (bytes_read == 0) {
         // The pipe has closed...
         Close();
         return false;
       }
     }
     DCHECK(bytes_read);
 
     if (client_pipe_ != -1) {
-      Singleton<PipeMap>()->Remove(pipe_name_);
-      HANDLE_EINTR(close(client_pipe_));
+      Singleton<PipeMap>()->RemoveAndClose(pipe_name_);
       client_pipe_ = -1;
     }
 
     // a pointer to an array of |num_wire_fds| file descriptors from the read
     const int* wire_fds = NULL;
     unsigned num_wire_fds = 0;
 
     // walk the list of control messages and, if we find an array of file
     // descriptors, save a pointer to the array
 
@@ skipping 331 matching lines @@
   }
 
   // Unregister libevent for the FIFO and close it.
   read_watcher_.StopWatchingFileDescriptor();
   write_watcher_.StopWatchingFileDescriptor();
   if (pipe_ != -1) {
     HANDLE_EINTR(close(pipe_));
     pipe_ = -1;
   }
   if (client_pipe_ != -1) {
-    Singleton<PipeMap>()->Remove(pipe_name_);
-    HANDLE_EINTR(close(client_pipe_));
+    Singleton<PipeMap>()->RemoveAndClose(pipe_name_);
     client_pipe_ = -1;
   }
 
   if (uses_fifo_) {
     // Unlink the FIFO
     unlink(pipe_name_.c_str());
   }
 
   while (!output_queue_.empty()) {
     Message* m = output_queue_.front();
@@ skipping 34 matching lines @@
 
 bool Channel::Send(Message* message) {
   return channel_impl_->Send(message);
 }
 
 int Channel::GetClientFileDescriptor() const {
   return channel_impl_->GetClientFileDescriptor();
 }
 
 }  // namespace IPC