A number of poorly written IE BHO's crash IE if ChromeFrame is the currently ...

chrome_frame/buggy_bho_handling.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/buggy_bho_handling.h"
 
-#include "base/logging.h"
+#include "base/lazy_instance.h"
 #include "base/scoped_comptr_win.h"
-
 #include "chrome_frame/exception_barrier.h"
 #include "chrome_frame/function_stub.h"
+#include "chrome_frame/urlmon_moniker.h"
 #include "chrome_frame/utils.h"
 #include "chrome_frame/vtable_patch_manager.h"
 
 namespace buggy_bho {
 
-base::ThreadLocalPointer<BuggyBhoTls> BuggyBhoTls::s_bad_object_tls_;
+base::LazyInstance<BuggyBhoHandler>
+    g_buggy_bho_handler(base::LINKER_INITIALIZED);
 
 struct ModuleAndVersion {
   const char* module_name_;
   const uint32 major_version_;
   const uint32 minor_version_;
 };
 
 const ModuleAndVersion kBuggyModules[] = {
   { "askbar.dll", 4, 1 },  // troublemaker: 4.1.0.5.
   { "gbieh.dll", 3, 8 },  // troublemaker: 3.8.14.12
@@ skipping 40 matching lines @@
           (HIWORD(version) == buggy.major_version_ &&
            LOWORD(version) <= buggy.minor_version_)) {
         return true;
       }
     }
   }
 
   return false;
 }
 
-BuggyBhoTls::BuggyBhoTls() : previous_instance_(s_bad_object_tls_.Get()) {
-  s_bad_object_tls_.Set(this);
+BuggyBhoHandler::BuggyBhoHandler() {
 }
 
-BuggyBhoTls::~BuggyBhoTls() {
-  DCHECK(FromCurrentThread() == this);
-  s_bad_object_tls_.Set(previous_instance_);
+BuggyBhoHandler::~BuggyBhoHandler() {
 }
 
-void BuggyBhoTls::AddBuggyObject(IDispatch* obj) {
-  bad_objects_.push_back(obj);
+BuggyBhoHandler* BuggyBhoHandler::GetInstance() {
+  return g_buggy_bho_handler.Pointer();
 }
 
-bool BuggyBhoTls::IsBuggyObject(IDispatch* obj) const {
-  return std::find(bad_objects_.begin(), bad_objects_.end(), obj) !=
-         bad_objects_.end();
+void BuggyBhoHandler::ClearBuggyObjectsForThread(
+    base::PlatformThreadId thread_id) {
+  DCHECK(GetInstance())
+      << "You must first have an instance of BuggyBhoHandler.";
+
+  base::AutoLock lock(GetInstance()->lock_);

[tommi (sloooow) - chröme, 2011/02/11 14:49:02]

If you store the object list in the tls, you wouldn't need this lock and no
thread_id is needed.

+
+  std::vector<ObjectInfo>::iterator index =
+      GetInstance()->bad_objects_.begin();
+  while (index != GetInstance()->bad_objects_.end()) {
+    if (index->object_thread_id == thread_id) {
+      index = GetInstance()->bad_objects_.erase(index);
+    } else {
+      ++index;
+    }
+  }
+}
+
+void BuggyBhoHandler::AddBuggyObject(IDispatch* obj) {
+  base::AutoLock lock(lock_);
+  ObjectInfo object_info;
+  object_info.disp_interface = obj;
+  object_info.object_thread_id = base::PlatformThread::CurrentId();
+  bad_objects_.push_back(object_info);
+}
+
+bool BuggyBhoHandler::ShouldSkipInvoke(IDispatch* obj) {
+  NavigationManager* navigation_mgr = NavigationManager::GetThreadInstance();
+  DCHECK(navigation_mgr);
+  if (navigation_mgr && IsChromeFrameDocument(navigation_mgr->web_browser())) {
+    base::AutoLock lock(lock_);
+    std::vector<ObjectInfo>::iterator index;
+    for (index = bad_objects_.begin(); index != bad_objects_.end(); ++index) {
+      if (index->disp_interface == obj)
+        return true;
+    }
+  }
+  return false;
 }
 
 // static
-BuggyBhoTls* BuggyBhoTls::FromCurrentThread() {
-  return s_bad_object_tls_.Get();
-}
-
-// static
-STDMETHODIMP BuggyBhoTls::BuggyBhoInvoke(InvokeFunc original, IDispatch* me,
+STDMETHODIMP BuggyBhoHandler::BuggyBhoInvoke(InvokeFunc original, IDispatch* me,
                                          DISPID dispid, REFIID riid, LCID lcid,
                                          WORD flags, DISPPARAMS* params,
                                          VARIANT* result, EXCEPINFO* ei,
                                          UINT* err) {
   DVLOG(1) << __FUNCTION__;
 
-  const BuggyBhoTls* tls = BuggyBhoTls::FromCurrentThread();
-  if (tls && tls->IsBuggyObject(me)) {
+  DCHECK(GetInstance())
+      << "You must first have an instance of BuggyBhoHandler.";
+
+  if (GetInstance()->ShouldSkipInvoke(me)) {
     // Ignore this call and avoid the bug.
     // TODO(tommi): Maybe we should check a specific list of DISPIDs too?
     return S_OK;
   }
 
   // No need to report crashes in those known-to-be-buggy DLLs.
   ExceptionBarrierReportOnlyModule barrier;
   return original(me, dispid, riid, lcid, flags, params, result, ei, err);
 }
 
 // static
-HRESULT BuggyBhoTls::PatchInvokeMethod(PROC* invoke) {
+HRESULT BuggyBhoHandler::PatchInvokeMethod(PROC* invoke) {
   CCritSecLock lock(_pAtlModule->m_csStaticDataInitAndTypeInfo.m_sec, true);
 
   FunctionStub* stub = FunctionStub::FromCode(*invoke);
   if (stub)
     return S_FALSE;
 
   DWORD flags = 0;
   if (!::VirtualProtect(invoke, sizeof(PROC), PAGE_EXECUTE_READWRITE, &flags))
     return AtlHresultFromLastError();
 
@@ skipping 14 matching lines @@
       ::FlushInstructionCache(::GetCurrentProcess(), invoke, sizeof(PROC));
     }
   }
 
   ::VirtualProtect(invoke, sizeof(PROC), flags, &flags);
 
   return hr;
 }
 
 // static
-bool BuggyBhoTls::PatchIfBuggy(CONNECTDATA* cd, const IID& diid) {
+bool BuggyBhoHandler::PatchIfBuggy(CONNECTDATA* cd, const IID& diid) {
   DCHECK(cd);
   PROC* methods = *reinterpret_cast<PROC**>(cd->pUnk);
   HMODULE mod = GetModuleFromAddress(methods[0]);
   if (!IsBuggyBho(mod))
     return false;
 
   ScopedComPtr<IDispatch> disp;
   HRESULT hr = cd->pUnk->QueryInterface(diid,
       reinterpret_cast<void**>(disp.Receive()));
   if (FAILED(hr))  // Sometimes only IDispatch QI is supported
     hr = disp.QueryFrom(cd->pUnk);
   DCHECK(SUCCEEDED(hr));
 
   if (SUCCEEDED(hr)) {
     const int kInvokeIndex = 6;
     DCHECK(static_cast<IUnknown*>(disp) == cd->pUnk);
     if (SUCCEEDED(PatchInvokeMethod(&methods[kInvokeIndex]))) {
-      BuggyBhoTls* tls = BuggyBhoTls::FromCurrentThread();
-      DCHECK(tls);
-      if (tls) {
-        tls->AddBuggyObject(disp);
-      }
+      BuggyBhoHandler* instance = GetInstance();
+      DCHECK(instance);
+      instance->AddBuggyObject(disp);
     }
   }
 
   return false;
 }
 
 // static
-HRESULT BuggyBhoTls::PatchBuggyBHOs(IWebBrowser2* browser) {
+HRESULT BuggyBhoHandler::PatchBuggyBHOs(IWebBrowser2* browser) {
   DCHECK(browser);
-  DCHECK(BuggyBhoTls::FromCurrentThread())
-      << "You must first have an instance of BuggyBhoTls on this thread";
+  DCHECK(GetInstance())
+      << "You must first have an instance of BuggyBhoHandler.";
+  // Serialized as we could be called from multiple threads and the same BHO
+  // could be loaded in multiple IE windows.
+  base::AutoLock lock(GetInstance()->lock_);
 
   ScopedComPtr<IConnectionPointContainer> cpc;
   HRESULT hr = cpc.QueryFrom(browser);
   if (SUCCEEDED(hr)) {
     const GUID sinks[] = { DIID_DWebBrowserEvents2, DIID_DWebBrowserEvents };
     for (size_t i = 0; i < arraysize(sinks); ++i) {
       ScopedComPtr<IConnectionPoint> cp;
       cpc->FindConnectionPoint(sinks[i], cp.Receive());
       if (cp) {
         ScopedComPtr<IEnumConnections> connections;
         cp->EnumConnections(connections.Receive());
         if (connections) {
           CONNECTDATA cd = {0};
           DWORD fetched = 0;
           while (connections->Next(1, &cd, &fetched) == S_OK && fetched) {
             PatchIfBuggy(&cd, sinks[i]);
             cd.pUnk->Release();
             fetched = 0;
           }
         }
       }
     }
   }
-
   return hr;
 }
 
 }  // end namespace buggy_bho