Prevent reentrant destructors in the PluginModule.

ppapi/proxy/host_dispatcher.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/host_dispatcher.h"
 
 #include <map>
 
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
@@ skipping 116 matching lines @@
 }
 
 bool HostDispatcher::IsPlugin() const {
   return false;
 }
 
 bool HostDispatcher::Send(IPC::Message* msg) {
   TRACE_EVENT2("ppapi proxy", "HostDispatcher::Send",
                "Class", IPC_MESSAGE_ID_CLASS(msg->type()),
                "Line", IPC_MESSAGE_ID_LINE(msg->type()));
-  // Prevent the dispatcher from going away during the call. Scenarios
-  // where this could happen include a Send for a sync message which while
-  // waiting for the reply, dispatches an incoming ExecuteScript call which
-  // destroys the plugin module and in turn the dispatcher.
-  ScopedModuleReference ref(this);
 
   // Normal sync messages are set to unblock, which would normally cause the
   // plugin to be reentered to process them. We only want to do this when we
   // know the plugin is in a state to accept reentrancy. Since the plugin side
   // never clears this flag on messages it sends, we can't get deadlock, but we
   // may still get reentrancy in the host as a result.
-
   if (!allow_plugin_reentrancy_)
     msg->set_unblock(false);
-  return Dispatcher::Send(msg);
+
+  if (msg->is_sync()) {
+    // Don't allow sending sync messages during module shutdown. Seee the "else"
+    // block below for why.
+    CHECK(!PP_ToBool(ppb_proxy()->IsInModuleDestructor(pp_module())));
+
+    // Prevent the dispatcher from going away during sync calls. Scenarios
+    // where this could happen include a Send for a sync message which while
+    // waiting for the reply, dispatches an incoming ExecuteScript call which
+    // destroys the plugin module and in turn the dispatcher.
+    ScopedModuleReference scoped_ref(this);
+    return Dispatcher::Send(msg);
+  } else {
+    // We don't want to have a scoped ref for async message cases since since
+    // async messages are sent during module desruction. In this case, the
+    // module will have a 0 refcount and addrefing and releasing it will
+    // reenter the destructor and it will crash.
+    return Dispatcher::Send(msg);
+  }
 }
 
 bool HostDispatcher::OnMessageReceived(const IPC::Message& msg) {
   TRACE_EVENT2("ppapi proxy", "HostDispatcher::OnMessageReceived",
                "Class", IPC_MESSAGE_ID_CLASS(msg.type()),
                "Line", IPC_MESSAGE_ID_LINE(msg.type()));
   // We only want to allow reentrancy when the most recent message from the
   // plugin was a scripting message. We save the old state of the flag on the
   // stack in case we're (we are the host) being reentered ourselves. The flag
   // is set to false here for all messages, and then the scripting API will
@@ skipping 50 matching lines @@
   dispatcher_ = static_cast<HostDispatcher*>(dispatcher);
   dispatcher_->ppb_proxy()->AddRefModule(dispatcher_->pp_module());
 }
 
 ScopedModuleReference::~ScopedModuleReference() {
   dispatcher_->ppb_proxy()->ReleaseModule(dispatcher_->pp_module());
 }
 
 }  // namespace proxy
 }  // namespace ppapi