Fix a race condition in the Java Bridge when adding objects

content/browser/renderer_host/java/java_bridge_dispatcher_host.cc

Index: content/browser/renderer_host/java/java_bridge_dispatcher_host.cc
diff --git a/content/browser/renderer_host/java/java_bridge_dispatcher_host.cc b/content/browser/renderer_host/java/java_bridge_dispatcher_host.cc
index b4573054e7561eb64abcd2ad3729dc0fdbdc11bd..1e0fc100744052967c673e3ee9bd1e9cfc9d0e2a 100644
--- a/content/browser/renderer_host/java/java_bridge_dispatcher_host.cc
+++ b/content/browser/renderer_host/java/java_bridge_dispatcher_host.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/renderer_host/java/java_bridge_dispatcher_host.h"
 
+#include "base/bind.h"
 #include "content/browser/renderer_host/browser_render_process_host.h"
 #include "content/browser/renderer_host/java/java_bridge_channel_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
@@ -18,8 +19,7 @@ using content::BrowserThread;
 
 JavaBridgeDispatcherHost::JavaBridgeDispatcherHost(
     RenderViewHost* render_view_host)
-    : render_view_host_(render_view_host) {
-  DCHECK(render_view_host_);
+    : RenderViewHostObserver(render_view_host) {
 }
 
 JavaBridgeDispatcherHost::~JavaBridgeDispatcherHost() {
@@ -27,16 +27,10 @@ JavaBridgeDispatcherHost::~JavaBridgeDispatcherHost() {
 
 void JavaBridgeDispatcherHost::AddNamedObject(const string16& name,
                                               NPObject* object) {
-  // Post to the WEBKIT thread, as that's where we want injected objects to
-  // live.
-  WebKit::WebBindings::retainObject(object);
-  BrowserThread::PostTask(
-      BrowserThread::WEBKIT,
-      FROM_HERE,
-      NewRunnableMethod(this,
-                        &JavaBridgeDispatcherHost::DoAddNamedObject,
-                        name,
-                        object));
+  NPVariant_Param variant_param;
+  CreateNPVariantParam(object, &variant_param);
+  render_view_host()->Send(new JavaBridgeMsg_AddNamedObject(routing_id(), name,
+                                                            variant_param));
 }
 
 void JavaBridgeDispatcherHost::RemoveNamedObject(const string16& name) {
@@ -45,47 +39,96 @@ void JavaBridgeDispatcherHost::RemoveNamedObject(const string16& name) {
   // removed, the proxy object will delete its NPObjectProxy, which will cause
   // the NPObjectStub to be deleted, which will drop its reference to the
   // original NPObject.
-  render_view_host_->Send(new JavaBridgeMsg_RemoveNamedObject(
-      render_view_host_->routing_id(), name));
+  render_view_host()->Send(new JavaBridgeMsg_RemoveNamedObject(routing_id(),
+                                                               name));
 }
 
-void JavaBridgeDispatcherHost::DoAddNamedObject(const string16& name,
-                                                NPObject* object) {
-  EnsureChannelIsSetUp();
-
-  NPVariant variant;
-  OBJECT_TO_NPVARIANT(object, variant);
-  DCHECK_EQ(variant.type, NPVariantType_Object);
-
-  // Create an NPVariantParam suitable for serialization over IPC from our
-  // NPVariant. Internally, this will create an NPObjectStub, which takes a
-  // reference to the underlying NPObject. We pass release = true to release
-  // the ref added in AddNamedObject(). We don't need the containing window or
-  // the page URL, as we don't do re-entrant sync IPC.
-  NPVariant_Param variant_param;
-  CreateNPVariantParam(variant, channel_, &variant_param, true, 0, GURL());
-  DCHECK_EQ(variant_param.type, NPVARIANT_PARAM_SENDER_OBJECT_ROUTING_ID);
+bool JavaBridgeDispatcherHost::Send(IPC::Message* msg) {
+  return RenderViewHostObserver::Send(msg);
+}
 
-  render_view_host_->Send(new JavaBridgeMsg_AddNamedObject(
-      render_view_host_->routing_id(), name, variant_param));
+bool JavaBridgeDispatcherHost::OnMessageReceived(const IPC::Message& msg) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(JavaBridgeDispatcherHost, msg)
+    IPC_MESSAGE_HANDLER_DELAY_REPLY(JavaBridgeMsg_GetChannelHandle,
+                                    OnGetChannelHandle)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
 }
 
-void JavaBridgeDispatcherHost::EnsureChannelIsSetUp() {
-  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
-  if (channel_) {
-    return;
+void JavaBridgeDispatcherHost::OnGetChannelHandle(IPC::Message* reply_msg) {
+  // In renderer-in-process mode, this sync IPC is coming from the WEBKIT
+  // thread, so we can't post to the WEBKIT thread.
+  if (RenderProcessHost::run_renderer_in_process()) {
+    GetChannelHandle(reply_msg);
+  } else {
+    BrowserThread::PostTask(
+        BrowserThread::WEBKIT,
+        FROM_HERE,
+        base::Bind(&JavaBridgeDispatcherHost::GetChannelHandle, this,
+                   reply_msg));
   }
+}
 
-  channel_ = JavaBridgeChannelHost::GetJavaBridgeChannelHost(
-      render_view_host_->process()->id(),
-      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO));
-
+void JavaBridgeDispatcherHost::GetChannelHandle(IPC::Message* reply_msg) {
   // The channel creates the channel handle based on the renderer ID we passed
   // to GetJavaBridgeChannelHost() and, on POSIX, the file descriptor used by
   // the underlying channel.
-  IPC::ChannelHandle channel_handle = channel_->channel_handle();
+  JavaBridgeMsg_GetChannelHandle::WriteReplyParams(reply_msg,
+                                                   channel_->channel_handle());
+  Send(reply_msg);
+}
+
+void JavaBridgeDispatcherHost::CreateNPVariantParam(NPObject* object,
+                                                    NPVariant_Param* param) {
+  // The JavaBridgeChannelHost needs to be created on the WEBKIT thread, as
+  // that is where Java objects will live, and CreateNPVariantParam() needs the
+  // channel to create the NPObjectStub. To avoid blocking here until the
+  // channel is ready, create the NPVariant_Param by hand, then post a message
+  // to the WEBKIT thread to set up the channel and create the corresponding
+  // NPObjectStub. Post that message before doing any IPC, to make sure that
+  // the channel and object proxies are ready before responses are received
+  // from the renderer.
+
+  bool is_first_run = !route_id_generator_;
+  if (is_first_run) {
+    route_id_generator_ = new RouteIDGenerator();
+  }
+
+  // Create an NPVariantParam suitable for serialization over IPC from our
+  // NPVariant. See CreateNPVariantParam() in npobject_utils.
+  param->type = NPVARIANT_PARAM_SENDER_OBJECT_ROUTING_ID;
+  int route_id = route_id_generator_->GenerateRouteID();
+  param->npobject_routing_id = route_id;
+
+  WebKit::WebBindings::retainObject(object);
+  BrowserThread::PostTask(
+      BrowserThread::WEBKIT,
+      FROM_HERE,
+      base::Bind(&JavaBridgeDispatcherHost::CreateObjectStub, this, object,
+                 route_id));
+
+  if (is_first_run) {
+    render_view_host()->Send(new JavaBridgeMsg_Init(routing_id()));
+  }
+}
+
+void JavaBridgeDispatcherHost::CreateObjectStub(NPObject* object,
+                                                int route_id) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT));
+
+  if (!channel_) {
+    channel_ = JavaBridgeChannelHost::GetJavaBridgeChannelHost(
+        render_view_host()->process()->id(),
+        BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO),
+        route_id_generator_);
+  }
 
-  bool sent = render_view_host_->Send(new JavaBridgeMsg_Init(
-      render_view_host_->routing_id(), channel_handle));
-  DCHECK(sent);
+  // We don't need the containing window or the page URL, as we don't do
+  // re-entrant sync IPC.
+  new NPObjectStub(object, channel_, route_id, 0, GURL());
+  // The NPObjectStub takes a reference to the NPObject. Release the ref added
+  // in CreateNPVariantParam().
+  WebKit::WebBindings::releaseObject(object);
 }