Fix race condition in utility process clients

content/browser/utility_process_host.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_UTILITY_PROCESS_HOST_H_
 #define CONTENT_BROWSER_UTILITY_PROCESS_HOST_H_
 #pragma once
 
 #include <string>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "base/process_util.h"
+#include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_child_process_host_delegate.h"
 #include "content/public/browser/browser_thread.h"
 #include "ipc/ipc_message.h"
 
 class BrowserChildProcessHostImpl;
 
 // This class acts as the browser-side host to a utility child process.  A
 // utility process is a short-lived sandboxed process that is created to run
 // a specific task.  This class lives solely on the IO thread.
 // If you need a single method call in the sandbox, use StartFooBar(p).
 // If you need multiple batches of work to be done in the sandboxed process,
 // use StartBatchMode(), then multiple calls to StartFooBar(p),
 // then finish with EndBatchMode().
 class CONTENT_EXPORT UtilityProcessHost
     : public content::BrowserChildProcessHostDelegate,
-      public IPC::Message::Sender {
+      public IPC::Message::Sender,
+      public base::SupportsWeakPtr<UtilityProcessHost> {

[jam, 2012/01/26 03:56:18]

i dont think this is necessary. you can already get notified through the
Client::OnProcessCrashed callback.

[dgrogan, 2012/01/26 04:17:39]

Client::OnProcessCrashed is posted to the IO thread asynchronously but
UtilityProcessHost is deleted synchronously, so there's a tiny race condition
that could be triggered if a task is already queued up on the IO thread that
uses KeyUtilityClientImpl::utility_process_host_.

[jam, 2012/01/26 05:17:00]

ah, good point. There are other places that hang on to UtilityProcessHost. Can
you either fix them or file bugs against those owners? And also add a warning in
the header file about this issue so others don't repeat it?

[dgrogan, 2012/01/26 23:17:58]

Done.

  public:
   // An interface to be implemented by consumers of the utility process to
   // get results back.  All functions are called on the thread passed along
   // to UtilityProcessHost.
   class CONTENT_EXPORT Client : public base::RefCountedThreadSafe<Client> {
    public:
     Client();
 
     // Called when the process has crashed.
     virtual void OnProcessCrashed(int exit_code);
@@ skipping 38 matching lines @@
   // Allow these methods to be overridden for tests.
   virtual FilePath GetUtilityProcessCmd();
 
  private:
   // Starts a process if necessary.  Returns true if it succeeded or a process
   // has already been started via StartBatchMode().
   bool StartProcess();
 
   // BrowserChildProcessHost:
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
-  virtual void OnProcessCrashed(int exit_code) OVERRIDE;
+  virtual void OnProcessCrashedOrWasKilled(int exit_code) OVERRIDE;
 
   // A pointer to our client interface, who will be informed of progress.
   scoped_refptr<Client> client_;
   content::BrowserThread::ID client_thread_id_;
   // True when running in batch mode, i.e., StartBatchMode() has been called
   // and the utility process will run until EndBatchMode().
   bool is_batch_mode_;
 
   // Allows a directory to be opened through the sandbox, in case it's needed by
   // the operation.
@@ skipping 13 matching lines @@
   base::environment_vector env_;
 
   bool started_;
 
   scoped_ptr<BrowserChildProcessHostImpl> process_;
 
   DISALLOW_COPY_AND_ASSIGN(UtilityProcessHost);
 };
 
 #endif  // CONTENT_BROWSER_UTILITY_PROCESS_HOST_H_