Switch the plugin cap back to a reporting mode

webkit/plugins/npapi/webplugin_delegate_impl_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/npapi/webplugin_delegate_impl.h"
 
 #include <map>
 #include <string>
 #include <vector>
 
@@ skipping 127 matching lines @@
 base::LazyInstance<base::win::IATPatchFunction> g_iat_patch_virtual_free =
     LAZY_INSTANCE_INITIALIZER;
 BOOL (WINAPI *g_iat_orig_virtual_free)(LPVOID address,
                                        SIZE_T size,
                                        DWORD free_type);
 
 const DWORD kExecPageMask = PAGE_EXECUTE_READ;
 static volatile intptr_t g_max_exec_mem_size;
 static scoped_ptr<base::Lock> g_exec_mem_lock;
 
-bool UpdateExecMemSize(intptr_t size) {
+void UpdateExecMemSize(intptr_t size) {
   base::AutoLock locked(*g_exec_mem_lock);
 
-  const intptr_t kMaxPluginExecMemSizeSpike = 80 * 1024 * 1024;  // 80mb.
-  const DWORD kTimeLimit = 6;  // 6 minute timeout.
-
   static intptr_t s_exec_mem_size = 0;
-  static intptr_t s_exec_mem_size_old = 0;
-  static struct {
-    intptr_t size;
-    DWORD minutes;
-  } s_exec_mem_log[kTimeLimit];
-  static size_t s_old_idx;
-  static size_t s_now_idx;
-
-  DWORD now = ::GetTickCount() / (60 * 1000);
-
-  // Keep the size change history. This is done using a ring of entries with
-  // with the size and tick count
-  if (s_exec_mem_log[s_now_idx].minutes == now) {
-    s_exec_mem_log[s_now_idx].size += size;
-  } else {
-    // Move the index forward and clear the old entry if needed.
-    s_now_idx = (s_now_idx + 1) % kTimeLimit;
-    if (s_now_idx == s_old_idx) {
-      s_exec_mem_size_old = std::max(0, s_exec_mem_log[s_old_idx].size +
-                                     s_exec_mem_size_old);
-      ++s_old_idx;
-    }
-    s_exec_mem_log[s_now_idx].minutes = now;
-    s_exec_mem_log[s_now_idx].size = size;
-
-    // Expire any waiting old entries.
-    for (; s_old_idx != s_now_idx; s_old_idx = (s_old_idx + 1) % kTimeLimit) {
-      DWORD minutes = s_exec_mem_log[s_old_idx].minutes;
-      if (now - minutes < kTimeLimit)
-        break;
-      s_exec_mem_size_old = std::max(0, s_exec_mem_log[s_old_idx].size +
-                                     s_exec_mem_size_old);
-    }
-  }
 
   // Floor to zero since shutdown may unmap pages created before our hooks.
   s_exec_mem_size = std::max(0, s_exec_mem_size + size);
   if (s_exec_mem_size > g_max_exec_mem_size)
     g_max_exec_mem_size = s_exec_mem_size;
-
-
-  if ((s_exec_mem_size - s_exec_mem_size_old) > kMaxPluginExecMemSizeSpike)
-    return false;
-
-  return true;
-}
-
-// Throw a unique exception when the JIT limit is hit.
-inline void RaiseJITException() {
-  static const ULONG parameters[] = {1, 0xabad1dea /* 2880249322 */ };
-  ::RaiseException(EXCEPTION_ACCESS_VIOLATION, EXCEPTION_NONCONTINUABLE,
-                   arraysize(parameters), parameters);
 }
 
 // http://crbug.com/16114
 // Enforces providing a valid device context in NPWindow, so that NPP_SetWindow
 // is never called with NPNWindoTypeDrawable and NPWindow set to NULL.
 // Doing so allows removing NPP_SetWindow call during painting a windowless
 // plugin, which otherwise could trigger layout change while painting by
 // invoking NPN_Evaluate. Which would cause bad, bad crashes. Bad crashes.
 // TODO(dglazkov): If this approach doesn't produce regressions, move class to
 // webplugin_delegate_impl.h and implement for other platforms.
@@ skipping 172 matching lines @@
 // We need to track RX memory usage in plugins to prevent JIT spraying attacks.
 // This is done by hooking VirtualProtect and VirtualFree.
 BOOL WINAPI WebPluginDelegateImpl::VirtualProtectPatch(LPVOID address,
                                                        SIZE_T size,
                                                        DWORD new_protect,
                                                        PDWORD old_protect) {
   if (g_iat_orig_virtual_protect(address, size, new_protect, old_protect)) {
     bool is_exec = new_protect == kExecPageMask;
     bool was_exec = *old_protect == kExecPageMask;
     if (is_exec && !was_exec) {
-      if (!UpdateExecMemSize(static_cast<intptr_t>(size)))
-        RaiseJITException();
+      UpdateExecMemSize(static_cast<intptr_t>(size));
     } else if (!is_exec && was_exec) {
       UpdateExecMemSize(-(static_cast<intptr_t>(size)));
     }
 
     return TRUE;
   }
 
   return FALSE;
 }
 
@@ skipping 1304 matching lines @@
       ::ReleaseCapture();
       break;
 
     default:
       break;
   }
 }
 
 }  // namespace npapi
 }  // namespace webkit