Generate dumps for relevant renderers when users kill a hung pepper plugin.

chrome/browser/ui/hung_plugin_tab_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/hung_plugin_tab_helper.h"
 
 #include "base/bind.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/process.h"
 #include "base/process_util.h"
+#include "base/rand_util.h"
 #include "build/build_config.h"
 #include "chrome/browser/api/infobars/confirm_infobar_delegate.h"
 #include "chrome/browser/infobars/infobar.h"
 #include "chrome/browser/infobars/infobar_tab_helper.h"
 #include "chrome/browser/ui/tab_contents/tab_contents.h"
 #include "chrome/common/chrome_notification_types.h"
+#include "chrome/common/chrome_version_info.h"
 #include "content/public/browser/browser_child_process_host_iterator.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_data.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/plugin_service.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/common/result_codes.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
 #include "grit/locale_settings.h"
 #include "grit/theme_resources.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 
 #if defined(OS_WIN)
+#include "base/win/scoped_handle.h"
 #include "chrome/browser/hang_monitor/hang_crash_dump_win.h"
 #endif
 
 namespace {
 
 // Delay in seconds before re-showing the hung plugin message. This will be
 // increased each time.
 const int kInitialReshowDelaySec = 10;
 
+#if defined(OS_WIN)
+
+const char kDumpChildProcessesSequenceName[] = "DumpChildProcesses";
+
+class OwnedHandleVector {
+ public:
+  OwnedHandleVector() {}
+
+  ~OwnedHandleVector() {
+    for (std::vector<HANDLE>::const_iterator iter = data_.begin();
+         iter != data_.end(); ++iter) {
+      ::CloseHandle(*iter);
+    }
+  }
+
+  std::vector<HANDLE>& data() { return data_; }
+
+ private:
+  std::vector<HANDLE> data_;
+
+  DISALLOW_COPY_AND_ASSIGN(OwnedHandleVector);
+};
+
+void DumpRenderersInBlockingPool(OwnedHandleVector* renderer_handles) {
+  for (std::vector<HANDLE>::const_iterator iter =
+           renderer_handles->data().begin();
+       iter != renderer_handles->data().end(); ++iter) {
+    CrashDumpIfProcessHandlingPepper(*iter);
+  }
+}
+
+void DumpAndTerminatePluginInBlockingPool(
+    base::win::ScopedHandle* plugin_handle) {
+  CrashDumpAndTerminateHungChildProcess(plugin_handle->Get());
+}
+
+#endif
+
 // Called on the I/O thread to actually kill the plugin with the given child
 // ID. We specifically don't want this to be a member function since if the
 // user chooses to kill the plugin, we want to kill it even if they close the
 // tab first.
 //
 // Be careful with the child_id. It's supplied by the renderer which might be
 // hacked.
 void KillPluginOnIOThread(int child_id) {
   content::BrowserChildProcessHostIterator iter(
       content::PROCESS_TYPE_PPAPI_PLUGIN);
   while (!iter.Done()) {
     const content::ChildProcessData& data = iter.GetData();
     if (data.id == child_id) {
 #if defined(OS_WIN)
-      CrashDumpAndTerminateHungChildProcess(data.handle);
+      HANDLE handle = NULL;
+      HANDLE current_process = ::GetCurrentProcess();
+      ::DuplicateHandle(current_process, data.handle, current_process, &handle,
+                        0, FALSE, DUPLICATE_SAME_ACCESS);
+      // Run it in blocking pool so that it won't block the I/O thread. Besides,
+      // we would like to make sure that it happens after dumping renderers.
+      content::BrowserThread::PostBlockingPoolSequencedTask(
+          kDumpChildProcessesSequenceName, FROM_HERE,
+          base::Bind(&DumpAndTerminatePluginInBlockingPool,
+                     base::Owned(new base::win::ScopedHandle(handle))));
 #else
       base::KillProcess(data.handle, content::RESULT_CODE_HUNG, false);
 #endif
       break;
     }
     ++iter;
   }
   // Ignore the case where we didn't find the plugin, it may have terminated
   // before this function could run.
 }
@@ skipping 167 matching lines @@
                      i->first));
 
       // Next time we do this, delay it twice as long to avoid being annoying.
       state->next_reshow_delay *= 2;
       return;
     }
   }
 }
 
 void HungPluginTabHelper::KillPlugin(int child_id) {
+#if defined(OS_WIN)
+  // Dump renderers that are sending or receiving pepper messages, in order to
+  // diagnose inter-process deadlocks.
+  // Only do that on the Canary channel, for 20% of pepper plugin hangs.
+  if (base::RandInt(0, 100) < 20) {
+    chrome::VersionInfo::Channel channel = chrome::VersionInfo::GetChannel();
+    if (channel == chrome::VersionInfo::CHANNEL_CANARY) {
+      scoped_ptr<OwnedHandleVector> renderer_handles(new OwnedHandleVector);
+      HANDLE current_process = ::GetCurrentProcess();
+      content::RenderProcessHost::iterator renderer_iter =
+          content::RenderProcessHost::AllHostsIterator();
+      for (; !renderer_iter.IsAtEnd(); renderer_iter.Advance()) {
+        content::RenderProcessHost* host = renderer_iter.GetCurrentValue();
+        HANDLE handle = NULL;
+        ::DuplicateHandle(current_process, host->GetHandle(), current_process,
+                          &handle, 0, FALSE, DUPLICATE_SAME_ACCESS);
+        renderer_handles->data().push_back(handle);
+      }
+      // If there are a lot of renderer processes, it is likely that we will
+      // generate too many crash dumps. They might not all be uploaded/recorded
+      // due to our crash dump uploading restrictions. So we just don't generate
+      // renderer crash dumps in that case.
+      if (renderer_handles->data().size() > 0 &&
+          renderer_handles->data().size() < 8) {
+        content::BrowserThread::PostBlockingPoolSequencedTask(
+            kDumpChildProcessesSequenceName, FROM_HERE,
+            base::Bind(&DumpRenderersInBlockingPool,
+                       base::Owned(renderer_handles.release())));
+      }
+    }
+  }
+#endif
+
   PluginStateMap::iterator found = hung_plugins_.find(child_id);
   if (found == hung_plugins_.end()) {
     NOTREACHED();
     return;
   }
 
   content::BrowserThread::PostTask(content::BrowserThread::IO,
                                    FROM_HERE,
                                    base::Bind(&KillPluginOnIOThread, child_id));
   CloseBar(found->second.get());
@@ skipping 30 matching lines @@
     state->info_bar = NULL;
   }
 }
 
 InfoBarTabHelper* HungPluginTabHelper::GetInfoBarHelper() {
   TabContents* tab_contents = TabContents::FromWebContents(web_contents());
   if (!tab_contents)
     return NULL;
   return tab_contents->infobar_tab_helper();
 }