Fix in process PPAPI decryption.

ppapi/proxy/ppp_content_decryptor_private_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/ppp_content_decryptor_private_proxy.h"
 
 #include "base/platform_file.h"
 #include "ppapi/c/pp_bool.h"
 #include "ppapi/c/ppb_core.h"
 #include "ppapi/proxy/content_decryptor_private_serializer.h"
@@ skipping 57 matching lines @@
 // SerializedVarReceiveInput will decrement the reference count, but we want
 // to give the recipient a reference. This utility function takes care of that
 // work for the message handlers defined below.
 PP_Var ExtractReceivedVarAndAddRef(Dispatcher* dispatcher,
                                    SerializedVarReceiveInput* serialized_var) {
   PP_Var var = serialized_var->Get(dispatcher);
   PpapiGlobals::Get()->GetVarTracker()->AddRefVar(var);
   return var;
 }
 
-// Increments the reference count on |resource| to ensure that it remains valid
-// until the plugin receives the resource within the asynchronous message sent
-// from the proxy.  The plugin side takes ownership of that reference. Returns
-// PP_TRUE when the reference is successfully added, PP_FALSE otherwise.
-PP_Bool AddRefResourceForPlugin(HostDispatcher* dispatcher,
-                                PP_Resource resource) {
-  const PPB_Core* core = static_cast<const PPB_Core*>(
-      dispatcher->local_get_interface()(PPB_CORE_INTERFACE));
-  if (!core) {
-    NOTREACHED();
-    return PP_FALSE;
-  }
-  core->AddRefResource(resource);
-  return PP_TRUE;
-}

[dmichael (off chromium), 2012/12/13 19:20:35]

I was confused when reading the CL...  I think this AddRef still needs to
happen. What you're doing here is making sure that the Buffer Resource stays
valid long enough for the Plugin to take it. The messages you send (e.g., to
Decrypt) are asynchronous. If you don't AddRef them before sending them, I think
it's possible that the Buffer will be released before the plugin is done with
it.

I think you want to AddRef here (or maybe just before you send it, to make it
easier to balance?).

Maybe AddRefing right before you send, then RemoveRef on the plugin side right
after you call the related PPP function.

-
 bool InitializePppDecryptorBuffer(PP_Instance instance,
                                   HostDispatcher* dispatcher,
                                   PP_Resource resource,
                                   PPPDecryptor_Buffer* buffer) {
   if (!buffer) {
     NOTREACHED();
     return false;
   }
 
   if (resource == 0) {
     buffer->resource = HostResource();
     buffer->handle = base::SharedMemoryHandle();
     buffer->size = 0;
     return true;
   }
 
-  if (!AddRefResourceForPlugin(dispatcher, resource))
-    return false;
-
   HostResource host_resource;
   host_resource.SetHostResource(instance, resource);
 
   uint32_t size = 0;
   if (DescribeHostBufferResource(resource, &size) == PP_FALSE)
     return false;
 
   base::SharedMemoryHandle handle;
   if (ShareHostBufferResourceToPlugin(dispatcher,
                                       resource,
@@ skipping 444 matching lines @@
         ppp_decryptor_impl_->DecryptAndDecode,
         instance,
         decoder_type,
         plugin_resource,
         const_cast<const PP_EncryptedBlockInfo*>(&block_info));
   }
 }
 
 }  // namespace proxy
 }  // namespace ppapi