Kill bad apps.

extensions/browser/guest_view/app_view/app_view_guest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/guest_view/app_view/app_view_guest.h"
 
 #include "base/command_line.h"
 #include "components/guest_view/browser/guest_view_manager.h"
-#include "content/public/browser/render_view_host.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/browser/user_metrics.h"
 #include "content/public/common/renderer_preferences.h"
 #include "extensions/browser/api/app_runtime/app_runtime_api.h"
 #include "extensions/browser/api/extensions_api_client.h"
 #include "extensions/browser/app_window/app_delegate.h"
 #include "extensions/browser/event_router.h"
 #include "extensions/browser/extension_host.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/guest_view/app_view/app_view_constants.h"
 #include "extensions/browser/lazy_background_task_queue.h"
 #include "extensions/browser/process_manager.h"
@@ skipping 26 matching lines @@
         app_view_guest(app_view_guest),
         callback(callback) {}
 
   ~ResponseInfo() {}
 };
 
 typedef std::map<int, linked_ptr<ResponseInfo> > PendingResponseMap;
 static base::LazyInstance<PendingResponseMap> pending_response_map =
     LAZY_INSTANCE_INITIALIZER;
 
+void KillRenderProcessHostAndRecordUMAMetric(int render_process_host_id) {
+  content::RecordAction(
+      base::UserMetricsAction("BadExtensionTerminate_AppViewTag"));
+  content::RenderProcessHost::FromID(render_process_host_id)
+      ->Shutdown(-1, false);
+}
+
 }  // namespace
 
 // static.
 const char AppViewGuest::Type[] = "appview";
 
 // static.
 bool AppViewGuest::CompletePendingRequest(
     content::BrowserContext* browser_context,
     const GURL& url,
     int guest_instance_id,
-    const std::string& guest_extension_id) {
+    const std::string& guest_extension_id,
+    int guest_render_process_host_id) {
   PendingResponseMap* response_map = pending_response_map.Pointer();
   PendingResponseMap::iterator it = response_map->find(guest_instance_id);
   if (it == response_map->end()) {
-    // TODO(fsamuel): An app is sending invalid responses. We should probably
-    // kill it.
+    // The app is asking for a non-existent <appview>.
+    KillRenderProcessHostAndRecordUMAMetric(guest_render_process_host_id);
     return false;
   }
 
   linked_ptr<ResponseInfo> response_info = it->second;
   if (!response_info->app_view_guest ||
       (response_info->guest_extension->id() != guest_extension_id)) {
-    // TODO(fsamuel): An app is trying to respond to an <appview> that didn't
-    // initiate communication with it. We should kill the app here.
+    // The app is trying to communicate with an <appview> not assigned to it.
+    KillRenderProcessHostAndRecordUMAMetric(guest_render_process_host_id);
     return false;
   }
 
   response_info->app_view_guest->CompleteCreateWebContents(
       url, response_info->guest_extension.get(), response_info->callback);
 
   response_map->erase(guest_instance_id);
   return true;
 }
 
@@ skipping 173 matching lines @@
   embed_request->SetString(appview::kEmbedderID, owner_host());
   embed_request->Set(appview::kData, data.release());
   AppRuntimeEventRouter::DispatchOnEmbedRequestedEvent(
       browser_context(), embed_request.Pass(), extension_host->extension());
 }
 
 void AppViewGuest::SetAppDelegateForTest(AppDelegate* delegate) {
   app_delegate_.reset(delegate);
 }
 
+// static
+base::WeakPtr<AppViewGuest>
+AppViewGuest::GetAppViewGuestFromExtensionIdForTesting(
+    const std::string& extension_id) {
+  for (auto it = pending_response_map.Get().begin();
+       it != pending_response_map.Get().end(); ++it) {
+    if (it->second->guest_extension->id() == extension_id) {
+      return it->second->app_view_guest->weak_ptr_factory_.GetWeakPtr();
+    }
+  }
+  return base::WeakPtr<AppViewGuest>();
+}
+
+void AppViewGuest::SetAppViewGuestForExtensionIdForTesting(
+    const std::string& extension_id,
+    base::WeakPtr<AppViewGuest> weak_ptr) {
+  for (auto it = pending_response_map.Get().begin();
+       it != pending_response_map.Get().end(); ++it) {
+    if (it->second->guest_extension->id() == extension_id) {
+      it->second->app_view_guest = weak_ptr;
+    }
+  }
+}
+
+std::vector<int> AppViewGuest::GetAllRegisteredInstanceIdsForTesting() {
+  std::vector<int> instances;
+  for (auto it = pending_response_map.Get().begin();
+       it != pending_response_map.Get().end(); ++it) {
+    instances.push_back(it->first);
+  }
+  return instances;
+}
+
 }  // namespace extensions