[Mac] Do not forward graceful shutdown from child signal handlers.

chrome/browser/chrome_browser_main_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chrome_browser_main_posix.h"
 
 #include <errno.h>
 #include <limits.h>
 #include <pthread.h>
 #include <signal.h>
@@ skipping 22 matching lines @@
 #endif
 
 using content::BrowserThread;
 
 namespace {
 
 // See comment in |PreEarlyInitialization()|, where sigaction is called.
 void SIGCHLDHandler(int signal) {
 }
 
+// The OSX fork() implementation can crash in the child process before
+// fork() returns.  In that case, the shutdown pipe will still be
+// shared with the parent process.  To prevent child crashes from
+// causing parent shutdowns, |g_pipe_pid| is the pid for the process
+// which registered |g_shutdown_pipe_write_fd|.

[viettrungluu, 2013/02/25 23:15:06]

Could you include a reference to the bug(s)?

[Scott Hess - ex-Googler, 2013/02/25 23:20:46]

Done.

+pid_t g_pipe_pid = -1;
 int g_shutdown_pipe_write_fd = -1;
 int g_shutdown_pipe_read_fd = -1;
 
 // Common code between SIG{HUP, INT, TERM}Handler.
 void GracefulShutdownHandler(int signal) {
   // Reinstall the default handler.  We had one shot at graceful shutdown.
   struct sigaction action;
   memset(&action, 0, sizeof(action));
   action.sa_handler = SIG_DFL;
   RAW_CHECK(sigaction(signal, &action, NULL) == 0);
 
+  RAW_CHECK(g_pipe_pid == getpid());
   RAW_CHECK(g_shutdown_pipe_write_fd != -1);
   RAW_CHECK(g_shutdown_pipe_read_fd != -1);
   size_t bytes_written = 0;
   do {
     int rv = HANDLE_EINTR(
         write(g_shutdown_pipe_write_fd,
               reinterpret_cast<const char*>(&signal) + bytes_written,
               sizeof(signal) - bytes_written));
     RAW_CHECK(rv >= 0);
     bytes_written += rv;
@@ skipping 230 matching lines @@
 void ChromeBrowserMainPartsPosix::PostMainMessageLoopStart() {
   ChromeBrowserMainParts::PostMainMessageLoopStart();
 
   int pipefd[2];
   int ret = pipe(pipefd);
   if (ret < 0) {
     PLOG(DFATAL) << "Failed to create pipe";
   } else {
     g_shutdown_pipe_read_fd = pipefd[0];
     g_shutdown_pipe_write_fd = pipefd[1];
+    g_pipe_pid = getpid();

[viettrungluu, 2013/02/25 23:15:06]

Nit: You may as well initialize these in the same order as they're declared
(i.e., g_pipe_pid before the fds).

[Scott Hess - ex-Googler, 2013/02/25 23:20:46]

Done.

I was not willing to initialize the write fd before the read fd.  It looked too
weird.  Should have used a socketpair(), or just assumed that pipe() _is_ a
socketpair(), but  that would be creepy, too.

 #if !defined(ADDRESS_SANITIZER) && !defined(KEEP_SHADOW_STACKS)
     const size_t kShutdownDetectorThreadStackSize = PTHREAD_STACK_MIN;
 #else
     // ASan instrumentation and -finstrument-functions (used for keeping the
     // shadow stacks) bloat the stack frames, so we need to increase the stack
     // size to avoid hitting the guard page.
     const size_t kShutdownDetectorThreadStackSize = PTHREAD_STACK_MIN * 4;
 #endif
     // TODO(viettrungluu,willchan): crbug.com/29675 - This currently leaks, so
     // if you change this, you'll probably need to change the suppression.
@@ skipping 41 matching lines @@
   ChromeBrowserMainExtraPartsGtk::ShowMessageBox(
       chrome_browser::kMissingLocaleDataMessage);
 #elif defined(USE_AURA)
   // TODO(port): We may want a views based message dialog here eventually, but
   // for now, crash.
   NOTREACHED();
 #else
 #error "Need MessageBox implementation."
 #endif
 }