Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(420)

Side by Side Diff: content/browser/renderer_host/render_view_host_impl.h

Issue 1345353003: Fix detection of RenderViewHosts pending deletion in CreateRenderViewHost. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Fix UAFs due to SwapOut timer calling OnSwappedOut in the middle of test. Created 5 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_ 5 #ifndef CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_
6 #define CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_ 6 #define CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_
7 7
8 #include <map> 8 #include <map>
9 #include <string> 9 #include <string>
10 #include <vector> 10 #include <vector>
(...skipping 203 matching lines...) Expand 10 before | Expand all | Expand 10 after
214 base::TerminationStatus render_view_termination_status() const { 214 base::TerminationStatus render_view_termination_status() const {
215 return render_view_termination_status_; 215 return render_view_termination_status_;
216 } 216 }
217 217
218 // Tracks whether this RenderViewHost is in an active state (rather than 218 // Tracks whether this RenderViewHost is in an active state (rather than
219 // pending swap out, pending deletion, or swapped out), according to its main 219 // pending swap out, pending deletion, or swapped out), according to its main
220 // frame RenderFrameHost. 220 // frame RenderFrameHost.
221 bool is_active() const { return is_active_; } 221 bool is_active() const { return is_active_; }
222 void set_is_active(bool is_active) { is_active_ = is_active; } 222 void set_is_active(bool is_active) { is_active_ = is_active; }
223 223
224 // Tracks whether this RenderViewHost is pending deletion. This is tracked
225 // separately from the main frame pending deletion state, because the
226 // RenderViewHost's main frame is cleared when the main frame's
227 // RenderFrameHost is marked for deletion.
228 //
229 // TODO(nasko,alexmos): This should not be necessary once swapped-out is
230 // removed.
231 bool is_pending_deletion() const { return is_pending_deletion_; }
232 void set_pending_deletion() { is_pending_deletion_ = true; }
233
224 // Tracks whether this RenderViewHost is swapped out, according to its main 234 // Tracks whether this RenderViewHost is swapped out, according to its main
225 // frame RenderFrameHost. 235 // frame RenderFrameHost.
226 void set_is_swapped_out(bool is_swapped_out) { 236 void set_is_swapped_out(bool is_swapped_out) {
227 is_swapped_out_ = is_swapped_out; 237 is_swapped_out_ = is_swapped_out;
228 } 238 }
229 239
230 // TODO(creis): Remove as part of http://crbug.com/418265. 240 // TODO(creis): Remove as part of http://crbug.com/418265.
231 bool is_waiting_for_close_ack() const { return is_waiting_for_close_ack_; } 241 bool is_waiting_for_close_ack() const { return is_waiting_for_close_ack_; }
232 242
233 // Tells the renderer that this RenderView will soon be swapped out, and thus 243 // Tells the renderer that this RenderView will soon be swapped out, and thus
(...skipping 202 matching lines...) Expand 10 before | Expand all | Expand 10 after
436 // The unique ID of the latest NavigationEntry that this RenderViewHost is 446 // The unique ID of the latest NavigationEntry that this RenderViewHost is
437 // showing. TODO(avi): Move to RenderFrameHost once PageState is broken up 447 // showing. TODO(avi): Move to RenderFrameHost once PageState is broken up
438 // into FrameStates. 448 // into FrameStates.
439 int nav_entry_id_; 449 int nav_entry_id_;
440 450
441 // Tracks whether this RenderViewHost is in an active state. False if the 451 // Tracks whether this RenderViewHost is in an active state. False if the
442 // main frame is pending swap out, pending deletion, or swapped out, because 452 // main frame is pending swap out, pending deletion, or swapped out, because
443 // it is not visible to the user in any of these cases. 453 // it is not visible to the user in any of these cases.
444 bool is_active_; 454 bool is_active_;
445 455
456 // True if this RenderViewHost is pending deletion.
457 bool is_pending_deletion_;
458
446 // Tracks whether the main frame RenderFrameHost is swapped out. Unlike 459 // Tracks whether the main frame RenderFrameHost is swapped out. Unlike
447 // is_active_, this is false when the frame is pending swap out or deletion. 460 // is_active_, this is false when the frame is pending swap out or deletion.
448 // TODO(creis): Remove this when we no longer use swappedout://. 461 // TODO(creis): Remove this when we no longer use swappedout://.
449 // See http://crbug.com/357747. 462 // See http://crbug.com/357747.
450 bool is_swapped_out_; 463 bool is_swapped_out_;
451 464
452 // Routing ID for the main frame's RenderFrameHost. 465 // Routing ID for the main frame's RenderFrameHost.
453 int main_frame_routing_id_; 466 int main_frame_routing_id_;
454 467
455 // Set to true when waiting for a ViewHostMsg_ClosePageACK. 468 // Set to true when waiting for a ViewHostMsg_ClosePageACK.
(...skipping 25 matching lines...) Expand all
481 DISALLOW_COPY_AND_ASSIGN(RenderViewHostImpl); 494 DISALLOW_COPY_AND_ASSIGN(RenderViewHostImpl);
482 }; 495 };
483 496
484 #if defined(COMPILER_MSVC) 497 #if defined(COMPILER_MSVC)
485 #pragma warning(pop) 498 #pragma warning(pop)
486 #endif 499 #endif
487 500
488 } // namespace content 501 } // namespace content
489 502
490 #endif // CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_ 503 #endif // CONTENT_BROWSER_RENDERER_HOST_RENDER_VIEW_HOST_IMPL_H_
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698