Never connect a port to the same frame

chrome/browser/extensions/api/messaging/message_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/messaging/message_service.h"
 
 #include <stdint.h>
 #include <limits>
 #include <utility>
 
@@ skipping 175 matching lines @@
     BrowserContext* context,
     const std::string& extension_id) {
   scoped_refptr<SiteInstance> site_instance =
       ProcessManager::Get(context)->GetSiteInstanceForURL(
           Extension::GetBaseURLFromExtensionId(extension_id));
   return site_instance->HasProcess() ? site_instance->GetProcess() : NULL;
 }
 
 }  // namespace
 
+void MessageService::MessagePort::RemoveCommonFrames(const MessagePort& port) {}
+
+bool MessageService::MessagePort::HasFrame(
+    content::RenderFrameHost* rfh) const {
+  return false;
+}
+
 // static
 void MessageService::AllocatePortIdPair(int* port1, int* port2) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   unsigned channel_id = static_cast<unsigned>(g_next_channel_id.GetNext()) %
                         (std::numeric_limits<int32_t>::max() / 2);
   unsigned port1_id = channel_id * 2;
   unsigned port2_id = channel_id * 2 + 1;
 
   // Sanity checks to make sure our channel<->port converters are correct.
@@ skipping 356 matching lines @@
     return;
   }
 
   scoped_ptr<MessagePort> opener(
       new ExtensionMessagePort(weak_factory_.GetWeakPtr(),
                                GET_OPPOSITE_PORT_ID(params->receiver_port_id),
                                params->source_extension_id, source, false));
   if (!opener->IsValidPort())
     return;
 
+  params->receiver->RemoveCommonFrames(*opener);
+  if (!params->receiver->IsValidPort()) {
+    opener->DispatchOnDisconnect(kReceivingEndDoesntExistError);
+    return;
+  }
+
   MessageChannel* channel(new MessageChannel());
   channel->opener.reset(opener.release());
   channel->receiver.reset(params->receiver.release());
   AddChannel(channel, params->receiver_port_id);
 
   // TODO(robwu): Could |guest_process_id| and |guest_render_frame_routing_id|
   // be removed? In the past extension message routing was process-based, but
   // now that extensions are routed from a specific RFH, the special casing for
   // guest views seems no longer necessary, because the ExtensionMessagePort can
   // simply obtain the source process & frame ID directly from the RFH.
@@ skipping 119 matching lines @@
 }
 
 void MessageService::CloseChannelImpl(
     MessageChannelMap::iterator channel_iter,
     int closing_port_id,
     const std::string& error_message,
     bool notify_other_port) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   MessageChannel* channel = channel_iter->second;
+  // Remove from map to make sure that it is impossible for CloseChannelImpl to
+  // run twice for the same channel.
+  channels_.erase(channel_iter);
 
   // Notify the other side.
   if (notify_other_port) {
     MessagePort* port = IS_OPENER_PORT_ID(closing_port_id) ?
         channel->receiver.get() : channel->opener.get();
     port->DispatchOnDisconnect(error_message);
   }
 
   // Balance the IncrementLazyKeepaliveCount() in OpenChannelImpl.
   channel->opener->DecrementLazyKeepaliveCount();
   channel->receiver->DecrementLazyKeepaliveCount();
 
-  delete channel_iter->second;
-  channels_.erase(channel_iter);
+  delete channel;
 }
 
 void MessageService::PostMessage(int source_port_id, const Message& message) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   int channel_id = GET_CHANNEL_ID(source_port_id);
   MessageChannelMap::iterator iter = channels_.find(channel_id);
   if (iter == channels_.end()) {
     // If this channel is pending, queue up the PostMessage to run once
     // the channel opens.
@@ skipping 258 matching lines @@
 
   MessageChannelMap::iterator channel_iter = channels_.find(channel_id);
   if (channel_iter != channels_.end()) {
     for (const PendingMessage& message : queue) {
       DispatchMessage(message.first, channel_iter->second, message.second);
     }
   }
 }
 
 }  // namespace extensions