Merge 22369 - Fix plugin IPC issues....

webkit/glue/webplugin_impl.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Event.h"
 #include "EventNames.h"
@@ skipping 101 matching lines @@
       NOTREACHED();
       return;
     }
 
     resource_response_ = response;
   }
 
   // Receives individual part data from a multipart response.
   virtual void didReceiveData(
       WebURLLoader*, const char* data, int data_size, long long) {
+    // TODO(ananta)
+    // We should defer further loads on multipart resources on the same lines
+    // as regular resources requested by plugins to prevent reentrancy.
     resource_client_->DidReceiveData(
         data, data_size, byte_range_lower_bound_);
   }
 
   virtual void didFinishLoading(WebURLLoader*) {}
   virtual void didFail(WebURLLoader*, const WebURLError&) {}
 
   void Clear() {
     resource_response_.reset();
     byte_range_lower_bound_ = 0;
@@ skipping 336 matching lines @@
     delegate_->SendJavaScriptStream(url, wresult, succ, notify_needed,
                                     notify_data);
 
   return succ;
 }
 
 void WebPluginImpl::CancelResource(int id) {
   for (size_t i = 0; i < clients_.size(); ++i) {
     if (clients_[i].id == id) {
       if (clients_[i].loader.get()) {
+        clients_[i].loader->setDefersLoading(false);
         clients_[i].loader->cancel();
         RemoveClient(i);
       }
       return;
     }
   }
 }
 
 bool WebPluginImpl::SetPostData(WebURLRequest* request,
                                 const char *buf,
@@ skipping 416 matching lines @@
   if (!delegate_->HandleInputEvent(web_event, &cursor_info))
     event->setDefaultHandled();
 }
 
 NPObject* WebPluginImpl::GetPluginScriptableObject() {
   return delegate_->GetPluginScriptableObject();
 }
 
 WebPluginResourceClient* WebPluginImpl::GetClientFromLoader(
     WebURLLoader* loader) {
+  ClientInfo* client_info = GetClientInfoFromLoader(loader);
+  if (client_info)
+    return client_info->client;
+  return NULL;
+}
+
+WebPluginImpl::ClientInfo* WebPluginImpl::GetClientInfoFromLoader(
+    WebURLLoader* loader) {
   for (size_t i = 0; i < clients_.size(); ++i) {
     if (clients_[i].loader.get() == loader)
-      return clients_[i].client;
+      return &clients_[i];
   }
 
   NOTREACHED();
   return 0;
 }
 
-
 void WebPluginImpl::willSendRequest(WebURLLoader* loader,
                                     WebURLRequest& request,
                                     const WebURLResponse&) {
   WebPluginResourceClient* client = GetClientFromLoader(loader);
   if (client)
     client->WillSendRequest(request.url());
 }
 
 void WebPluginImpl::didSendData(WebURLLoader* loader,
                                 unsigned long long bytes_sent,
@@ skipping 54 matching lines @@
           clients_[i].client = resource_client;
           client = resource_client;
           break;
         }
       }
 
       DCHECK(client != NULL);
     }
   }
 
+  // Calling into a plugin could result in reentrancy if the plugin yields
+  // control to the OS like entering a modal loop etc. Prevent this by
+  // stopping further loading until the plugin notifies us that it is ready to
+  // accept data
+  loader->setDefersLoading(true);
+
   client->DidReceiveResponse(
       base::SysWideToNativeMB(http_response_info.mime_type),
       base::SysWideToNativeMB(GetAllHeaders(resource_response)),
       http_response_info.expected_length,
-      http_response_info.last_modified, request_is_seekable, &cancel);
-
-  if (cancel) {
-    loader->cancel();
-    RemoveClient(loader);
-    return;
-  }
+      http_response_info.last_modified, request_is_seekable);
 
   // Bug http://b/issue?id=925559. The flash plugin would not handle the HTTP
   // error codes in the stream header and as a result, was unaware of the
   // fate of the HTTP requests issued via NPN_GetURLNotify. Webkit and FF
   // destroy the stream and invoke the NPP_DestroyStream function on the
   // plugin if the HTTP request fails.
   const GURL& url = response.url();
   if (url.SchemeIs("http") || url.SchemeIs("https")) {
     if (response.httpStatusCode() < 100 || response.httpStatusCode() >= 400) {
       // The plugin instance could be in the process of deletion here.
@@ skipping 15 matching lines @@
   WebPluginResourceClient* client = GetClientFromLoader(loader);
   if (!client)
     return;
   MultiPartResponseHandlerMap::iterator index =
       multi_part_response_map_.find(client);
   if (index != multi_part_response_map_.end()) {
     MultipartResponseDelegate* multi_part_handler = (*index).second;
     DCHECK(multi_part_handler != NULL);
     multi_part_handler->OnReceivedData(buffer, length);
   } else {
+    loader->setDefersLoading(true);
     client->DidReceiveData(buffer, length, 0);
   }
 }
 
 void WebPluginImpl::didFinishLoading(WebURLLoader* loader) {
-  WebPluginResourceClient* client = GetClientFromLoader(loader);
-  if (client) {
+  ClientInfo* client_info = GetClientInfoFromLoader(loader);
+  if (client_info && client_info->client) {
     MultiPartResponseHandlerMap::iterator index =
-        multi_part_response_map_.find(client);
+      multi_part_response_map_.find(client_info->client);
     if (index != multi_part_response_map_.end()) {
       delete (*index).second;
       multi_part_response_map_.erase(index);
 
       WebView* web_view = webframe_->GetView();
       web_view->GetDelegate()->DidStopLoading(web_view);
     }
-    client->DidFinishLoading();
+    loader->setDefersLoading(true);
+    client_info->client->DidFinishLoading();
+    // The WebPluginResourceClient pointer gets deleted soon after a call to
+    // DidFinishLoading.
+    client_info->client = NULL;
   }
-
-  RemoveClient(loader);
 }
 
 void WebPluginImpl::didFail(WebURLLoader* loader,
                             const WebURLError&) {
-  WebPluginResourceClient* client = GetClientFromLoader(loader);
-  if (client)
-    client->DidFail();
-
-  RemoveClient(loader);
+  ClientInfo* client_info = GetClientInfoFromLoader(loader);
+  if (client_info && client_info->client) {
+    loader->setDefersLoading(true);
+    client_info->client->DidFail();
+    // The WebPluginResourceClient pointer gets deleted soon after a call to
+    // DidFinishLoading.
+    client_info->client = NULL;
+  }
 }
 
 void WebPluginImpl::RemoveClient(size_t i) {
   clients_.erase(clients_.begin() + i);
 }
 
 void WebPluginImpl::RemoveClient(WebURLLoader* loader) {
   for (size_t i = 0; i < clients_.size(); ++i) {
     if (clients_[i].loader.get() == loader) {
       RemoveClient(i);
@@ skipping 196 matching lines @@
   CompleteURL(url, &complete_url_string);
 
   WebPluginResourceClient* resource_client =
       delegate_->CreateResourceClient(resource_id, complete_url_string,
                                       notify_needed, notify_data,
                                       existing_stream);
   InitiateHTTPRequest(resource_id, resource_client, "GET", NULL, 0,
                       GURL(complete_url_string), range_info, true);
 }
 
+void WebPluginImpl::SetDeferResourceLoading(int resource_id, bool defer) {
+  std::vector<ClientInfo>::iterator client_index = clients_.begin();
+  while (client_index != clients_.end()) {
+    ClientInfo& client_info = *client_index;
+
+    if (client_info.id == resource_id) {
+      client_info.loader->setDefersLoading(defer);
+      break;
+    }
+    client_index++;
+  }
+}
+
 void WebPluginImpl::HandleHttpMultipartResponse(
-    const WebURLResponse& response,
-    WebPluginResourceClient* client) {
+    const WebURLResponse& response, WebPluginResourceClient* client) {
   std::string multipart_boundary;
   if (!MultipartResponseDelegate::ReadMultipartBoundary(
           response, &multipart_boundary)) {
     NOTREACHED();
     return;
   }
 
   WebView* web_view = webframe_->GetView();
   web_view->GetDelegate()->DidStartLoading(web_view);
 
@@ skipping 128 matching lines @@
 
   WebPluginGeometry move;
   move.window = window_;
   move.window_rect = gfx::Rect();
   move.clip_rect = gfx::Rect();
   move.rects_valid = false;
   move.visible = widget_->isVisible();
 
   webview->delegate()->DidMovePlugin(move);
 }