Ensure we don't leak ObjectProxy objects

ppapi/proxy/ppp_class_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/ppp_class_proxy.h"
 
 #include "ppapi/c/dev/ppb_var_deprecated.h"
 #include "ppapi/c/dev/ppp_class_deprecated.h"
 #include "ppapi/c/pp_var.h"
 #include "ppapi/proxy/dispatcher.h"
+#include "ppapi/proxy/host_dispatcher.h"
 #include "ppapi/proxy/plugin_globals.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/proxy/serialized_var.h"
 #include "ppapi/shared_impl/api_id.h"
 #include "ppapi/shared_impl/proxy_lock.h"
 
 namespace ppapi {
 namespace proxy {
 
 namespace {
 
 // PPP_Class in the browser implementation -------------------------------------
 
 // Represents a plugin-implemented class in the browser process. This just
 // stores the data necessary to call back the plugin.
 struct ObjectProxy {
-  ObjectProxy(Dispatcher* d, int64_t p, int64_t ud)
-      : dispatcher(d), ppp_class(p), user_data(ud) {}
+  ObjectProxy(Dispatcher* d, int64_t p, int64_t ud, PP_Instance inst)
+      : dispatcher(d), ppp_class(p), user_data(ud), instance(inst) {}
 
   Dispatcher* dispatcher;
   int64_t ppp_class;
   int64_t user_data;
+  PP_Instance instance;
 };
 
 ObjectProxy* ToObjectProxy(void* data) {
   ObjectProxy* obj = reinterpret_cast<ObjectProxy*>(data);
-  if (!obj || !obj->dispatcher)
-    return NULL;
+  if (!obj)
+    return nullptr;
+  Dispatcher* dispatcher = HostDispatcher::GetForInstance(obj->instance);
+  if (!dispatcher)
+    return nullptr;
+  DCHECK_EQ(dispatcher, obj->dispatcher);
   if (!obj->dispatcher->permissions().HasPermission(PERMISSION_DEV))
-    return NULL;
+    return nullptr;
   return obj;
 }
 
 bool HasProperty(void* object, PP_Var name, PP_Var* exception) {
   ObjectProxy* obj = ToObjectProxy(object);
   if (!obj)
     return false;
 
   bool result = false;
   ReceiveSerializedException se(obj->dispatcher, exception);
@@ skipping 104 matching lines @@
                                         &argv_vect);
 
   obj->dispatcher->Send(new PpapiMsg_PPPClass_Construct(
       API_ID_PPP_CLASS,
       obj->ppp_class, obj->user_data, argv_vect, &se, &result));
   return result.Return(obj->dispatcher);
 }
 
 void Deallocate(void* object) {
   ObjectProxy* obj = ToObjectProxy(object);
-  if (!obj)
+  if (!obj) {
+    // Take care to delete the object even if we can't use it to notify the
+    // plugin.
+    delete reinterpret_cast<ObjectProxy*>(object);

[piman, 2016/03/29 18:28:51]

nit: static_cast

     return;
+  }
 
   obj->dispatcher->Send(new PpapiMsg_PPPClass_Deallocate(
       API_ID_PPP_CLASS, obj->ppp_class, obj->user_data));
   delete obj;
 }
 
 const PPP_Class_Deprecated class_interface = {
   &HasProperty,
   &HasMethod,
   &GetProperty,
@@ skipping 35 matching lines @@
 InterfaceProxy* PPP_Class_Proxy::Create(Dispatcher* dispatcher) {
   return new PPP_Class_Proxy(dispatcher);
 }
 
 // static
 PP_Var PPP_Class_Proxy::CreateProxiedObject(const PPB_Var_Deprecated* var,
                                             Dispatcher* dispatcher,
                                             PP_Instance instance_id,
                                             int64_t ppp_class,
                                             int64_t class_data) {
-  ObjectProxy* object_proxy = new ObjectProxy(dispatcher,
-                                              ppp_class, class_data);

[raymes, 2016/04/05 07:48:46]

piman: how about tracking these objects, either in a static std::map that lives
in this file or in HostVarTracker. They would be cleaned up on instance
deletion.

A more hacky but easier alternative would be to just delete the pointer in
PluginObject. We know for sure that it was always allocated here. I think this
code could probably be unwound to pass this object directly into PluginObject
and manage the lifetime there but it would be a lot of work. 

+  ObjectProxy* object_proxy =
+      new ObjectProxy(dispatcher, ppp_class, class_data, instance_id);
   return var->CreateObject(instance_id, &class_interface, object_proxy);
 }
 
 // static
 PP_Bool PPP_Class_Proxy::IsInstanceOf(const PPB_Var_Deprecated* ppb_var_impl,
                                       const PP_Var& var,
                                       int64_t ppp_class,
                                       int64_t* ppp_class_data) {
   void* proxied_object = NULL;
   if (ppb_var_impl->IsInstanceOf(var,
@@ skipping 157 matching lines @@
     // malicious.
     if (exception)
       *exception->OutParam(dispatcher()) = PP_MakeInt32(1);
     return false;
   }
   return true;
 }
 
 }  // namespace proxy
 }  // namespace ppapi