Attempt to fix a IAT unpatch crash.

webkit/glue/plugins/webplugin_delegate_impl.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/glue/plugins/webplugin_delegate_impl.h"
 
 #include <string>
 #include <vector>
 
 #include "base/file_util.h"
+#include "base/iat_patch.h"
+#include "base/lazy_instance.h"
 #include "base/message_loop.h"
 #include "base/stats_counters.h"
 #include "base/string_util.h"
 #include "webkit/default_plugin/plugin_impl.h"
 #include "webkit/glue/glue_util.h"
 #include "webkit/glue/webplugin.h"
 #include "webkit/glue/plugins/plugin_constants_win.h"
 #include "webkit/glue/plugins/plugin_instance.h"
 #include "webkit/glue/plugins/plugin_lib.h"
 #include "webkit/glue/plugins/plugin_list.h"
 #include "webkit/glue/plugins/plugin_stream_url.h"
 #include "webkit/glue/webkit_glue.h"
 
-static StatsCounter windowless_queue("Plugin.ThrottleQueue");
+namespace {
 
-static const wchar_t kWebPluginDelegateProperty[] =
-    L"WebPluginDelegateProperty";
-static const wchar_t kPluginNameAtomProperty[] = L"PluginNameAtom";
-static const wchar_t kDummyActivationWindowName[] = L"DummyWindowForActivation";
-static const wchar_t kPluginOrigProc[] = L"OriginalPtr";
-static const wchar_t kPluginFlashThrottle[] = L"FlashThrottle";
+const wchar_t kWebPluginDelegateProperty[] = L"WebPluginDelegateProperty";
+const wchar_t kPluginNameAtomProperty[] = L"PluginNameAtom";
+const wchar_t kDummyActivationWindowName[] = L"DummyWindowForActivation";
+const wchar_t kPluginOrigProc[] = L"OriginalPtr";
+const wchar_t kPluginFlashThrottle[] = L"FlashThrottle";
 
 // The fastest we are willing to process WM_USER+1 events for Flash.
 // Flash can easily exceed the limits of our CPU if we don't throttle it.
 // The throttle has been chosen by testing various delays and compromising
 // on acceptable Flash performance and reasonable CPU consumption.
 //
 // I'd like to make the throttle delay variable, based on the amount of
 // time currently required to paint Flash plugins.  There isn't a good
 // way to count the time spent in aggregate plugin painting, however, so
 // this seems to work well enough.
-static const int kFlashWMUSERMessageThrottleDelayMs = 5;
+const int kFlashWMUSERMessageThrottleDelayMs = 5;
 
-std::list<MSG> WebPluginDelegateImpl::throttle_queue_;
+// The current instance of the plugin which entered the modal loop.
+WebPluginDelegateImpl* g_current_plugin_instance = NULL;
 
-WebPluginDelegateImpl* WebPluginDelegateImpl::current_plugin_instance_ = NULL;
+base::LazyInstance<std::list<MSG> > g_throttle_queue(base::LINKER_INITIALIZED);
 
-iat_patch::IATPatchFunction WebPluginDelegateImpl::iat_patch_track_popup_menu_;
-iat_patch::IATPatchFunction WebPluginDelegateImpl::iat_patch_set_cursor_;
+// Helper object for patching the TrackPopupMenu API.
+base::LazyInstance<iat_patch::IATPatchFunction> g_iat_patch_track_popup_menu(
+    base::LINKER_INITIALIZED);
+
+// Helper object for patching the SetCursor API.
+base::LazyInstance<iat_patch::IATPatchFunction> g_iat_patch_set_cursor(
+    base::LINKER_INITIALIZED);
+
+}  // namespace
 
 WebPluginDelegateImpl* WebPluginDelegateImpl::Create(
     const FilePath& filename,
     const std::string& mime_type,
     gfx::NativeView containing_view) {
   scoped_refptr<NPAPI::PluginLib> plugin =
       NPAPI::PluginLib::CreatePluginLib(filename);
   if (plugin.get() == NULL)
     return NULL;
 
@@ skipping 45 matching lines @@
   wchar_t window_title[MAX_PATH + 1] = {0};
   if (GetWindowText(window, window_title, arraysize(window_title))) {
     return (0 == lstrcmpiW(window_title, kDummyActivationWindowName));
   }
   return false;
 }
 
 LRESULT CALLBACK WebPluginDelegateImpl::HandleEventMessageFilterHook(
     int code, WPARAM wParam, LPARAM lParam) {
 
-  DCHECK(current_plugin_instance_);
-  current_plugin_instance_->OnModalLoopEntered();
+  DCHECK(g_current_plugin_instance);
+  g_current_plugin_instance->OnModalLoopEntered();
   return CallNextHookEx(NULL, code, wParam, lParam);
 }
 
 WebPluginDelegateImpl::WebPluginDelegateImpl(
     gfx::NativeView containing_view,
     NPAPI::PluginInstance *instance)
     : parent_(containing_view),
       instance_(instance),
       quirks_(0),
       plugin_(NULL),
@@ skipping 127 matching lines @@
   plugin_url_ = url.spec();
 
   // The windowless version of the Silverlight plugin calls the
   // WindowFromPoint API and passes the result of that to the
   // TrackPopupMenu API call as the owner window. This causes the API
   // to fail as the API expects the window handle to live on the same
   // thread as the caller. It works in the other browsers as the plugin
   // lives on the browser thread. Our workaround is to intercept the
   // TrackPopupMenu API for Silverlight and replace the window handle
   // with the dummy activation window.
-  if (windowless_ && !iat_patch_track_popup_menu_.is_patched() &&
+  if (windowless_ && !g_iat_patch_track_popup_menu.Pointer()->is_patched() &&
       (quirks_ & PLUGIN_QUIRK_PATCH_TRACKPOPUP_MENU)) {
-    iat_patch_track_popup_menu_.Patch(
+    g_iat_patch_track_popup_menu.Pointer()->Patch(
         plugin_module_handle_, "user32.dll", "TrackPopupMenu",
         WebPluginDelegateImpl::TrackPopupMenuPatch);
   }
 
   // Windowless plugins can set cursors by calling the SetCursor API. This
   // works because the thread inputs of the browser UI thread and the plugin
   // thread are attached. We intercept the SetCursor API for windowless plugins
   // and remember the cursor being set. This is shipped over to the browser
   // in the HandleEvent call, which ensures that the cursor does not change
   // when a windowless plugin instance changes the cursor in a background tab.
-  if (windowless_ && !iat_patch_set_cursor_.is_patched() &&
+  if (windowless_ && !g_iat_patch_set_cursor.Pointer()->is_patched() &&
       (quirks_ & PLUGIN_QUIRK_PATCH_SETCURSOR)) {
-    iat_patch_set_cursor_.Patch(plugin_module_handle_, "user32.dll",
-                                "SetCursor",
-                                WebPluginDelegateImpl::SetCursorPatch);
+    g_iat_patch_set_cursor.Pointer()->Patch(
+        plugin_module_handle_, "user32.dll", "SetCursor",
+        WebPluginDelegateImpl::SetCursorPatch);
   }
   return true;
 }
 
 void WebPluginDelegateImpl::DestroyInstance() {
   if (instance_ && (instance_->npp()->ndata != NULL)) {
     // Shutdown all streams before destroying so that
     // no streams are left "in progress".  Need to do
     // this before calling set_web_plugin(NULL) because the
     // instance uses the helper to do the download.
     instance_->CloseStreams();
 
     window_.window = NULL;
     if (!(quirks_ & PLUGIN_QUIRK_DONT_SET_NULL_WINDOW_HANDLE_ON_DESTROY)) {
       instance_->NPP_SetWindow(&window_);
     }
 
     instance_->NPP_Destroy();
 
     instance_->set_web_plugin(NULL);
 
     if (instance_->plugin_lib()) {
       // Unpatch if this is the last plugin instance.
       if (instance_->plugin_lib()->instance_count() == 1) {
-        if (iat_patch_set_cursor_.is_patched()) {
-          iat_patch_set_cursor_.Unpatch();
+        if (g_iat_patch_set_cursor.Pointer()->is_patched()) {
+          g_iat_patch_set_cursor.Pointer()->Unpatch();
         }
 
-        if (iat_patch_track_popup_menu_.is_patched()) {
-          iat_patch_track_popup_menu_.Unpatch();
+        if (g_iat_patch_track_popup_menu.Pointer()->is_patched()) {
+          g_iat_patch_track_popup_menu.Pointer()->Unpatch();
         }
       }
     }
 
     instance_ = 0;
   }
 }
 
 void WebPluginDelegateImpl::UpdateGeometry(
     const gfx::Rect& window_rect,
@@ skipping 175 matching lines @@
     DestroyWindow(windowed_handle_);
     windowed_handle_ = 0;
   }
 }
 
 // Erase all messages in the queue destined for a particular window.
 // When windows are closing, callers should use this function to clear
 // the queue.
 // static
 void WebPluginDelegateImpl::ClearThrottleQueueForWindow(HWND window) {
+  std::list<MSG>* throttle_queue = g_throttle_queue.Pointer();
+
   std::list<MSG>::iterator it;
-  for (it = throttle_queue_.begin(); it != throttle_queue_.end(); ) {
+  for (it = throttle_queue->begin(); it != throttle_queue->end(); ) {
     if (it->hwnd == window) {
-      it = throttle_queue_.erase(it);
-      windowless_queue.Decrement();
+      it = throttle_queue->erase(it);
     } else {
       it++;
     }
   }
 }
 
 // Delayed callback for processing throttled messages.
 // Throttled messages are aggregated globally across all plugins.
 // static
 void WebPluginDelegateImpl::OnThrottleMessage() {
   // The current algorithm walks the list and processes the first
   // message it finds for each plugin.  It is important to service
   // all active plugins with each pass through the throttle, otherwise
   // we see video jankiness.
+  std::list<MSG>* throttle_queue = g_throttle_queue.Pointer();
   std::map<HWND, int> processed;
 
-  std::list<MSG>::iterator it = throttle_queue_.begin();
-  while (it != throttle_queue_.end()) {
+  std::list<MSG>::iterator it = throttle_queue->begin();
+  while (it != throttle_queue->end()) {
     const MSG& msg = *it;
     if (processed.find(msg.hwnd) == processed.end()) {
       WNDPROC proc = reinterpret_cast<WNDPROC>(msg.time);
           // It is possible that the window was closed after we queued
           // this message.  This is a rare event; just verify the window
           // is alive.  (see also bug 1259488)
           if (IsWindow(msg.hwnd))
           CallWindowProc(proc, msg.hwnd, msg.message, msg.wParam, msg.lParam);
       processed[msg.hwnd] = 1;
-      it = throttle_queue_.erase(it);
-      windowless_queue.Decrement();
+      it = throttle_queue->erase(it);
     } else {
       it++;
     }
   }
 
-  if (throttle_queue_.size() > 0)
+  if (throttle_queue->size() > 0)
     MessageLoop::current()->PostDelayedTask(FROM_HERE,
         NewRunnableFunction(&WebPluginDelegateImpl::OnThrottleMessage),
         kFlashWMUSERMessageThrottleDelayMs);
 }
 
 // Schedule a windows message for delivery later.
 // static
 void WebPluginDelegateImpl::ThrottleMessage(WNDPROC proc, HWND hwnd,
                                             UINT message, WPARAM wParam,
                                             LPARAM lParam) {
   MSG msg;
   msg.time = reinterpret_cast<DWORD>(proc);
   msg.hwnd = hwnd;
   msg.message = message;
   msg.wParam = wParam;
   msg.lParam = lParam;
-  throttle_queue_.push_back(msg);
-  windowless_queue.Increment();
 
-  if (throttle_queue_.size() == 1) {
+  std::list<MSG>* throttle_queue = g_throttle_queue.Pointer();
+

[jam, 2009/01/23 19:26:23]

nit: no need for extra line?

+  throttle_queue->push_back(msg);
+
+  if (throttle_queue->size() == 1) {
     MessageLoop::current()->PostDelayedTask(FROM_HERE,
         NewRunnableFunction(&WebPluginDelegateImpl::OnThrottleMessage),
         kFlashWMUSERMessageThrottleDelayMs);
   }
 }
 
 // We go out of our way to find the hidden windows created by Flash for
 // windowless plugins.  We throttle the rate at which they deliver messages
 // so that they will not consume outrageous amounts of CPU.
 // static
@@ skipping 231 matching lines @@
     invalid_rect.Offset(-window_rect.left, -window_rect.top);
 
     // The plugin window might have non-client area.   If we don't pass in
     // RDW_FRAME then the children don't receive WM_NCPAINT messages while
     // scrolling, which causes painting problems (http://b/issue?id=923945).
     RedrawWindow(hwnd, &invalid_rect.ToRECT(), NULL,
                  RDW_UPDATENOW | RDW_INVALIDATE | RDW_ALLCHILDREN | RDW_FRAME);
     return FALSE;
   }
 
-  current_plugin_instance_ = delegate;
+  g_current_plugin_instance = delegate;
 
   switch (message) {
     case WM_NCDESTROY: {
       RemoveProp(hwnd, kWebPluginDelegateProperty);
       ATOM plugin_name_atom = reinterpret_cast  <ATOM>(
           RemoveProp(hwnd, kPluginNameAtomProperty));
       if (plugin_name_atom != 0)
         GlobalDeleteAtom(plugin_name_atom);
       ClearThrottleQueueForWindow(hwnd);
       break;
     }
     // Flash may flood the message queue with WM_USER+1 message causing 100% CPU
     // usage.  See https://bugzilla.mozilla.org/show_bug.cgi?id=132759.  We
     // prevent this by throttling the messages.
     case WM_USER + 1: {
       if (delegate->quirks() & PLUGIN_QUIRK_THROTTLE_WM_USER_PLUS_ONE) {
         WebPluginDelegateImpl::ThrottleMessage(delegate->plugin_wnd_proc_, hwnd,
                                                message, wparam, lparam);
-        current_plugin_instance_ = NULL;
+        g_current_plugin_instance = NULL;
         return FALSE;
       }
       break;
     }
     default: {
       break;
     }
   }
 
   delegate->last_message_ = message;
   delegate->is_calling_wndproc = true;
 
   if (!delegate->user_gesture_message_posted_ &&
        IsUserGestureMessage(message)) {
     delegate->user_gesture_message_posted_ = true;
 
     delegate->instance()->PushPopupsEnabledState(true);
 
     MessageLoop::current()->PostTask(FROM_HERE,
         delegate->user_gesture_msg_factory_.NewRunnableMethod(
             &WebPluginDelegateImpl::OnUserGestureEnd));
   }
 
   LRESULT result = CallWindowProc(delegate->plugin_wnd_proc_, hwnd, message,
                                   wparam, lparam);
   delegate->is_calling_wndproc = false;
-  current_plugin_instance_ = NULL;
+  g_current_plugin_instance = NULL;
   return result;
 }
 
 void WebPluginDelegateImpl::WindowlessUpdateGeometry(
     const gfx::Rect& window_rect,
     const gfx::Rect& clip_rect) {
   // Only resend to the instance if the geometry has changed.
   if (window_rect == window_rect_ && clip_rect == clip_rect_)
     return;
 
@@ skipping 121 matching lines @@
     // in that context we unhook on receiving the first notification in
     // the message filter hook.
     handle_event_message_filter_hook_ =
         SetWindowsHookEx(WH_MSGFILTER, HandleEventMessageFilterHook, NULL,
                          GetCurrentThreadId());
   }
 
   bool old_task_reentrancy_state =
       MessageLoop::current()->NestableTasksAllowed();
 
-  current_plugin_instance_ = this;
+  g_current_plugin_instance = this;
 
   handle_event_depth_++;
 
   bool pop_user_gesture = false;
 
   if (IsUserGestureMessage(event->event)) {
     pop_user_gesture = true;
     instance()->PushPopupsEnabledState(true);
   }
 
   bool ret = instance()->NPP_HandleEvent(event) != 0;
 
   if (event->event == WM_MOUSEMOVE) {
     // Snag a reference to the current cursor ASAP in case the plugin modified
     // it. There is a nasty race condition here with the multiprocess browser
     // as someone might be setting the cursor in the main process as well.
     *cursor = current_windowless_cursor_;
   }
 
   if (pop_user_gesture) {
     instance()->PopPopupsEnabledState();
   }
 
   handle_event_depth_--;
 
-  current_plugin_instance_ = NULL;
+  g_current_plugin_instance = NULL;
 
   MessageLoop::current()->SetNestableTasksAllowed(old_task_reentrancy_state);
 
   if (handle_event_message_filter_hook_) {
     UnhookWindowsHookEx(handle_event_message_filter_hook_);
     handle_event_message_filter_hook_ = NULL;
   }
 
   // We could have multiple NPP_HandleEvent calls nested together in case
   // the plugin enters a modal loop. Reset the pump messages event when
@@ skipping 75 matching lines @@
 }
 
 void WebPluginDelegateImpl::OnUserGestureEnd() {
   user_gesture_message_posted_ = false;
   instance()->PopPopupsEnabledState();
 }
 
 BOOL WINAPI WebPluginDelegateImpl::TrackPopupMenuPatch(
     HMENU menu, unsigned int flags, int x, int y, int reserved,
     HWND window, const RECT* rect) {
-  if (current_plugin_instance_) {
+  if (g_current_plugin_instance) {
     unsigned long window_process_id = 0;
     unsigned long window_thread_id =
         GetWindowThreadProcessId(window, &window_process_id);
     // TrackPopupMenu fails if the window passed in belongs to a different
     // thread.
     if (::GetCurrentThreadId() != window_thread_id) {
-      window = current_plugin_instance_->dummy_window_for_activation_;
+      window = g_current_plugin_instance->dummy_window_for_activation_;
     }
   }
   return TrackPopupMenu(menu, flags, x, y, reserved, window, rect);
 }
 
 HCURSOR WINAPI WebPluginDelegateImpl::SetCursorPatch(HCURSOR cursor) {
   // The windowless flash plugin periodically calls SetCursor in a wndproc
   // instantiated on the plugin thread. This causes annoying cursor flicker
   // when the mouse is moved on a foreground tab, with a windowless plugin
   // instance in a background tab. We just ignore the call here.
-  if (!current_plugin_instance_)
+  if (!g_current_plugin_instance)
     return GetCursor();
 
-  if (!current_plugin_instance_->windowless()) {
+  if (!g_current_plugin_instance->windowless()) {
     return SetCursor(cursor);
   }
 
   // It is ok to pass NULL here to GetCursor as we are not looking for cursor
   // types defined by Webkit.
   HCURSOR previous_cursor =
-      current_plugin_instance_->current_windowless_cursor_.GetCursor(NULL);
+      g_current_plugin_instance->current_windowless_cursor_.GetCursor(NULL);
 
-  current_plugin_instance_->current_windowless_cursor_.InitFromExternalCursor(
+  g_current_plugin_instance->current_windowless_cursor_.InitFromExternalCursor(
       cursor);
   return previous_cursor;
 }