Add safe blob-over-IPC transfer from browser->renderer for IDB.

content/browser/indexed_db/indexed_db_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/process/process.h"
+#include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/indexed_db/indexed_db_callbacks.h"
 #include "content/browser/indexed_db/indexed_db_connection.h"
 #include "content/browser/indexed_db/indexed_db_context_impl.h"
 #include "content/browser/indexed_db/indexed_db_cursor.h"
 #include "content/browser/indexed_db/indexed_db_database_callbacks.h"
 #include "content/browser/indexed_db/indexed_db_metadata.h"
 #include "content/browser/renderer_host/render_message_filter.h"
 #include "content/common/indexed_db/indexed_db_messages.h"
 #include "content/public/browser/browser_thread.h"
@@ skipping 12 matching lines @@
 
 IndexedDBDispatcherHost::IndexedDBDispatcherHost(
     IndexedDBContextImpl* indexed_db_context)
     : BrowserMessageFilter(IndexedDBMsgStart),
       indexed_db_context_(indexed_db_context),
       database_dispatcher_host_(new DatabaseDispatcherHost(this)),
       cursor_dispatcher_host_(new CursorDispatcherHost(this)) {
   DCHECK(indexed_db_context_);
 }
 
-IndexedDBDispatcherHost::~IndexedDBDispatcherHost() {}
+IndexedDBDispatcherHost::~IndexedDBDispatcherHost() {
+  STLDeleteValues(&blob_data_handle_map_);
+}
 
 void IndexedDBDispatcherHost::OnChannelClosing() {
   bool success = indexed_db_context_->TaskRunner()->PostTask(
       FROM_HERE,
       base::Bind(&IndexedDBDispatcherHost::ResetDispatcherHosts, this));
 
   if (!success)
     ResetDispatcherHosts();
 }
 
@@ skipping 40 matching lines @@
       cursor_dispatcher_host_->OnMessageReceived(message, message_was_ok);
 
   if (!handled) {
     handled = true;
     IPC_BEGIN_MESSAGE_MAP_EX(IndexedDBDispatcherHost, message, *message_was_ok)
       IPC_MESSAGE_HANDLER(IndexedDBHostMsg_FactoryGetDatabaseNames,
                           OnIDBFactoryGetDatabaseNames)
       IPC_MESSAGE_HANDLER(IndexedDBHostMsg_FactoryOpen, OnIDBFactoryOpen)
       IPC_MESSAGE_HANDLER(IndexedDBHostMsg_FactoryDeleteDatabase,
                           OnIDBFactoryDeleteDatabase)
+      IPC_MESSAGE_HANDLER(IndexedDBHostMsg_AckReceivedBlobs, OnAckReceivedBlobs)
       IPC_MESSAGE_UNHANDLED(handled = false)
     IPC_END_MESSAGE_MAP()
   }
   return handled;
 }
 
 int32 IndexedDBDispatcherHost::Add(IndexedDBCursor* cursor) {
   if (!cursor_dispatcher_host_) {
     return 0;
   }
@@ skipping 46 matching lines @@
     int64 host_transaction_id) {
   return host_transaction_id & 0xffffffff;
 }
 
 // static
 uint32 IndexedDBDispatcherHost::TransactionIdToProcessId(
     int64 host_transaction_id) {
   return (host_transaction_id >> 32) & 0xffffffff;
 }
 
+void IndexedDBDispatcherHost::HoldBlobDataHandle(
+    const std::string& uuid,
+    scoped_ptr<webkit_blob::BlobDataHandle>& blob_data_handle) {
+  DCHECK(ContainsKey(blob_data_handle_map_, uuid));
+  blob_data_handle_map_[uuid] = blob_data_handle.release();
+}
+
+void IndexedDBDispatcherHost::DropBlobDataHandle(const std::string& uuid) {
+  BlobDataHandleMap::iterator iter = blob_data_handle_map_.find(uuid);
+  if (iter != blob_data_handle_map_.end()) {
+    delete iter->second;
+    blob_data_handle_map_.erase(iter);
+  } else {
+    DLOG(FATAL) << "Failed to find blob UUID in map:" << uuid;
+  }
+}
 
 IndexedDBCursor* IndexedDBDispatcherHost::GetCursorFromId(int32 ipc_cursor_id) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   return cursor_dispatcher_host_->map_.Lookup(ipc_cursor_id);
 }
 
 ::IndexedDBDatabaseMetadata IndexedDBDispatcherHost::ConvertMetadata(
     const content::IndexedDBDatabaseMetadata& web_metadata) {
   ::IndexedDBDatabaseMetadata metadata;
   metadata.id = web_metadata.id;
@@ skipping 88 matching lines @@
       webkit_database::GetOriginFromIdentifier(params.database_identifier);
   base::FilePath indexed_db_path = indexed_db_context_->data_path();
   Context()->GetIDBFactory()->DeleteDatabase(
       params.name,
       new IndexedDBCallbacks(
           this, params.ipc_thread_id, params.ipc_callbacks_id),
       origin_url,
       indexed_db_path);
 }
 
+void IndexedDBDispatcherHost::OnAckReceivedBlobs(
+    const std::vector<std::string>& uuids) {
+  DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
+  std::vector<std::string>::const_iterator iter;
+  for (iter = uuids.begin(); iter != uuids.end(); ++iter)
+    DropBlobDataHandle(*iter);
+}
+
 void IndexedDBDispatcherHost::FinishTransaction(int64 host_transaction_id,
                                                 bool committed) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   if (!database_dispatcher_host_)
     return;
   TransactionIDToURLMap& transaction_url_map =
       database_dispatcher_host_->transaction_url_map_;
   TransactionIDToSizeMap& transaction_size_map =
       database_dispatcher_host_->transaction_size_map_;
   TransactionIDToDatabaseIDMap& transaction_database_map =
@@ skipping 557 matching lines @@
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
     int32 ipc_object_id) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 }  // namespace content