Add ref count to service workers for extension API.

extensions/common/extension_messages.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // IPC messages for extensions.
 // Multiply-included message file, hence no include guard.
 
 #include <stdint.h>
 
 #include <string>
@@ skipping 98 matching lines @@
   // True if request has a callback specified.
   IPC_STRUCT_MEMBER(bool, has_callback)
 
   // True if request is executed in response to an explicit user gesture.
   IPC_STRUCT_MEMBER(bool, user_gesture)
 
   // If this API call is for a service worker, then this is the worker thread
   // id. Otherwise, this is -1.
   IPC_STRUCT_MEMBER(int, worker_thread_id)
 
-  // If this API call is for a service worker, then this is the embedded
-  // worker id. Otherwise, this is -1.
-  IPC_STRUCT_MEMBER(int, embedded_worker_id)
+  // If this API call is for a service worker, then this is the service
+  // worker version id. Otherwise, this is -1.
+  IPC_STRUCT_MEMBER(int64_t, service_worker_version_id)
 IPC_STRUCT_END()
 
 // Allows an extension to execute code in a tab.
 IPC_STRUCT_BEGIN(ExtensionMsg_ExecuteCode_Params)
   // The extension API request id, for responding.
   IPC_STRUCT_MEMBER(int, request_id)
 
   // The ID of the requesting injection host.
   IPC_STRUCT_MEMBER(HostID, host_id)
 
@@ skipping 748 matching lines @@
 
 // The browser sends this message in response to all service worker extension
 // api calls. The response data (if any) is one of the base::Value subclasses,
 // wrapped as the first element in a ListValue.
 IPC_MESSAGE_CONTROL5(ExtensionMsg_ResponseWorker,
                      int /* thread_id */,
                      int /* request_id */,
                      bool /* success */,
                      base::ListValue /* response wrapper (see comment above) */,
                      std::string /* error */)
+
+// Asks the browser to increment the pending activity count for

[Tom Sepez, 2016/10/07 22:31:46]

What happens browser-side if a compromised renderer sends more decrements than
increments, or continues to use in some manner a worker that has been
decremented to 0?

[lazyboy, 2016/10/07 23:16:59]

This is expected to be unique, I've added a comment saying that.

A compromised renderer can keep sending same request_uuid, in that case:
For increment: if there's any request that was already pending with
|request_uuid|, browser will ignore it (I've not been doing that, added that in
latest patch, thanks).
For decrement: It will only work if browser has a pending request with
|request_uuid|, otherwise it will ignore the request.

+// the worker with version id |service_worker_version_id|.
+IPC_MESSAGE_CONTROL2(ExtensionHostMsg_IncrementServiceWorkerActivity,
+                     int64_t /* service_worker_version_id */,
+                     std::string /* request_uuid */)
+
+// Asks the browser to decrement the pending activity count for
+// the worker with version id |service_worker_version_id|.
+IPC_MESSAGE_CONTROL2(ExtensionHostMsg_DecrementServiceWorkerActivity,
+                     int64_t /* service_worker_version_id */,
+                     std::string /* request_uuid */)