Move on-demand update checks from the FILE thread to the blocking pool.

chrome/browser/google/google_update_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/google/google_update_win.h"
 
 #include <atlbase.h>
 #include <atlcom.h>
 #include <stdint.h>
 #include <string.h>
 
 #include <utility>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/files/file_path.h"
 #include "base/location.h"
 #include "base/macros.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/path_service.h"
+#include "base/sequenced_task_runner.h"
 #include "base/sequenced_task_runner_helpers.h"
-#include "base/single_thread_task_runner.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/threading/thread_task_runner_handle.h"
+#include "base/threading/sequenced_task_runner_handle.h"
 #include "base/time/time.h"
 #include "base/version.h"
 #include "base/win/scoped_bstr.h"
 #include "base/win/windows_version.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/google_update_settings.h"
 #include "chrome/installer/util/helper.h"
 #include "chrome/installer/util/install_util.h"
@@ skipping 14 matching lines @@
   UPGRADE_IS_AVAILABLE = 2,
   // The upgrade happened successfully.
   UPGRADE_SUCCESSFUL = 3,
   // No need to upgrade, Chrome is up to date.
   UPGRADE_ALREADY_UP_TO_DATE = 4,
   // An error occurred.
   UPGRADE_ERROR = 5,
   NUM_UPGRADE_STATUS
 };
 
+GlobalInterfaceTableClassFactory* g_global_interface_table_factory = nullptr;
 GoogleUpdate3ClassFactory* g_google_update_factory = nullptr;
 
 // The time interval, in milliseconds, between polls to Google Update. This
 // value was chosen unscientificaly during an informal discussion.
 const int64_t kGoogleUpdatePollIntervalMs = 250;
 
 const int kGoogleAllowedRetries = 1;
 const int kGoogleRetryIntervalSeconds = 5;
 
 // Constants from Google Update.
@@ skipping 42 matching lines @@
   ::CoSetProxyBlanket(interface_pointer,
                       RPC_C_AUTHN_DEFAULT,
                       RPC_C_AUTHZ_DEFAULT,
                       COLE_DEFAULT_PRINCIPAL,
                       RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
                       RPC_C_IMP_LEVEL_IMPERSONATE,
                       nullptr,
                       EOAC_DYNAMIC_CLOAKING);
 }
 
+HRESULT CreateGlobalInterfaceTable(
+    base::win::ScopedComPtr<IGlobalInterfaceTable>* global_interface_table) {
+  if (g_global_interface_table_factory)
+    return g_global_interface_table_factory->Run(global_interface_table);
+
+  return global_interface_table->CreateInstance(CLSID_StdGlobalInterfaceTable,
+                                                nullptr, CLSCTX_INPROC_SERVER);
+}
+
 // Creates a class factory for a COM Local Server class using either plain
 // vanilla CoGetClassObject, or using the Elevation moniker if running on
 // Vista+. |hwnd| must refer to a foregound window in order to get the UAC
 // prompt to appear in the foreground if running on Vista+. It can also be NULL
 // if background UAC prompts are desired.
 HRESULT CoGetClassObjectAsAdmin(REFCLSID class_id,
                                 REFIID interface_id,
                                 gfx::AcceleratedWidget hwnd,
                                 void** interface_ptr) {
   if (!interface_ptr)
@@ skipping 61 matching lines @@
     return hresult;
 
   ConfigureProxyBlanket(class_factory.get());
 
   return class_factory->CreateInstance(
       nullptr,
       base::win::ScopedComPtr<IGoogleUpdate3Web>::iid(),
       google_update->ReceiveVoid());
 }
 
+// InterfaceCookie -------------------------------------------------------------
+
+// Manages the lifetime of an interface's cookie in the COM Global Interface
+// Table.
+template <class T>
+class InterfaceCookie {
+ public:
+  InterfaceCookie() = default;
+  ~InterfaceCookie();
+
+  void Initialize(
+      base::win::ScopedComPtr<IGlobalInterfaceTable> global_interface_table);
+
+  // Registers |interface_pointer| in the process's Global Interface Table.
+  HRESULT Register(const base::win::ScopedComPtr<T>& interface_pointer);
+
+  // Populates |interface_pointer| with the cookie's interface in the process's
+  // Global Interface Table.
+  HRESULT Get(base::win::ScopedComPtr<T>* interface_pointer) const;
+
+  // Revokes the cookie from the Global Interface Table. This function is safe
+  // to call when the cookie is empty.
+  HRESULT Revoke();
+
+  explicit operator bool() const { return cookie_ != 0; }
+
+ private:
+  base::win::ScopedComPtr<IGlobalInterfaceTable> global_interface_table_;
+  DWORD cookie_ = 0;
+
+  DISALLOW_COPY_AND_ASSIGN(InterfaceCookie);
+};
+
+template <class T>
+InterfaceCookie<T>::~InterfaceCookie() {
+  Revoke();
+}
+
+template <class T>
+void InterfaceCookie<T>::Initialize(
+    base::win::ScopedComPtr<IGlobalInterfaceTable> global_interface_table) {
+  DCHECK(!global_interface_table_);
+  global_interface_table_ = std::move(global_interface_table);
+}
+
+template <class T>
+HRESULT InterfaceCookie<T>::Register(
+    const base::win::ScopedComPtr<T>& interface_pointer) {
+  DCHECK(global_interface_table_);
+  DCHECK_EQ(0U, cookie_);
+  return global_interface_table_->RegisterInterfaceInGlobal(
+      interface_pointer.get(), base::win::ScopedComPtr<T>::iid(), &cookie_);
+}
+
+template <class T>
+HRESULT InterfaceCookie<T>::Get(
+    base::win::ScopedComPtr<T>* interface_pointer) const {
+  DCHECK(global_interface_table_);
+  DCHECK(interface_pointer);
+  DCHECK_NE(0U, cookie_);
+  return global_interface_table_->GetInterfaceFromGlobal(
+      cookie_, base::win::ScopedComPtr<T>::iid(),
+      interface_pointer->ReceiveVoid());
+}
+
+template <class T>
+HRESULT InterfaceCookie<T>::Revoke() {
+  if (!cookie_)
+    return S_OK;
+
+  DCHECK(global_interface_table_);
+  HRESULT hresult = global_interface_table_->RevokeInterfaceFromGlobal(cookie_);
+  if (SUCCEEDED(hresult))
+    cookie_ = 0;
+  return hresult;
+}
+
 // UpdateCheckDriver -----------------------------------------------------------
 
-// A driver that is created and destroyed on the caller's thread and drives
+// A driver that is created and destroyed on the caller's task runner and drives
 // Google Update on another.
 class UpdateCheckDriver {
  public:
   // Runs an update check on |task_runner|, invoking methods of |delegate| on
-  // the caller's thread to report progress and final results.
+  // the caller's task runner to report progress and final results.
   static void RunUpdateCheck(
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+      scoped_refptr<base::SequencedTaskRunner> task_runner,
       const std::string& locale,
       bool install_update_if_possible,
       gfx::AcceleratedWidget elevation_window,
       const base::WeakPtr<UpdateCheckDelegate>& delegate);
 
  private:
   friend class base::DeleteHelper<UpdateCheckDriver>;
 
-  UpdateCheckDriver(
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner,
-      const std::string& locale,
-      bool install_update_if_possible,
-      gfx::AcceleratedWidget elevation_window,
-      const base::WeakPtr<UpdateCheckDelegate>& delegate);
+  UpdateCheckDriver(scoped_refptr<base::SequencedTaskRunner> task_runner,
+                    const std::string& locale,
+                    bool install_update_if_possible,
+                    gfx::AcceleratedWidget elevation_window,
+                    const base::WeakPtr<UpdateCheckDelegate>& delegate);
 
   // Invokes a completion or error method on all delegates, as appropriate.
   ~UpdateCheckDriver();
 
   // If an UpdateCheckDriver is already running, the delegate is added to the
   // existing one instead of creating a new one.
   void AddDelegate(const base::WeakPtr<UpdateCheckDelegate>& delegate);
 
   // Notifies delegates of an update's progress. |progress|, a number between 0
   // and 100 (inclusive), is an estimation as to what percentage of the upgrade
@@ skipping 16 matching lines @@
   // to the user. This call should be followed by deletion of the driver,
   // which will result in callers being notified via their delegates.
   void OnUpgradeError(GoogleUpdateErrorCode error_code,
                       HRESULT hresult,
                       int installer_exit_code,
                       const base::string16& error_string);
 
   // Returns true if |current_state| and |state_value| can be obtained from the
   // ongoing update check. Otherwise, populates |hresult| with the reason they
   // could not be obtained.
-  bool GetCurrentState(base::win::ScopedComPtr<ICurrentState>* current_state,
+  bool GetCurrentState(base::win::ScopedComPtr<IAppBundleWeb>* app_bundle,
+                       base::win::ScopedComPtr<ICurrentState>* current_state,
                        CurrentState* state_value,
                        HRESULT* hresult) const;
 
   // Returns true if |current_state| and |state_value| constitute an error state
   // for the ongoing update check, in which case |error_code| is populated with
   // one of GOOGLE_UPDATE_ERROR_UPDATING, GOOGLE_UPDATE_DISABLED_BY_POLICY, or
   // GOOGLE_UPDATE_ONDEMAND_CLASS_REPORTED_ERROR. |hresult| is populated with
   // the most relevant HRESULT (which may be a value from Google Update; see
   // https://code.google.com/p/omaha/source/browse/trunk/base/error.h). In case
   // Chrome's installer failed during execution, |installer_exit_code| may be
   // populated with its process exit code (see enum installer::InstallStatus in
   // chrome/installer/util/util_constants.h); otherwise, it will be -1.
   // |error_string| will be populated with a completion message if one is
   // provided by Google Update.
-  bool IsErrorState(const base::win::ScopedComPtr<ICurrentState>& current_state,
+  bool IsErrorState(const base::win::ScopedComPtr<IAppBundleWeb>& app_bundle,
+                    const base::win::ScopedComPtr<ICurrentState>& current_state,
                     CurrentState state_value,
                     GoogleUpdateErrorCode* error_code,
                     HRESULT* hresult,
                     int* installer_exit_code,
                     base::string16* error_string) const;
 
   // Returns true if |current_state| and |state_value| constitute a final state
   // for the ongoing update check, in which case |upgrade_status| is populated
   // with one of UPGRADE_ALREADY_UP_TO_DATE or UPGRADE_IS_AVAILABLE (in case a
   // pure check is being performed rather than an update) or UPGRADE_SUCCESSFUL
@@ skipping 17 matching lines @@
       base::string16* new_version,
       int* progress) const;
 
   // Polls Google Update to determine the state of the ongoing check or
   // update. If the process has reached a terminal state, this instance will be
   // deleted and the caller will be notified of the final status. Otherwise, the
   // caller will be notified of the intermediate state (iff it differs from a
   // previous notification) and another future poll will be scheduled.
   void PollGoogleUpdate();
 
-  // The global driver instance. Accessed only on the caller's thread.
+  // The global driver instance. Accessed only on the caller's task runner.
   static UpdateCheckDriver* driver_;
 
   // The task runner on which the update checks runs.
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+  scoped_refptr<base::SequencedTaskRunner> task_runner_;
 
   // The caller's task runner, on which methods of the |delegates_| will be
   // invoked.
-  scoped_refptr<base::SingleThreadTaskRunner> result_runner_;
+  scoped_refptr<base::SequencedTaskRunner> result_runner_;
 
   // The UI locale.
   std::string locale_;
 
   // False to only check for an update; true to also install one if available.
   bool install_update_if_possible_;
 
   // A parent window in case any UX is required (e.g., an elevation prompt).
   gfx::AcceleratedWidget elevation_window_;
 
   // Contains all delegates by which feedback is conveyed. Accessed only on the
-  // caller's thread.
+  // caller's task runner.
   std::vector<base::WeakPtr<UpdateCheckDelegate>> delegates_;
 
   // Number of remaining retries allowed when errors occur.
   int allowed_retries_;
 
   // True if operating on a per-machine installation rather than a per-user one.
   bool system_level_install_;
 
-  // The on-demand updater that is doing the work.
-  base::win::ScopedComPtr<IGoogleUpdate3Web> google_update_;
+  // The COM Global Interface Table for the process.
+  base::win::ScopedComPtr<IGlobalInterfaceTable> global_interface_table_;
 
-  // An app bundle containing the application being updated.
-  base::win::ScopedComPtr<IAppBundleWeb> app_bundle_;
+  // A cookie in the Global Interface Table for the on-demand updater that is
+  // doing the work.
+  InterfaceCookie<IGoogleUpdate3Web> google_update_cookie_;
 
-  // The application being updated (Chrome, Chrome Binaries, or Chrome SxS).
-  base::win::ScopedComPtr<IAppWeb> app_;
+  // A cookie in the Global Interface Table for the app bundle containing the
+  // application being updated.
+  InterfaceCookie<IAppBundleWeb> app_bundle_cookie_;
 
   // The progress value reported most recently to the caller.
   int last_reported_progress_;
 
   // The results of the update check to be logged via UMA and/or reported to the
   // caller.
   GoogleUpdateUpgradeStatus status_;
   GoogleUpdateErrorCode error_code_;
   base::string16 html_error_message_;
   base::string16 new_version_;
   HRESULT hresult_;
   int installer_exit_code_;
 
   DISALLOW_COPY_AND_ASSIGN(UpdateCheckDriver);
 };
 
 UpdateCheckDriver* UpdateCheckDriver::driver_ = nullptr;
 
 // static
 void UpdateCheckDriver::RunUpdateCheck(
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+    scoped_refptr<base::SequencedTaskRunner> task_runner,
     const std::string& locale,
     bool install_update_if_possible,
     gfx::AcceleratedWidget elevation_window,
     const base::WeakPtr<UpdateCheckDelegate>& delegate) {
   // Create the driver if it doesn't exist, or add the delegate to the existing
   // one.
   if (!driver_) {
     // The driver is owned by itself, and will self-destruct when its work is
     // done.
     driver_ =
         new UpdateCheckDriver(task_runner, locale, install_update_if_possible,
                               elevation_window, delegate);
     task_runner->PostTask(FROM_HERE,
                           base::Bind(&UpdateCheckDriver::BeginUpdateCheck,
                                      base::Unretained(driver_)));
   } else {
     DCHECK_EQ(driver_->task_runner_, task_runner);
     driver_->AddDelegate(delegate);
   }
 }
 
-// Runs on the caller's thread.
+// Runs on the caller's task runner.
 UpdateCheckDriver::UpdateCheckDriver(
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+    scoped_refptr<base::SequencedTaskRunner> task_runner,
     const std::string& locale,
     bool install_update_if_possible,
     gfx::AcceleratedWidget elevation_window,
     const base::WeakPtr<UpdateCheckDelegate>& delegate)
     : task_runner_(std::move(task_runner)),
-      result_runner_(base::ThreadTaskRunnerHandle::Get()),
+      result_runner_(base::SequencedTaskRunnerHandle::Get()),
       locale_(locale),
       install_update_if_possible_(install_update_if_possible),
       elevation_window_(elevation_window),
       delegates_(1, delegate),
       allowed_retries_(kGoogleAllowedRetries),
       system_level_install_(false),
       last_reported_progress_(0),
       status_(UPGRADE_ERROR),
       error_code_(GOOGLE_UPDATE_NO_ERROR),
       hresult_(S_OK),
       installer_exit_code_(-1) {}
 
 UpdateCheckDriver::~UpdateCheckDriver() {
-  DCHECK(result_runner_->BelongsToCurrentThread());
+  DCHECK(result_runner_->RunsTasksOnCurrentThread());
+  DCHECK(!google_update_cookie_);
+  DCHECK(!app_bundle_cookie_);
+
   // If there is an error, then error_code must not be blank, and vice versa.
   DCHECK_NE(status_ == UPGRADE_ERROR, error_code_ == GOOGLE_UPDATE_NO_ERROR);
   UMA_HISTOGRAM_ENUMERATION("GoogleUpdate.UpgradeResult", status_,
                             NUM_UPGRADE_STATUS);
   if (status_ == UPGRADE_ERROR) {
     UMA_HISTOGRAM_ENUMERATION("GoogleUpdate.UpdateErrorCode", error_code_,
                               NUM_ERROR_CODES);
     if (FAILED(hresult_))
       UMA_HISTOGRAM_SPARSE_SLOWLY("GoogleUpdate.ErrorHresult", hresult_);
     if (installer_exit_code_ != -1) {
@@ skipping 14 matching lines @@
       else if (install_update_if_possible_)
         delegate->OnUpgradeComplete(new_version_);
       else
         delegate->OnUpdateCheckComplete(new_version_);
     }
   }
 }
 
 void UpdateCheckDriver::AddDelegate(
     const base::WeakPtr<UpdateCheckDelegate>& delegate) {
-  DCHECK(result_runner_->BelongsToCurrentThread());
+  DCHECK(result_runner_->RunsTasksOnCurrentThread());
   delegates_.push_back(delegate);
 }
 
 void UpdateCheckDriver::NotifyUpgradeProgress(
     int progress,
     const base::string16& new_version) {
-  DCHECK(result_runner_->BelongsToCurrentThread());
+  DCHECK(result_runner_->RunsTasksOnCurrentThread());
 
   for (const auto& delegate : delegates_) {
     if (delegate)
       delegate->OnUpgradeProgress(progress, new_version);
   }
 }
 
 void UpdateCheckDriver::BeginUpdateCheck() {
   GoogleUpdateErrorCode error_code = GOOGLE_UPDATE_NO_ERROR;
   HRESULT hresult = BeginUpdateCheckInternal(&error_code);
@@ skipping 17 matching lines @@
   }
 
   DCHECK(FAILED(hresult));
   // Return results immediately since the driver is not polling Google Update.
   OnUpgradeError(error_code, hresult, -1, base::string16());
   result_runner_->DeleteSoon(FROM_HERE, this);
 }
 
 HRESULT UpdateCheckDriver::BeginUpdateCheckInternal(
     GoogleUpdateErrorCode* error_code) {
+  // All errors prior to creation of the main update class are reported as:
+  *error_code = GOOGLE_UPDATE_ONDEMAND_CLASS_NOT_FOUND;
   HRESULT hresult = S_OK;
-  // Instantiate GoogleUpdate3Web{Machine,User}Class.
-  if (!google_update_) {
+
+  // Create/get the process's Global Interface Table.
+  if (!global_interface_table_) {
+    // Make sure ATL is initialized in this module.
+    ui::win::CreateATLModuleIfNeeded();
+
+    hresult = CreateGlobalInterfaceTable(&global_interface_table_);
+    if (FAILED(hresult))
+      return hresult;
+
+    google_update_cookie_.Initialize(global_interface_table_);
+    app_bundle_cookie_.Initialize(global_interface_table_);
+  }
+
+  // Create or get the GoogleUpdate3Web class.
+  base::win::ScopedComPtr<IGoogleUpdate3Web> google_update;
+  if (!google_update_cookie_) {
+    // Instantiate GoogleUpdate3Web{Machine,User}Class.
     base::FilePath chrome_exe;
     if (!PathService::Get(base::DIR_EXE, &chrome_exe))
       NOTREACHED();
 
     system_level_install_ = !InstallUtil::IsPerUserInstall(chrome_exe);
 
-    // Make sure ATL is initialized in this module.
-    ui::win::CreateATLModuleIfNeeded();
-
     *error_code = CanUpdateCurrentChrome(chrome_exe, system_level_install_);
     if (*error_code != GOOGLE_UPDATE_NO_ERROR)
       return E_FAIL;
 
+    *error_code = GOOGLE_UPDATE_ONDEMAND_CLASS_NOT_FOUND;
     hresult = CreateGoogleUpdate3WebClass(system_level_install_,
                                           install_update_if_possible_,
-                                          elevation_window_, &google_update_);
-    if (FAILED(hresult)) {
-      *error_code = GOOGLE_UPDATE_ONDEMAND_CLASS_NOT_FOUND;
-      return hresult;
+                                          elevation_window_, &google_update);
+    if (SUCCEEDED(hresult)) {
+      ConfigureProxyBlanket(google_update.get());
+
+      hresult = google_update_cookie_.Register(google_update);
     }
 
-    ConfigureProxyBlanket(google_update_.get());
+    if (FAILED(hresult))
+      return hresult;
+  } else {
+    hresult = google_update_cookie_.Get(&google_update);
+    if (FAILED(hresult))
+      return hresult;
   }
 
   // The class was created, so all subsequent errors are reported as:
   *error_code = GOOGLE_UPDATE_ONDEMAND_CLASS_REPORTED_ERROR;
 
-  // Create an app bundle.
-  if (!app_bundle_) {
+  // Create or get the AppBundleWeb used to update Chrome.
+  if (!app_bundle_cookie_) {
     base::win::ScopedComPtr<IAppBundleWeb> app_bundle;
     base::win::ScopedComPtr<IDispatch> dispatch;
-    hresult = google_update_->createAppBundleWeb(dispatch.Receive());
+    hresult = google_update->createAppBundleWeb(dispatch.Receive());
     if (FAILED(hresult))
       return hresult;
     hresult = dispatch.QueryInterface(app_bundle.Receive());
     if (FAILED(hresult))
       return hresult;
     dispatch.Release();
 
     ConfigureProxyBlanket(app_bundle.get());
 
     if (!locale_.empty()) {
       // Ignore the result of this since, while setting the display language is
       // nice to have, a failure to do so does not affect the likelihood that
       // the update check and/or install will succeed.
       app_bundle->put_displayLanguage(
           base::win::ScopedBstr(base::UTF8ToUTF16(locale_).c_str()));
     }
 
     hresult = app_bundle->initialize();
     if (FAILED(hresult))
       return hresult;
     if (elevation_window_) {
       // Likewise, a failure to set the parent window need not block an update
       // check.
       app_bundle->put_parentHWND(
           reinterpret_cast<ULONG_PTR>(elevation_window_));
     }
-    app_bundle_.swap(app_bundle);
-  }
-
-  // Get a reference to the Chrome app in the bundle.
-  if (!app_) {
     base::string16 app_guid =
         installer::GetAppGuidForUpdates(system_level_install_);
     DCHECK(!app_guid.empty());
 
-    base::win::ScopedComPtr<IDispatch> dispatch;
     // It is common for this call to fail with APP_USING_EXTERNAL_UPDATER if
     // an auto update is in progress.
-    hresult = app_bundle_->createInstalledApp(
-        base::win::ScopedBstr(app_guid.c_str()));
+    hresult =
+        app_bundle->createInstalledApp(base::win::ScopedBstr(app_guid.c_str()));
     if (FAILED(hresult))
       return hresult;
-    // Move the IAppBundleWeb reference into a local now so that failures from
-    // this point onward result in it being released.
-    base::win::ScopedComPtr<IAppBundleWeb> app_bundle;
-    app_bundle.swap(app_bundle_);
-    hresult = app_bundle->get_appWeb(0, dispatch.Receive());
-    if (FAILED(hresult))
-      return hresult;
-    base::win::ScopedComPtr<IAppWeb> app;
-    hresult = dispatch.QueryInterface(app.Receive());
-    if (FAILED(hresult))
-      return hresult;
-    ConfigureProxyBlanket(app.get());
     hresult = app_bundle->checkForUpdate();
     if (FAILED(hresult))
       return hresult;
-    app_bundle_.swap(app_bundle);
-    app_.swap(app);
+
+    hresult = app_bundle_cookie_.Register(app_bundle);
+    if (FAILED(hresult))
+      return hresult;
   }
 
   return hresult;
 }
 
 bool UpdateCheckDriver::GetCurrentState(
+    base::win::ScopedComPtr<IAppBundleWeb>* app_bundle,
     base::win::ScopedComPtr<ICurrentState>* current_state,
     CurrentState* state_value,
     HRESULT* hresult) const {
+  // Get the bundle being checked or updated.
+  *hresult = app_bundle_cookie_.Get(app_bundle);
+  if (FAILED(*hresult))
+    return false;
+
+  // Get Chrome's app from the bundle.
   base::win::ScopedComPtr<IDispatch> dispatch;
-  *hresult = app_->get_currentState(dispatch.Receive());
+  *hresult = (*app_bundle)->get_appWeb(0, dispatch.Receive());
+  if (FAILED(*hresult))
+    return false;
+  base::win::ScopedComPtr<IAppWeb> app;
+  *hresult = dispatch.QueryInterface(app.Receive());
+  if (FAILED(*hresult))
+    return false;
+  dispatch.Release();
+  ConfigureProxyBlanket(app.get());
+
+  // Get the status of Chrome's update check or update.
+  *hresult = app->get_currentState(dispatch.Receive());
   if (FAILED(*hresult))
     return false;
   *hresult = dispatch.QueryInterface(current_state->Receive());
   if (FAILED(*hresult))
     return false;
+  dispatch.Release();
   ConfigureProxyBlanket(current_state->get());
   LONG value = 0;
   *hresult = (*current_state)->get_stateValue(&value);
   if (FAILED(*hresult))
     return false;
   *state_value = static_cast<CurrentState>(value);
   return true;
 }
 
 bool UpdateCheckDriver::IsErrorState(
+    const base::win::ScopedComPtr<IAppBundleWeb>& app_bundle,
     const base::win::ScopedComPtr<ICurrentState>& current_state,
     CurrentState state_value,
     GoogleUpdateErrorCode* error_code,
     HRESULT* hresult,
     int* installer_exit_code,
     base::string16* error_string) const {
   if (state_value == STATE_ERROR) {
     // In general, errors reported by Google Update fall under this category
     // (see special case below).
     *error_code = GOOGLE_UPDATE_ERROR_UPDATING;
@@ skipping 24 matching lines @@
       *installer_exit_code = code;
     }
 
     base::win::ScopedBstr message;
     if (SUCCEEDED(current_state->get_completionMessage(message.Receive())))
       error_string->assign(message, message.Length());
 
     return true;
   }
   if (state_value == STATE_UPDATE_AVAILABLE && install_update_if_possible_) {
-    *hresult = app_bundle_->install();
+    *hresult = app_bundle->install();
     if (FAILED(*hresult)) {
       // Report a failure to start the install as a general error while trying
       // to interact with Google Update.
       *error_code = GOOGLE_UPDATE_ONDEMAND_CLASS_REPORTED_ERROR;
       *installer_exit_code = -1;
       return true;
     }
     // Return false for handling in IsIntermediateState.
   }
   return false;
@@ skipping 92 matching lines @@
     case STATE_ERROR:
     default:
       NOTREACHED();
       UMA_HISTOGRAM_SPARSE_SLOWLY("GoogleUpdate.UnexpectedState", state_value);
       return false;
   }
   return true;
 }
 
 void UpdateCheckDriver::PollGoogleUpdate() {
+  base::win::ScopedComPtr<IAppBundleWeb> app_bundle;
   base::win::ScopedComPtr<ICurrentState> state;
   CurrentState state_value = STATE_INIT;
   HRESULT hresult = S_OK;
   GoogleUpdateErrorCode error_code = GOOGLE_UPDATE_NO_ERROR;
   int installer_exit_code = -1;
   base::string16 error_string;
   GoogleUpdateUpgradeStatus upgrade_status = UPGRADE_ERROR;
   base::string16 new_version;
   int progress = 0;
 
-  if (!GetCurrentState(&state, &state_value, &hresult)) {
+  if (!GetCurrentState(&app_bundle, &state, &state_value, &hresult)) {
     OnUpgradeError(GOOGLE_UPDATE_ONDEMAND_CLASS_REPORTED_ERROR, hresult, -1,
                    base::string16());
-  } else if (IsErrorState(state, state_value, &error_code, &hresult,
+  } else if (IsErrorState(app_bundle, state, state_value, &error_code, &hresult,
                           &installer_exit_code, &error_string)) {
     OnUpgradeError(error_code, hresult, installer_exit_code, error_string);
   } else if (IsFinalState(state, state_value, &upgrade_status, &new_version)) {
     status_ = upgrade_status;
     error_code_ = GOOGLE_UPDATE_NO_ERROR;
     html_error_message_.clear();
     if (!new_version.empty())
       new_version_ = new_version;
     hresult_ = S_OK;
     installer_exit_code_ = -1;
@@ skipping 16 matching lines @@
     // Schedule the next check.
     task_runner_->PostDelayedTask(
         FROM_HERE, base::Bind(&UpdateCheckDriver::PollGoogleUpdate,
                               base::Unretained(this)),
         base::TimeDelta::FromMilliseconds(kGoogleUpdatePollIntervalMs));
     // Early return for this non-terminal state.
     return;
   }
 
   // Release the reference on the COM objects before bouncing back to the
-  // caller's thread.
+  // caller's task runner.
   state.Release();
-  app_.Release();
-  app_bundle_.Release();
-  google_update_.Release();
+  app_bundle.Release();
+  app_bundle_cookie_.Revoke();
+  google_update_cookie_.Revoke();
 
   result_runner_->DeleteSoon(FROM_HERE, this);
 }
 
 void UpdateCheckDriver::OnUpgradeError(GoogleUpdateErrorCode error_code,
                                        HRESULT hresult,
                                        int installer_exit_code,
                                        const base::string16& error_string) {
   status_ = UPGRADE_ERROR;
   error_code_ = error_code;
@@ skipping 16 matching lines @@
     html_error_msg += base::StringPrintf(L": %d", installer_exit_code_);
   if (system_level_install_)
     html_error_msg += L" -- system level";
   if (error_string.empty()) {
     html_error_message_ = l10n_util::GetStringFUTF16(
         IDS_ABOUT_BOX_ERROR_UPDATE_CHECK_FAILED, html_error_msg);
   } else {
     html_error_message_ = l10n_util::GetStringFUTF16(
         IDS_ABOUT_BOX_GOOGLE_UPDATE_ERROR, error_string, html_error_msg);
   }
+
+  app_bundle_cookie_.Revoke();
+  google_update_cookie_.Revoke();
 }
 
 }  // namespace
 
 
 // Globals ---------------------------------------------------------------------
 
-void BeginUpdateCheck(
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner,
-    const std::string& locale,
-    bool install_update_if_possible,
-    gfx::AcceleratedWidget elevation_window,
-    const base::WeakPtr<UpdateCheckDelegate>& delegate) {
+void BeginUpdateCheck(scoped_refptr<base::SequencedTaskRunner> task_runner,
+                      const std::string& locale,
+                      bool install_update_if_possible,
+                      gfx::AcceleratedWidget elevation_window,
+                      const base::WeakPtr<UpdateCheckDelegate>& delegate) {
   UpdateCheckDriver::RunUpdateCheck(std::move(task_runner), locale,
                                     install_update_if_possible,
                                     elevation_window, delegate);
 }
 
 
 // Private API exposed for testing. --------------------------------------------
 
-void SetGoogleUpdateFactoryForTesting(
+void SetUpdateCheckFactoriesForTesting(
+    const GlobalInterfaceTableClassFactory& global_interface_table_factory,
     const GoogleUpdate3ClassFactory& google_update_factory) {
+  if (g_global_interface_table_factory) {
+    delete g_global_interface_table_factory;
+    g_global_interface_table_factory = nullptr;
+  }
+  if (!global_interface_table_factory.is_null())
+    g_global_interface_table_factory =
+        new GlobalInterfaceTableClassFactory(global_interface_table_factory);
+
   if (g_google_update_factory) {
     delete g_google_update_factory;
     g_google_update_factory = nullptr;
   }
   if (!google_update_factory.is_null()) {
     g_google_update_factory =
         new GoogleUpdate3ClassFactory(google_update_factory);
   }
 }