Synchronously disable ConnectionFilterImpl when its RPHI cleans up

content/browser/renderer_host/render_process_host_impl.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Represents the browser side of the browser <--> renderer communication
 // channel. There will be one RenderProcessHost per renderer process.
 
 #include "content/browser/renderer_host/render_process_host_impl.h"
 
 #include <algorithm>
 #include <limits>
 #include <utility>
 #include <vector>
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/files/file.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/memory/ref_counted.h"
 #include "base/memory/shared_memory.h"
 #include "base/memory/shared_memory_handle.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/persistent_histogram_allocator.h"
 #include "base/metrics/persistent_memory_allocator.h"
 #include "base/process/process_handle.h"
 #include "base/rand_util.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/supports_user_data.h"
+#include "base/synchronization/lock.h"
 #include "base/sys_info.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/trace_event/trace_event.h"
 #include "base/tracked_objects.h"
 #include "build/build_config.h"
 #include "cc/base/switches.h"
 #include "cc/output/buffer_to_texture_target_map.h"
 #include "components/memory_coordinator/browser/memory_coordinator.h"
@@ skipping 407 matching lines @@
 
 base::MessageLoop* g_in_process_thread;
 
 // Stores the maximum number of renderer processes the content module can
 // create.
 static size_t g_max_renderer_count_override = 0;
 
 // static
 bool g_run_renderer_in_process_ = false;
 
+// Held by the RPH and used to control an (unowned) ConnectionFilterImpl from
+// any thread.
+class RenderProcessHostImpl::ConnectionFilterController
+    : public base::RefCountedThreadSafe<ConnectionFilterController> {
+ public:
+  // |filter| is not owned by this object.
+  explicit ConnectionFilterController(ConnectionFilterImpl* filter)
+      : filter_(filter) {}
+
+  void DisableFilter();
+
+ private:
+  friend class base::RefCountedThreadSafe<ConnectionFilterController>;
+  friend class ConnectionFilterImpl;
+
+  ~ConnectionFilterController() {}
+
+  void Detach() {
+    base::AutoLock lock(lock_);
+    filter_ = nullptr;
+  }
+
+  base::Lock lock_;
+  ConnectionFilterImpl* filter_;
+};
+
 // Held by the RPH's BrowserContext's MojoShellConnection, ownership transferred
 // back to RPH upon RPH destruction.
 class RenderProcessHostImpl::ConnectionFilterImpl : public ConnectionFilter {
  public:
   ConnectionFilterImpl(
       const shell::Identity& child_identity,
       std::unique_ptr<shell::InterfaceRegistry> registry)
       : child_identity_(child_identity),
         registry_(std::move(registry)),
+        controller_(new ConnectionFilterController(this)),
         weak_factory_(this) {
     // Registration of this filter may race with browser shutdown, in which case
     // it's possible for this filter to be destroyed on the main thread. This
     // is fine as long as the filter hasn't been used on the IO thread yet. We
     // detach the ThreadChecker initially and the first use of the filter will
     // bind it.
     thread_checker_.DetachFromThread();
   }
 
   ~ConnectionFilterImpl() override {
     DCHECK(thread_checker_.CalledOnValidThread());
+    controller_->Detach();
+  }
+
+  scoped_refptr<ConnectionFilterController> controller() { return controller_; }
+
+  void Disable() {
+    base::AutoLock lock(enabled_lock_);
+    enabled_ = false;
   }
 
  private:
   // ConnectionFilter:
   bool OnConnect(const shell::Identity& remote_identity,
                  shell::InterfaceRegistry* registry,
                  shell::Connector* connector) override {
     DCHECK(thread_checker_.CalledOnValidThread());
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     // We only fulfill connections from the renderer we host.
     if (child_identity_.name() != remote_identity.name() ||
         child_identity_.instance() != remote_identity.instance()) {
       return false;
     }
 
+    base::AutoLock lock(enabled_lock_);
+    if (!enabled_)
+      return false;
+
     std::set<std::string> interface_names;
     registry_->GetInterfaceNames(&interface_names);
     for (auto& interface_name : interface_names) {
       // Note that the added callbacks may outlive this object, which is
       // destroyed in RPH::Cleanup().
       registry->AddInterface(interface_name,
                              base::Bind(&ConnectionFilterImpl::GetInterface,
                                         weak_factory_.GetWeakPtr(),
                                         interface_name));
     }
     return true;
   }
 
   void GetInterface(const std::string& interface_name,
                     mojo::ScopedMessagePipeHandle handle) {
     DCHECK(thread_checker_.CalledOnValidThread());
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     shell::mojom::InterfaceProvider* provider = registry_.get();
-    provider->GetInterface(interface_name, std::move(handle));
+
+    base::AutoLock lock(enabled_lock_);
+    if (enabled_)
+      provider->GetInterface(interface_name, std::move(handle));
   }
 
   base::ThreadChecker thread_checker_;
   shell::Identity child_identity_;
   std::unique_ptr<shell::InterfaceRegistry> registry_;
+  scoped_refptr<ConnectionFilterController> controller_;
+
+  // Guards |enabled_|.
+  base::Lock enabled_lock_;
+  bool enabled_ = true;
+
   base::WeakPtrFactory<ConnectionFilterImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ConnectionFilterImpl);
 };
 
+void RenderProcessHostImpl::ConnectionFilterController::DisableFilter() {
+  base::AutoLock lock(lock_);
+  if (filter_)
+    filter_->Disable();
+}
+
 base::MessageLoop*
 RenderProcessHostImpl::GetInProcessRendererThreadForTesting() {
   return g_in_process_thread;
 }
 
 // static
 size_t RenderProcessHost::GetMaxRendererProcessCount() {
   if (g_max_renderer_count_override)
     return g_max_renderer_count_override;
 
@@ skipping 84 matching lines @@
 #endif
       worker_ref_count_(0),
       max_worker_count_(0),
       permission_service_context_(new PermissionServiceContext(this)),
       channel_connected_(false),
       sent_render_process_ready_(false),
 #if defined(OS_ANDROID)
       never_signaled_(base::WaitableEvent::ResetPolicy::MANUAL,
                       base::WaitableEvent::InitialState::NOT_SIGNALED),
 #endif
+      instance_weak_factory_(
+          new base::WeakPtrFactory<RenderProcessHostImpl>(this)),
       weak_factory_(this) {
   widget_helper_ = new RenderWidgetHelper();
 
   ChildProcessSecurityPolicyImpl::GetInstance()->Add(GetID());
 
   CHECK(!BrowserMainRunner::ExitedMainMessageLoop());
   RegisterHost(GetID(), this);
   g_all_hosts.Get().set_check_on_null_data(true);
   // Initialize |child_process_activity_time_| to a reasonable value.
   mark_child_process_activity_time();
@@ skipping 465 matching lines @@
 void RenderProcessHostImpl::RegisterMojoInterfaces() {
   std::unique_ptr<shell::InterfaceRegistry> registry(
       new shell::InterfaceRegistry);
 #if defined(OS_ANDROID)
   interface_registry_android_ =
       InterfaceRegistryAndroid::Create(registry.get());
   InterfaceRegistrarAndroid::ExposeInterfacesToRenderer(
       interface_registry_android_.get());
 #endif
 
-  scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner =
-      BrowserThread::GetTaskRunnerForThread(BrowserThread::UI);
 #if !defined(OS_ANDROID)
-  registry->AddInterface(base::Bind(&device::BatteryMonitorImpl::Create),
-                         ui_task_runner);
+  AddUIThreadInterface(
+      registry.get(), base::Bind(&device::BatteryMonitorImpl::Create));
 #endif
-  registry->AddInterface(
+  AddUIThreadInterface(
+      registry.get(),
       base::Bind(&PermissionServiceContext::CreateService,
-                 base::Unretained(permission_service_context_.get())),
-      ui_task_runner);
+                 base::Unretained(permission_service_context_.get())));
   // TODO(mcasas): finalize arguments.
-  registry->AddInterface(base::Bind(&ImageCaptureImpl::Create),
-                         ui_task_runner);
-  registry->AddInterface(base::Bind(&OffscreenCanvasSurfaceImpl::Create),
-                         ui_task_runner);
-  registry->AddInterface(
+  AddUIThreadInterface(registry.get(), base::Bind(&ImageCaptureImpl::Create));
+  AddUIThreadInterface(registry.get(),
+                       base::Bind(&OffscreenCanvasSurfaceImpl::Create));
+  AddUIThreadInterface(
+      registry.get(),
       base::Bind(&BackgroundSyncContext::CreateService,
                  base::Unretained(
-                     storage_partition_impl_->GetBackgroundSyncContext())),
-      ui_task_runner);
-  registry->AddInterface(
+                     storage_partition_impl_->GetBackgroundSyncContext())));
+  AddUIThreadInterface(
+      registry.get(),
       base::Bind(&PlatformNotificationContextImpl::CreateService,
                  base::Unretained(
                      storage_partition_impl_->GetPlatformNotificationContext()),
-                 GetID()),
-      ui_task_runner);
-  registry->AddInterface(
+                 GetID()));
+  AddUIThreadInterface(
+      registry.get(),
       base::Bind(&RenderProcessHostImpl::CreateStoragePartitionService,
-                 base::Unretained(this)),
-      ui_task_runner);
-  registry->AddInterface(
+                 base::Unretained(this)));
+  AddUIThreadInterface(
+      registry.get(),
       base::Bind(&BroadcastChannelProvider::Connect,
                  base::Unretained(
-                     storage_partition_impl_->GetBroadcastChannelProvider())),
-      ui_task_runner);
+                     storage_partition_impl_->GetBroadcastChannelProvider())));
   if (memory_coordinator::IsEnabled()) {
-    registry->AddInterface(base::Bind(&CreateMemoryCoordinatorHandle, GetID()),
-                           ui_task_runner);
+    AddUIThreadInterface(
+        registry.get(), base::Bind(&CreateMemoryCoordinatorHandle, GetID()));
   }
 
   scoped_refptr<base::SingleThreadTaskRunner> file_task_runner =
       BrowserThread::GetTaskRunnerForThread(BrowserThread::FILE);
   registry->AddInterface(base::Bind(&MimeRegistryImpl::Create),
                          file_task_runner);
 #if defined(USE_MINIKIN_HYPHENATION)
   registry->AddInterface(base::Bind(&hyphenation::HyphenationImpl::Create),
                          file_task_runner);
 #endif
 
   // These callbacks will be run immediately on the IO thread.
   registry->AddInterface(base::Bind(&DeviceLightHost::Create));
   registry->AddInterface(base::Bind(&DeviceMotionHost::Create));
   registry->AddInterface(base::Bind(&DeviceOrientationHost::Create));
   registry->AddInterface(base::Bind(&DeviceOrientationAbsoluteHost::Create));
   registry->AddInterface(
       base::Bind(&URLLoaderFactoryImpl::Create, resource_message_filter_));
 
   // This is to support usage of WebSockets in cases in which there is no
   // associated RenderFrame (e.g., Shared Workers).
-  registry->AddInterface(
-      base::Bind(&WebSocketManager::CreateWebSocket, GetID(), MSG_ROUTING_NONE),
-      ui_task_runner);
+  AddUIThreadInterface(
+      registry.get(), base::Bind(&WebSocketManager::CreateWebSocket, GetID(),
+                                 MSG_ROUTING_NONE));
 
   GetContentClient()->browser()->ExposeInterfacesToRenderer(registry.get(),
                                                             this);
 
   MojoShellConnection* mojo_shell_connection =
       BrowserContext::GetMojoShellConnectionFor(browser_context_);
   std::unique_ptr<ConnectionFilterImpl> connection_filter(
       new ConnectionFilterImpl(mojo_child_connection_->child_identity(),
                                std::move(registry)));
-  connection_filter_ =
+  connection_filter_controller_ = connection_filter->controller();
+  connection_filter_id_ =
       mojo_shell_connection->AddConnectionFilter(std::move(connection_filter));
 }
 
 void RenderProcessHostImpl::CreateStoragePartitionService(
     mojo::InterfaceRequest<mojom::StoragePartitionService> request) {
   // DO NOT REMOVE THIS COMMAND LINE CHECK WITHOUT SECURITY REVIEW!
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kMojoLocalStorage)) {
     storage_partition_impl_->Bind(std::move(request));
   }
@@ skipping 779 matching lines @@
           RenderProcessHostObserver, observers_,
           RenderProcessExited(this, base::TERMINATION_STATUS_NORMAL_TERMINATION,
                               0));
     }
     FOR_EACH_OBSERVER(RenderProcessHostObserver, observers_,
                       RenderProcessHostDestroyed(this));
     NotificationService::current()->Notify(
         NOTIFICATION_RENDERER_PROCESS_TERMINATED,
         Source<RenderProcessHost>(this), NotificationService::NoDetails());
 
-    if (connection_filter_ != MojoShellConnection::kInvalidConnectionFilterId) {
+    if (connection_filter_id_ !=
+          MojoShellConnection::kInvalidConnectionFilterId) {
       MojoShellConnection* mojo_shell_connection =
           BrowserContext::GetMojoShellConnectionFor(browser_context_);
-      mojo_shell_connection->RemoveConnectionFilter(connection_filter_);
-      connection_filter_ = MojoShellConnection::kInvalidConnectionFilterId;
+      connection_filter_controller_->DisableFilter();
+      mojo_shell_connection->RemoveConnectionFilter(connection_filter_id_);
+      connection_filter_id_ = MojoShellConnection::kInvalidConnectionFilterId;
     }
 
 #ifndef NDEBUG
     is_self_deleted_ = true;
 #endif
     base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
     deleting_soon_ = true;
 
 #if USE_ATTACHMENT_BROKER
     IPC::AttachmentBroker::GetGlobal()->DeregisterCommunicationChannel(
         channel_.get());
 #endif
 
     // It's important not to wait for the DeleteTask to delete the channel
     // proxy. Kill it off now. That way, in case the profile is going away, the
     // rest of the objects attached to this RenderProcessHost start going
     // away first, since deleting the channel proxy will post a
     // OnChannelClosed() to IPC::ChannelProxy::Context on the IO thread.
     channel_.reset();
 
     // The following members should be cleared in ProcessDied() as well!
     message_port_message_filter_ = NULL;
 
     RemoveUserData(kSessionStorageHolderKey);
 
     // Remove ourself from the list of renderer processes so that we can't be
     // reused in between now and when the Delete task runs.
     UnregisterHost(GetID());
+
+    instance_weak_factory_.reset(
+        new base::WeakPtrFactory<RenderProcessHostImpl>(this));
   }
 }
 
 void RenderProcessHostImpl::AddPendingView() {
   pending_views_++;
 }
 
 void RenderProcessHostImpl::RemovePendingView() {
   DCHECK(pending_views_);
   pending_views_--;
@@ skipping 804 matching lines @@
   LOG(ERROR) << "Terminating render process for bad Mojo message: " << error;
 
   // The ReceivedBadMessage call below will trigger a DumpWithoutCrashing. Alias
   // enough information here so that we can determine what the bad message was.
   base::debug::Alias(&error);
   bad_message::ReceivedBadMessage(process.get(),
                                   bad_message::RPH_MOJO_PROCESS_ERROR);
 }
 
 }  // namespace content