OLD | NEW |
| (Empty) |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "storage/browser/blob/blob_async_builder_host.h" | |
6 | |
7 #include <stddef.h> | |
8 #include <stdint.h> | |
9 | |
10 #include <memory> | |
11 #include <utility> | |
12 | |
13 #include "base/bind.h" | |
14 #include "base/memory/ptr_util.h" | |
15 #include "base/memory/shared_memory.h" | |
16 #include "storage/browser/blob/blob_data_handle.h" | |
17 #include "storage/browser/blob/blob_storage_context.h" | |
18 | |
19 namespace storage { | |
20 namespace { | |
21 | |
22 bool CalculateBlobMemorySize(const std::vector<DataElement>& elements, | |
23 size_t* shortcut_bytes, | |
24 uint64_t* total_bytes) { | |
25 DCHECK(shortcut_bytes); | |
26 DCHECK(total_bytes); | |
27 base::CheckedNumeric<uint64_t> total_size_checked = 0; | |
28 base::CheckedNumeric<size_t> shortcut_size_checked = 0; | |
29 for (const auto& e : elements) { | |
30 if (e.type() == DataElement::TYPE_BYTES) { | |
31 total_size_checked += e.length(); | |
32 shortcut_size_checked += e.length(); | |
33 } else if (e.type() == DataElement::TYPE_BYTES_DESCRIPTION) { | |
34 total_size_checked += e.length(); | |
35 } else { | |
36 continue; | |
37 } | |
38 if (!total_size_checked.IsValid() || !shortcut_size_checked.IsValid()) { | |
39 return false; | |
40 } | |
41 } | |
42 *shortcut_bytes = shortcut_size_checked.ValueOrDie(); | |
43 *total_bytes = total_size_checked.ValueOrDie(); | |
44 return true; | |
45 } | |
46 | |
47 IPCBlobCreationCancelCode ConvertReferencedBlobErrorToConstructingError( | |
48 IPCBlobCreationCancelCode referenced_blob_error) { | |
49 switch (referenced_blob_error) { | |
50 // For most cases we propagate the error. | |
51 case IPCBlobCreationCancelCode::FILE_WRITE_FAILED: | |
52 case IPCBlobCreationCancelCode::SOURCE_DIED_IN_TRANSIT: | |
53 case IPCBlobCreationCancelCode::REFERENCED_BLOB_BROKEN: | |
54 case IPCBlobCreationCancelCode::OUT_OF_MEMORY: | |
55 return referenced_blob_error; | |
56 // Others we report that the referenced blob is broken, as we don't know | |
57 // why (the BLOB_DEREFERENCED_WHILE_BUILDING should never happen, as we hold | |
58 // onto the reference of the blobs we're using). | |
59 case IPCBlobCreationCancelCode::BLOB_DEREFERENCED_WHILE_BUILDING: | |
60 DCHECK(false) << "Referenced blob should never be dereferenced while we " | |
61 << "are depending on it, as our system holds a handle."; | |
62 case IPCBlobCreationCancelCode::UNKNOWN: | |
63 return IPCBlobCreationCancelCode::REFERENCED_BLOB_BROKEN; | |
64 } | |
65 NOTREACHED(); | |
66 return IPCBlobCreationCancelCode::REFERENCED_BLOB_BROKEN; | |
67 } | |
68 | |
69 } // namespace | |
70 | |
71 using MemoryItemRequest = | |
72 BlobAsyncTransportRequestBuilder::RendererMemoryItemRequest; | |
73 | |
74 BlobAsyncBuilderHost::BlobBuildingState::BlobBuildingState( | |
75 const std::string& uuid, | |
76 std::set<std::string> referenced_blob_uuids, | |
77 std::vector<std::unique_ptr<BlobDataHandle>>* referenced_blob_handles) | |
78 : data_builder(uuid), | |
79 referenced_blob_uuids(referenced_blob_uuids), | |
80 referenced_blob_handles(std::move(*referenced_blob_handles)) {} | |
81 | |
82 BlobAsyncBuilderHost::BlobBuildingState::~BlobBuildingState() {} | |
83 | |
84 BlobAsyncBuilderHost::BlobAsyncBuilderHost() : ptr_factory_(this) {} | |
85 | |
86 BlobAsyncBuilderHost::~BlobAsyncBuilderHost() {} | |
87 | |
88 BlobTransportResult BlobAsyncBuilderHost::RegisterBlobUUID( | |
89 const std::string& uuid, | |
90 const std::string& content_type, | |
91 const std::string& content_disposition, | |
92 const std::set<std::string>& referenced_blob_uuids, | |
93 BlobStorageContext* context) { | |
94 if (async_blob_map_.find(uuid) != async_blob_map_.end()) | |
95 return BlobTransportResult::BAD_IPC; | |
96 if (referenced_blob_uuids.find(uuid) != referenced_blob_uuids.end()) | |
97 return BlobTransportResult::BAD_IPC; | |
98 context->CreatePendingBlob(uuid, content_type, content_disposition); | |
99 std::vector<std::unique_ptr<BlobDataHandle>> handles; | |
100 for (const std::string& referenced_uuid : referenced_blob_uuids) { | |
101 std::unique_ptr<BlobDataHandle> handle = | |
102 context->GetBlobDataFromUUID(referenced_uuid); | |
103 if (!handle || handle->IsBroken()) { | |
104 // We cancel the blob right away, and don't bother storing our state. | |
105 context->CancelPendingBlob( | |
106 uuid, IPCBlobCreationCancelCode::REFERENCED_BLOB_BROKEN); | |
107 return BlobTransportResult::CANCEL_REFERENCED_BLOB_BROKEN; | |
108 } | |
109 handles.emplace_back(std::move(handle)); | |
110 } | |
111 async_blob_map_[uuid] = base::MakeUnique<BlobBuildingState>( | |
112 uuid, referenced_blob_uuids, &handles); | |
113 return BlobTransportResult::DONE; | |
114 } | |
115 | |
116 BlobTransportResult BlobAsyncBuilderHost::StartBuildingBlob( | |
117 const std::string& uuid, | |
118 const std::vector<DataElement>& elements, | |
119 size_t memory_available, | |
120 BlobStorageContext* context, | |
121 const RequestMemoryCallback& request_memory) { | |
122 DCHECK(context); | |
123 DCHECK(async_blob_map_.find(uuid) != async_blob_map_.end()); | |
124 | |
125 // Step 1: Get the sizes. | |
126 size_t shortcut_memory_size_bytes = 0; | |
127 uint64_t total_memory_size_bytes = 0; | |
128 if (!CalculateBlobMemorySize(elements, &shortcut_memory_size_bytes, | |
129 &total_memory_size_bytes)) { | |
130 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::UNKNOWN, context); | |
131 return BlobTransportResult::BAD_IPC; | |
132 } | |
133 | |
134 // Step 2: Check if we have enough memory to store the blob. | |
135 if (total_memory_size_bytes > memory_available) { | |
136 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::OUT_OF_MEMORY, context); | |
137 return BlobTransportResult::CANCEL_MEMORY_FULL; | |
138 } | |
139 | |
140 // From here on, we know we can fit the blob in memory. | |
141 BlobBuildingState* state_ptr = async_blob_map_[uuid].get(); | |
142 if (!state_ptr->request_builder.requests().empty()) { | |
143 // Check that we're not a duplicate call. | |
144 return BlobTransportResult::BAD_IPC; | |
145 } | |
146 state_ptr->request_memory_callback = request_memory; | |
147 | |
148 // Step 3: Check to make sure the referenced blob information we received | |
149 // earlier is correct: | |
150 std::set<std::string> extracted_blob_uuids; | |
151 for (const DataElement& e : elements) { | |
152 if (e.type() == DataElement::TYPE_BLOB) { | |
153 extracted_blob_uuids.insert(e.blob_uuid()); | |
154 // We can't depend on ourselves. | |
155 if (e.blob_uuid() == uuid) { | |
156 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::UNKNOWN, context); | |
157 return BlobTransportResult::BAD_IPC; | |
158 } | |
159 } | |
160 } | |
161 if (extracted_blob_uuids != state_ptr->referenced_blob_uuids) { | |
162 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::UNKNOWN, context); | |
163 return BlobTransportResult::BAD_IPC; | |
164 } | |
165 | |
166 // Step 4: Decide if we're using the shortcut method. This will also catch | |
167 // the case where we don't have any memory items. | |
168 if (shortcut_memory_size_bytes == total_memory_size_bytes && | |
169 shortcut_memory_size_bytes <= memory_available) { | |
170 for (const DataElement& e : elements) { | |
171 state_ptr->data_builder.AppendIPCDataElement(e); | |
172 } | |
173 FinishBuildingBlob(state_ptr, context); | |
174 return BlobTransportResult::DONE; | |
175 } | |
176 | |
177 // From here on, we know the blob's size is less than |memory_available|, | |
178 // so we know we're < max(size_t). | |
179 // Step 5: Decide if we're using shared memory. | |
180 if (total_memory_size_bytes > max_ipc_memory_size_) { | |
181 state_ptr->request_builder.InitializeForSharedMemoryRequests( | |
182 max_shared_memory_size_, total_memory_size_bytes, elements, | |
183 &(state_ptr->data_builder)); | |
184 } else { | |
185 // Step 6: We can fit in IPC. | |
186 state_ptr->request_builder.InitializeForIPCRequests( | |
187 max_ipc_memory_size_, total_memory_size_bytes, elements, | |
188 &(state_ptr->data_builder)); | |
189 } | |
190 // We initialize our requests received state now that they are populated. | |
191 state_ptr->request_received.resize( | |
192 state_ptr->request_builder.requests().size(), false); | |
193 return ContinueBlobMemoryRequests(uuid, context); | |
194 } | |
195 | |
196 BlobTransportResult BlobAsyncBuilderHost::OnMemoryResponses( | |
197 const std::string& uuid, | |
198 const std::vector<BlobItemBytesResponse>& responses, | |
199 BlobStorageContext* context) { | |
200 AsyncBlobMap::const_iterator state_it = async_blob_map_.find(uuid); | |
201 if (state_it == async_blob_map_.end()) { | |
202 DVLOG(1) << "Could not find blob " << uuid; | |
203 return BlobTransportResult::BAD_IPC; | |
204 } | |
205 if (responses.empty()) { | |
206 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::UNKNOWN, context); | |
207 return BlobTransportResult::BAD_IPC; | |
208 } | |
209 BlobAsyncBuilderHost::BlobBuildingState* state = state_it->second.get(); | |
210 BlobAsyncTransportRequestBuilder& request_builder = state->request_builder; | |
211 const auto& requests = request_builder.requests(); | |
212 for (const BlobItemBytesResponse& response : responses) { | |
213 if (response.request_number >= requests.size()) { | |
214 // Bad IPC, so we delete our record and ignore. | |
215 DVLOG(1) << "Invalid request number " << response.request_number; | |
216 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::UNKNOWN, context); | |
217 return BlobTransportResult::BAD_IPC; | |
218 } | |
219 DCHECK_LT(response.request_number, state->request_received.size()); | |
220 const MemoryItemRequest& request = requests[response.request_number]; | |
221 if (state->request_received[response.request_number]) { | |
222 // Bad IPC, so we delete our record. | |
223 DVLOG(1) << "Already received response for that request."; | |
224 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::UNKNOWN, context); | |
225 return BlobTransportResult::BAD_IPC; | |
226 } | |
227 state->request_received[response.request_number] = true; | |
228 bool invalid_ipc = false; | |
229 bool memory_error = false; | |
230 switch (request.message.transport_strategy) { | |
231 case IPCBlobItemRequestStrategy::IPC: | |
232 if (response.inline_data.size() < request.message.size) { | |
233 DVLOG(1) << "Invalid data size " << response.inline_data.size() | |
234 << " vs requested size of " << request.message.size; | |
235 invalid_ipc = true; | |
236 break; | |
237 } | |
238 invalid_ipc = !state->data_builder.PopulateFutureData( | |
239 request.browser_item_index, &response.inline_data[0], | |
240 request.browser_item_offset, request.message.size); | |
241 break; | |
242 case IPCBlobItemRequestStrategy::SHARED_MEMORY: | |
243 if (state->num_shared_memory_requests == 0) { | |
244 DVLOG(1) << "Received too many responses for shared memory."; | |
245 invalid_ipc = true; | |
246 break; | |
247 } | |
248 state->num_shared_memory_requests--; | |
249 if (!state->shared_memory_block->memory()) { | |
250 // We just map the whole block, as we'll probably be accessing the | |
251 // whole thing in this group of responses. Another option is to use | |
252 // MapAt, remove the mapped boolean, and then exclude the | |
253 // handle_offset below. | |
254 size_t handle_size = request_builder.shared_memory_sizes() | |
255 [state->current_shared_memory_handle_index]; | |
256 if (!state->shared_memory_block->Map(handle_size)) { | |
257 DVLOG(1) << "Unable to map memory to size " << handle_size; | |
258 memory_error = true; | |
259 break; | |
260 } | |
261 } | |
262 | |
263 invalid_ipc = !state->data_builder.PopulateFutureData( | |
264 request.browser_item_index, | |
265 static_cast<const char*>(state->shared_memory_block->memory()) + | |
266 request.message.handle_offset, | |
267 request.browser_item_offset, request.message.size); | |
268 break; | |
269 case IPCBlobItemRequestStrategy::FILE: | |
270 case IPCBlobItemRequestStrategy::UNKNOWN: | |
271 DVLOG(1) << "Not implemented."; | |
272 invalid_ipc = true; | |
273 break; | |
274 } | |
275 if (invalid_ipc) { | |
276 // Bad IPC, so we delete our record and return false. | |
277 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::UNKNOWN, context); | |
278 return BlobTransportResult::BAD_IPC; | |
279 } | |
280 if (memory_error) { | |
281 DVLOG(1) << "Shared memory error."; | |
282 CancelBuildingBlob(uuid, IPCBlobCreationCancelCode::OUT_OF_MEMORY, | |
283 context); | |
284 return BlobTransportResult::CANCEL_MEMORY_FULL; | |
285 } | |
286 state->num_fulfilled_requests++; | |
287 } | |
288 return ContinueBlobMemoryRequests(uuid, context); | |
289 } | |
290 | |
291 void BlobAsyncBuilderHost::CancelBuildingBlob(const std::string& uuid, | |
292 IPCBlobCreationCancelCode code, | |
293 BlobStorageContext* context) { | |
294 DCHECK(context); | |
295 auto state_it = async_blob_map_.find(uuid); | |
296 if (state_it == async_blob_map_.end()) { | |
297 return; | |
298 } | |
299 // We can have the blob dereferenced by the renderer, but have it still being | |
300 // 'built'. In this case, it's destructed in the context, but we still have | |
301 // it in our map. Hence we make sure the context has the entry before | |
302 // calling cancel. | |
303 if (context->registry().HasEntry(uuid)) | |
304 context->CancelPendingBlob(uuid, code); | |
305 async_blob_map_.erase(state_it); | |
306 } | |
307 | |
308 void BlobAsyncBuilderHost::CancelAll(BlobStorageContext* context) { | |
309 DCHECK(context); | |
310 // If the blob still exists in the context (and is being built), then we know | |
311 // that someone else is expecting our blob, and we need to cancel it to let | |
312 // the dependency know it's gone. | |
313 std::vector<std::unique_ptr<BlobDataHandle>> referenced_pending_blobs; | |
314 for (const auto& uuid_state_pair : async_blob_map_) { | |
315 if (context->IsBeingBuilt(uuid_state_pair.first)) { | |
316 referenced_pending_blobs.emplace_back( | |
317 context->GetBlobDataFromUUID(uuid_state_pair.first)); | |
318 } | |
319 } | |
320 // We clear the map before canceling them to prevent any strange reentry into | |
321 // our class (see ReferencedBlobFinished) if any blobs were waiting for others | |
322 // to construct. | |
323 async_blob_map_.clear(); | |
324 for (const std::unique_ptr<BlobDataHandle>& handle : | |
325 referenced_pending_blobs) { | |
326 context->CancelPendingBlob( | |
327 handle->uuid(), IPCBlobCreationCancelCode::SOURCE_DIED_IN_TRANSIT); | |
328 } | |
329 } | |
330 | |
331 BlobTransportResult BlobAsyncBuilderHost::ContinueBlobMemoryRequests( | |
332 const std::string& uuid, | |
333 BlobStorageContext* context) { | |
334 AsyncBlobMap::const_iterator state_it = async_blob_map_.find(uuid); | |
335 DCHECK(state_it != async_blob_map_.end()); | |
336 BlobAsyncBuilderHost::BlobBuildingState* state = state_it->second.get(); | |
337 | |
338 BlobAsyncTransportRequestBuilder& request_builder = state->request_builder; | |
339 const std::vector<MemoryItemRequest>& requests = request_builder.requests(); | |
340 size_t num_requests = requests.size(); | |
341 if (state->num_fulfilled_requests == num_requests) { | |
342 FinishBuildingBlob(state, context); | |
343 return BlobTransportResult::DONE; | |
344 } | |
345 DCHECK_LT(state->num_fulfilled_requests, num_requests); | |
346 if (state->next_request == num_requests) { | |
347 // We are still waiting on other requests to come back. | |
348 return BlobTransportResult::PENDING_RESPONSES; | |
349 } | |
350 | |
351 std::unique_ptr<std::vector<BlobItemBytesRequest>> byte_requests( | |
352 new std::vector<BlobItemBytesRequest>()); | |
353 std::unique_ptr<std::vector<base::SharedMemoryHandle>> shared_memory( | |
354 new std::vector<base::SharedMemoryHandle>()); | |
355 | |
356 for (; state->next_request < num_requests; ++state->next_request) { | |
357 const MemoryItemRequest& request = requests[state->next_request]; | |
358 | |
359 bool stop_accumulating = false; | |
360 bool using_shared_memory_handle = state->num_shared_memory_requests > 0; | |
361 switch (request.message.transport_strategy) { | |
362 case IPCBlobItemRequestStrategy::IPC: | |
363 byte_requests->push_back(request.message); | |
364 break; | |
365 case IPCBlobItemRequestStrategy::SHARED_MEMORY: | |
366 if (using_shared_memory_handle && | |
367 state->current_shared_memory_handle_index != | |
368 request.message.handle_index) { | |
369 // We only want one shared memory per requesting blob. | |
370 stop_accumulating = true; | |
371 break; | |
372 } | |
373 using_shared_memory_handle = true; | |
374 state->current_shared_memory_handle_index = | |
375 request.message.handle_index; | |
376 state->num_shared_memory_requests++; | |
377 | |
378 if (!state->shared_memory_block) { | |
379 state->shared_memory_block.reset(new base::SharedMemory()); | |
380 size_t size = | |
381 request_builder | |
382 .shared_memory_sizes()[request.message.handle_index]; | |
383 if (!state->shared_memory_block->CreateAnonymous(size)) { | |
384 DVLOG(1) << "Unable to allocate shared memory for blob transfer."; | |
385 return BlobTransportResult::CANCEL_MEMORY_FULL; | |
386 } | |
387 } | |
388 shared_memory->push_back(state->shared_memory_block->handle()); | |
389 byte_requests->push_back(request.message); | |
390 // Since we are only using one handle at a time, transform our handle | |
391 // index correctly back to 0. | |
392 byte_requests->back().handle_index = 0; | |
393 break; | |
394 case IPCBlobItemRequestStrategy::FILE: | |
395 case IPCBlobItemRequestStrategy::UNKNOWN: | |
396 NOTREACHED() << "Not implemented yet."; | |
397 break; | |
398 } | |
399 if (stop_accumulating) { | |
400 break; | |
401 } | |
402 } | |
403 DCHECK(!requests.empty()); | |
404 | |
405 state->request_memory_callback.Run( | |
406 std::move(byte_requests), std::move(shared_memory), | |
407 base::MakeUnique<std::vector<base::File>>()); | |
408 return BlobTransportResult::PENDING_RESPONSES; | |
409 } | |
410 | |
411 void BlobAsyncBuilderHost::ReferencedBlobFinished( | |
412 const std::string& owning_blob_uuid, | |
413 base::WeakPtr<BlobStorageContext> context, | |
414 bool construction_success, | |
415 IPCBlobCreationCancelCode reason) { | |
416 if (!context) { | |
417 return; | |
418 } | |
419 auto state_it = async_blob_map_.find(owning_blob_uuid); | |
420 if (state_it == async_blob_map_.end()) { | |
421 return; | |
422 } | |
423 if (!construction_success) { | |
424 CancelBuildingBlob(owning_blob_uuid, | |
425 ConvertReferencedBlobErrorToConstructingError(reason), | |
426 context.get()); | |
427 return; | |
428 } | |
429 BlobBuildingState* state = state_it->second.get(); | |
430 DCHECK_GT(state->num_referenced_blobs_building, 0u); | |
431 if (--state->num_referenced_blobs_building == 0) { | |
432 context->CompletePendingBlob(state->data_builder); | |
433 async_blob_map_.erase(state->data_builder.uuid()); | |
434 } | |
435 } | |
436 | |
437 void BlobAsyncBuilderHost::FinishBuildingBlob(BlobBuildingState* state, | |
438 BlobStorageContext* context) { | |
439 if (!state->referenced_blob_uuids.empty()) { | |
440 DCHECK_EQ(0u, state->num_referenced_blobs_building); | |
441 state->num_referenced_blobs_building = 0; | |
442 // We assume re-entry is not possible, as RunOnConstructionComplete | |
443 // will schedule a task when the blob is being built. Thus we can't have the | |
444 // case where |num_referenced_blobs_building| reaches 0 in the | |
445 // ReferencedBlobFinished method before we're finished looping. | |
446 for (const std::string& referenced_uuid : state->referenced_blob_uuids) { | |
447 if (context->IsBeingBuilt(referenced_uuid)) { | |
448 state->num_referenced_blobs_building++; | |
449 context->RunOnConstructionComplete( | |
450 referenced_uuid, | |
451 base::Bind(&BlobAsyncBuilderHost::ReferencedBlobFinished, | |
452 ptr_factory_.GetWeakPtr(), state->data_builder.uuid(), | |
453 context->AsWeakPtr())); | |
454 } | |
455 } | |
456 if (state->num_referenced_blobs_building > 0) { | |
457 // We wait until referenced blobs are done. | |
458 return; | |
459 } | |
460 } | |
461 context->CompletePendingBlob(state->data_builder); | |
462 async_blob_map_.erase(state->data_builder.uuid()); | |
463 } | |
464 | |
465 } // namespace storage | |
OLD | NEW |