Use UtilityProcessHost to patch files.

chrome/browser/component_updater/component_updater_service.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/component_updater/component_updater_service.h"
 
 #include <algorithm>
 #include <set>
 #include <vector>
 
 #include "base/at_exit.h"
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/sequenced_task_runner.h"
 #include "base/stl_util.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/timer/timer.h"
 #include "chrome/browser/browser_process.h"
-#include "chrome/browser/component_updater/component_patcher.h"
 #include "chrome/browser/component_updater/component_unpacker.h"
 #include "chrome/browser/component_updater/component_updater_ping_manager.h"
 #include "chrome/browser/component_updater/component_updater_utils.h"
 #include "chrome/browser/component_updater/crx_downloader.h"
 #include "chrome/browser/component_updater/crx_update_item.h"
 #include "chrome/browser/component_updater/update_checker.h"
 #include "chrome/browser/component_updater/update_response.h"
 #include "chrome/common/chrome_version_info.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/resource_controller.h"
@@ skipping 209 matching lines @@
   void NotifyComponentObservers(ComponentObserver::Events event,
                                 int extra) const;
 
   bool HasOnDemandItems() const;
 
   void OnNewResourceThrottle(base::WeakPtr<CUResourceThrottle> rt,
                              const std::string& crx_id);
 
   scoped_ptr<ComponentUpdateService::Configurator> config_;
 
-  scoped_ptr<ComponentPatcher> component_patcher_;
-
   scoped_ptr<UpdateChecker> update_checker_;
 
   scoped_ptr<PingManager> ping_manager_;
 
   scoped_ptr<ComponentUnpacker> unpacker_;
 
   scoped_ptr<CrxDownloader> crx_downloader_;
 
   // A collection of every work item.
   typedef std::vector<CrxUpdateItem*> UpdateItems;
   UpdateItems work_items_;
 
   base::OneShotTimer<CrxUpdateService> timer_;
 
   scoped_refptr<base::SequencedTaskRunner> blocking_task_runner_;
 
   const Version chrome_version_;
 
   bool running_;
 
   DISALLOW_COPY_AND_ASSIGN(CrxUpdateService);
 };
 
 //////////////////////////////////////////////////////////////////////////////
 
 CrxUpdateService::CrxUpdateService(ComponentUpdateService::Configurator* config)
     : config_(config),
-      component_patcher_(config->CreateComponentPatcher()),
       ping_manager_(new PingManager(config->PingUrl(),
                                     config->RequestContext())),
       blocking_task_runner_(BrowserThread::GetBlockingPool()->
           GetSequencedTaskRunnerWithShutdownBehavior(
               BrowserThread::GetBlockingPool()->GetSequenceToken(),
               base::SequencedWorkerPool::SKIP_ON_SHUTDOWN)),
       chrome_version_(chrome::VersionInfo().Version()),
       running_(false) {
 }
 
@@ skipping 542 matching lines @@
 // Install consists of digital signature verification, unpacking and then
 // calling the component specific installer. All that is handled by the
 // |unpacker_|. If there is an error this function is in charge of deleting
 // the files created.
 void CrxUpdateService::Install(scoped_ptr<CRXContext> context,
                                const base::FilePath& crx_path) {
   // This function owns the file at |crx_path| and the |context| object.
   unpacker_.reset(new ComponentUnpacker(context->pk_hash,
                                         crx_path,
                                         context->fingerprint,
-                                        component_patcher_.get(),
                                         context->installer,
+                                        config_->InProcess(),
                                         blocking_task_runner_));
   unpacker_->Unpack(base::Bind(&CrxUpdateService::EndUnpacking,
                                base::Unretained(this),
                                context->id,
                                crx_path));
 }
 
 void CrxUpdateService::EndUnpacking(const std::string& component_id,
                                     const base::FilePath& crx_path,
                                     ComponentUnpacker::Error error,
                                     int extended_error) {
   if (!DeleteFileAndEmptyParentDirectory(crx_path))
     NOTREACHED() << crx_path.value();
   BrowserThread::PostDelayedTask(
       BrowserThread::UI,
       FROM_HERE,
       base::Bind(&CrxUpdateService::DoneInstalling, base::Unretained(this),
                  component_id, error, extended_error),
       base::TimeDelta::FromMilliseconds(config_->StepDelay()));
+  // Reset the unpacker last, otherwise we free our own arguments.

[Sorin Jianu, 2014/02/03 20:57:57]

What happens if the unpacker is destroyed sooner?

[waffles, 2014/02/07 01:00:59]

The problem is that the unpacker owns the EndUnpacking callback, which owns
component_id, crx_path.

If EndUnpacking destroys the unpacker, the unpacker destroys the callback, while
the callback code is running.

This is a pretty awful situation.

One possible solution is to pass a component unpacker function as the callback
function, and make the component unpacker refcounted so that the callback
maintains a reference to the component unpacker. That component unpacker
function could then call CrxUpdateService::EndUnpacking directly. This seems
really circuitous, though.

[Sorin Jianu, 2014/02/27 20:53:57]

Thank you. I would suggest rewording the comment as:
// Reset the unpacker last, since it owns the callback which is currently
running.
 
It also made me think about how the other objects in the service are released
(or not).

+  unpacker_.reset();
 }
 
 // Installation has been completed. Adjust the component status and
 // schedule the next check. Schedule a short delay before trying the full
 // update when the differential update failed.
 void CrxUpdateService::DoneInstalling(const std::string& component_id,
                                       ComponentUnpacker::Error error,
                                       int extra_code) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
@@ skipping 118 matching lines @@
 // The component update factory. Using the component updater as a singleton
 // is the job of the browser process.
 ComponentUpdateService* ComponentUpdateServiceFactory(
     ComponentUpdateService::Configurator* config) {
   DCHECK(config);
   return new CrxUpdateService(config);
 }
 
 }  // namespace component_updater