Always notify Mojo EDK of incomplete content child process launch

Always notify Mojo EDK of incomplete content child process launch

There are some cases where RenderProcessHostImpl creates a
ChildConnection - and therefore allocates a partial message pipe
with a corresponding pending reservation for the other end,
associated with a child token - but never launches a child process
or even attempts to use a ChildProcessLauncher.

This is intentional due to the fact that ChildConnection
facilitates IPC Channel creation, and we support horribly
subtle legacy expectations regarding the existence of said
Channel at various points in the RPHI's lifetime.

In such cases, neither mojo::edk::ChildProcessLaunched nor
mojo::edk::ChildProcessLaunchFailed is called for the child
token, as this is normally done by ChildProcessLauncher.
This leaves the child's ServiceRequest pipe reservation pending
indefinitely and thus leaves the corresponding ServiceManager
Instance with an indefinitely open Service pipe, effectively
causing the Service Manager to leak content_renderer Instances.

This CL fixes the problem by having ChildConnection notify the
EDK of launch failure if the ChildConnection is destroyed before
its user provides a child process handle.

BUG=682459
R=ben@chromium.org

Review-Url: https://codereview.chromium.org/2645713004
Cr-Commit-Position: refs/heads/master@{#444830}
Committed: https://chromium.googlesource.com/chromium/src/+/fe2fecc147dceea5d6445140448d1ae8a53ecfcb

[Ken Rockot(use gerrit already), 2017-01-19 19:16:24]

The CQ bit was checked by rockot@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-19 19:16:48]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Ken Rockot(use gerrit already), 2017-01-19 19:17:29]

Description was changed from

==========
Notify Mojo EDK of incomplete process launch

There are some cases where RenderProcessHostImpl creates a
ChildConnection - and therefore allocates a partial message pipe
with a corresponding pending reservation for the other end,
associated with a child token - but never launches a child process
or even attempts to use a ChildProcessLauncher.

This is intentional due to the fact that ChildConnection
facilitates IPC Channel creation, and we support horribly
subtle legacy expectations regarding the existence of said
Channel at various points in the RPHI's lifetime.

In such cases, neither mojo::edk::ChildProcessLaunched nor
mojo::edk::ChildProcessLaunchFailed is called for the child
token, as this is normally done by ChildProcessLauncher.
This leaves the child's ServiceRequest pipe reservation pending
indefinitely and thus leaves the corresponding ServiceManager
Instance with an indefinitely open Service pipe, effectively
causing the Service Manager to leak content_renderer Instances.

This CL fixes the problem by having ChildConnection notify the
EDK of launch failure if the ChildConnection is destroyed before
its user provides a child process handle.

BUG=682459
R=ben@chromium.org
==========

to

==========
Always notify Mojo EDK of incomplete content child process launch

There are some cases where RenderProcessHostImpl creates a
ChildConnection - and therefore allocates a partial message pipe
with a corresponding pending reservation for the other end,
associated with a child token - but never launches a child process
or even attempts to use a ChildProcessLauncher.

This is intentional due to the fact that ChildConnection
facilitates IPC Channel creation, and we support horribly
subtle legacy expectations regarding the existence of said
Channel at various points in the RPHI's lifetime.

In such cases, neither mojo::edk::ChildProcessLaunched nor
mojo::edk::ChildProcessLaunchFailed is called for the child
token, as this is normally done by ChildProcessLauncher.
This leaves the child's ServiceRequest pipe reservation pending
indefinitely and thus leaves the corresponding ServiceManager
Instance with an indefinitely open Service pipe, effectively
causing the Service Manager to leak content_renderer Instances.

This CL fixes the problem by having ChildConnection notify the
EDK of launch failure if the ChildConnection is destroyed before
its user provides a child process handle.

BUG=682459
R=ben@chromium.org
==========

[Ben Goodger (Google), 2017-01-19 19:22:43]

lgtm

[Ken Rockot(use gerrit already), 2017-01-19 19:24:05]

The CQ bit was unchecked by rockot@chromium.org

[Ken Rockot(use gerrit already), 2017-01-19 19:24:06]

The CQ bit was checked by rockot@chromium.org

[commit-bot: I haz the power, 2017-01-19 19:24:18]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-19 20:16:24]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1484853846789070, "parent_rev":
"f4594827f0e174ac368878e81da6f1cd02b4b056", "commit_rev":
"fe2fecc147dceea5d6445140448d1ae8a53ecfcb"}

[commit-bot: I haz the power, 2017-01-19 20:16:55]

Description was changed from

==========
Always notify Mojo EDK of incomplete content child process launch

There are some cases where RenderProcessHostImpl creates a
ChildConnection - and therefore allocates a partial message pipe
with a corresponding pending reservation for the other end,
associated with a child token - but never launches a child process
or even attempts to use a ChildProcessLauncher.

This is intentional due to the fact that ChildConnection
facilitates IPC Channel creation, and we support horribly
subtle legacy expectations regarding the existence of said
Channel at various points in the RPHI's lifetime.

In such cases, neither mojo::edk::ChildProcessLaunched nor
mojo::edk::ChildProcessLaunchFailed is called for the child
token, as this is normally done by ChildProcessLauncher.
This leaves the child's ServiceRequest pipe reservation pending
indefinitely and thus leaves the corresponding ServiceManager
Instance with an indefinitely open Service pipe, effectively
causing the Service Manager to leak content_renderer Instances.

This CL fixes the problem by having ChildConnection notify the
EDK of launch failure if the ChildConnection is destroyed before
its user provides a child process handle.

BUG=682459
R=ben@chromium.org
==========

to

==========
Always notify Mojo EDK of incomplete content child process launch

There are some cases where RenderProcessHostImpl creates a
ChildConnection - and therefore allocates a partial message pipe
with a corresponding pending reservation for the other end,
associated with a child token - but never launches a child process
or even attempts to use a ChildProcessLauncher.

This is intentional due to the fact that ChildConnection
facilitates IPC Channel creation, and we support horribly
subtle legacy expectations regarding the existence of said
Channel at various points in the RPHI's lifetime.

In such cases, neither mojo::edk::ChildProcessLaunched nor
mojo::edk::ChildProcessLaunchFailed is called for the child
token, as this is normally done by ChildProcessLauncher.
This leaves the child's ServiceRequest pipe reservation pending
indefinitely and thus leaves the corresponding ServiceManager
Instance with an indefinitely open Service pipe, effectively
causing the Service Manager to leak content_renderer Instances.

This CL fixes the problem by having ChildConnection notify the
EDK of launch failure if the ChildConnection is destroyed before
its user provides a child process handle.

BUG=682459
R=ben@chromium.org

Review-Url: https://codereview.chromium.org/2645713004
Cr-Commit-Position: refs/heads/master@{#444830}
Committed:
https://chromium.googlesource.com/chromium/src/+/fe2fecc147dceea5d6445140448d...
==========

[commit-bot: I haz the power, 2017-01-19 20:16:56]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/chromium/src/+/fe2fecc147dceea5d6445140448d...