Mojo EDK: Add safe process connection API

content/browser/child_process_launcher.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_launcher.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
 #include "base/i18n/icu_util.h"
 #include "base/logging.h"
 #include "base/process/launch.h"
 #include "build/build_config.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/sandboxed_process_launcher_delegate.h"
 
 namespace content {
 
 using internal::ChildProcessLauncherHelper;
 
 ChildProcessLauncher::ChildProcessLauncher(
     std::unique_ptr<SandboxedProcessLauncherDelegate> delegate,
     std::unique_ptr<base::CommandLine> command_line,
     int child_process_id,
     Client* client,
-    const std::string& mojo_child_token,
+    std::unique_ptr<mojo::edk::PendingProcessConnection> pending_connection,
     const mojo::edk::ProcessErrorCallback& process_error_callback,
     bool terminate_on_shutdown)
     : client_(client),
       termination_status_(base::TERMINATION_STATUS_NORMAL_TERMINATION),
       exit_code_(RESULT_CODE_NORMAL_EXIT),
       starting_(true),
+      pending_connection_(std::move(pending_connection)),
       process_error_callback_(process_error_callback),
 #if defined(ADDRESS_SANITIZER) || defined(LEAK_SANITIZER) ||  \
     defined(MEMORY_SANITIZER) || defined(THREAD_SANITIZER) || \
     defined(UNDEFINED_SANITIZER)
       terminate_child_on_shutdown_(false),
 #else
       terminate_child_on_shutdown_(terminate_on_shutdown),
 #endif
-      mojo_child_token_(mojo_child_token),
       weak_factory_(this) {
   DCHECK(CalledOnValidThread());
   CHECK(BrowserThread::GetCurrentThreadIdentifier(&client_thread_id_));
 
   helper_ = new ChildProcessLauncherHelper(
                 child_process_id, client_thread_id_,
               std::move(command_line), std::move(delegate),
                        weak_factory_.GetWeakPtr(), terminate_on_shutdown);
   helper_->StartLaunchOnClientThread();
 }
@@ skipping 21 matching lines @@
 void ChildProcessLauncher::Notify(
     ChildProcessLauncherHelper::Process process,
     mojo::edk::ScopedPlatformHandle server_handle,
     int error_code) {
   DCHECK(CalledOnValidThread());
   starting_ = false;
   process_ = std::move(process);
 
   if (process_.process.IsValid()) {
     // Set up Mojo IPC to the new process.
-    mojo::edk::ChildProcessLaunched(process_.process.Handle(),
-                                    std::move(server_handle),
-                                    mojo_child_token_,
-                                    process_error_callback_);
+    DCHECK(pending_connection_);
+    pending_connection_->Connect(process_.process.Handle(),
+                                 std::move(server_handle),
+                                 process_error_callback_);
     client_->OnProcessLaunched();
   } else {
-    mojo::edk::ChildProcessLaunchFailed(mojo_child_token_);
+    pending_connection_.reset();

[Sam McNally, 2017/02/09 05:38:47]

Can we clear this unconditionally?

[Ken Rockot(use gerrit already), 2017/02/09 06:01:58]

Sure, done

     termination_status_ = base::TERMINATION_STATUS_LAUNCH_FAILED;
     client_->OnProcessLaunchFailed(error_code);
   }
 }
 
 bool ChildProcessLauncher::IsStarting() {
   // TODO(crbug.com/469248): This fails in some tests.
   // DCHECK(CalledOnValidThread());
   return starting_;
 }
@@ skipping 46 matching lines @@
 }
 
 ChildProcessLauncher::Client* ChildProcessLauncher::ReplaceClientForTest(
     Client* client) {
   Client* ret = client_;
   client_ = client;
   return ret;
 }
 
 }  // namespace content