Blobs: Catching browser-process created Blobs in extension code.

chrome/browser/extensions/blob_holder.cc

Index: chrome/browser/extensions/blob_holder.cc
diff --git a/chrome/browser/extensions/blob_holder.cc b/chrome/browser/extensions/blob_holder.cc
new file mode 100644
index 0000000000000000000000000000000000000000..fd8cfbbe8eb282ebab4064e943aac67d96aca638
--- /dev/null
+++ b/chrome/browser/extensions/blob_holder.cc
@@ -0,0 +1,70 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/extensions/blob_holder.h"
+
+#include "base/logging.h"
+#include "content/public/browser/blob_handle.h"
+#include "extensions/common/extension_messages.h"
+
+DEFINE_WEB_CONTENTS_USER_DATA_KEY(extensions::BlobHolder);
+
+namespace extensions {
+
+struct BlobHolder::BlobHolderData {
+  // Takes ownership of |blob_handle|.
+  BlobHolderData(content::RenderViewHost* render_view_host,
+                 content::BlobHandle* blob_handle)
+      : render_view_host(render_view_host),
+        blob_handle(blob_handle) {
+  }
+
+  content::RenderViewHost* render_view_host;
+  scoped_ptr<content::BlobHandle> blob_handle;
+};
+
+BlobHolder::~BlobHolder() {
+}
+
+void BlobHolder::HoldBlobReference(content::RenderViewHost* render_view_host,
+                                   scoped_ptr<content::BlobHandle> blob) {
+  held_blobs_.push_back(new BlobHolderData(render_view_host, blob.release()));

[Tom Sepez, 2014/05/19 23:41:37]

How do we ensure the UUID isn't duplicated?

[tommycli, 2014/05/20 00:04:11]

Currently we don't. We just assumed that they're unique. Do you think we should
iterate through our existing held UUIDs here with a function within a DCHECK?

[tommycli, 2014/05/20 18:22:42]

Done.

+}
+
+BlobHolder::BlobHolder(content::WebContents* web_contents)
+    : content::WebContentsObserver(web_contents) {
+}
+
+void BlobHolder::RenderViewDeleted(content::RenderViewHost* render_view_host) {
+  for (ScopedVector<BlobHolderData>::iterator it = held_blobs_.begin();
+         it != held_blobs_.end(); ++it) {
+    if ((*it)->render_view_host == render_view_host)
+      it = held_blobs_.erase(it);
+  }
+}
+
+bool BlobHolder::OnMessageReceived(const IPC::Message& message) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(BlobHolder, message)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_BlobOwnershipTaken,
+                        OnBlobOwnershipTaken)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
+}
+
+void BlobHolder::OnBlobOwnershipTaken(const std::string& uuid) {
+  for (ScopedVector<BlobHolderData>::iterator it = held_blobs_.begin();
+       it != held_blobs_.end(); ++it) {
+    if ((*it)->blob_handle->GetUUID() == uuid) {
+      it = held_blobs_.erase(it);
+      return;
+    }
+  }
+
+  DLOG(ERROR) << "Tried to release a Blob we don't have ownership to. UUID: "

[Tom Sepez, 2014/05/19 23:41:37]

probably want to kill the renderer here via BadMessageReceived().

[tommycli, 2014/05/20 00:04:11]

Since this isn't a BrowserMessageFilter, I don't have access to that method.

I could do a web_contents()->Close() or a
web_contents()->GetRenderViewHost()->ClosePage(). Do either of those make sense?

[tommycli, 2014/05/20 18:22:42]

Done.

+      << uuid;
+}
+
+}  // namespace extensions