Blobs: Catching browser-process created Blobs in extension code.

chrome/browser/extensions/blob_holder.cc

Index: chrome/browser/extensions/blob_holder.cc
diff --git a/chrome/browser/extensions/blob_holder.cc b/chrome/browser/extensions/blob_holder.cc
new file mode 100644
index 0000000000000000000000000000000000000000..b64c65c1e862210e707fc4ce20057a47c7ef0ca6
--- /dev/null
+++ b/chrome/browser/extensions/blob_holder.cc
@@ -0,0 +1,83 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/extensions/blob_holder.h"
+
+#include "base/logging.h"
+#include "content/public/browser/blob_handle.h"
+#include "content/public/browser/render_process_host.h"
+#include "extensions/common/extension_messages.h"
+
+DEFINE_WEB_CONTENTS_USER_DATA_KEY(extensions::BlobHolder);
+
+namespace extensions {
+
+struct BlobHolder::BlobHolderData {
+  // Takes ownership of |blob_handle|.
+  BlobHolderData(content::RenderViewHost* render_view_host,
+                 content::BlobHandle* blob_handle)
+      : render_view_host(render_view_host),
+        blob_handle(blob_handle) {
+  }
+
+  content::RenderViewHost* render_view_host;
+  scoped_ptr<content::BlobHandle> blob_handle;
+};
+
+BlobHolder::~BlobHolder() {
+}
+
+void BlobHolder::HoldBlobReference(content::RenderViewHost* render_view_host,
+                                   scoped_ptr<content::BlobHandle> blob) {
+  DCHECK(!ContainsUUID(blob->GetUUID()));

[michaeln, 2014/05/20 19:08:19]

wait, this isn't correct. there can be multiple handles referring to the same
blob, those will have the same uuid. dups here are not indicative of an error.

You should never see the same BlobHandle* here.

[tommycli, 2014/05/20 19:49:06]

Done.

+  held_blobs_.push_back(new BlobHolderData(render_view_host, blob.release()));
+}
+
+BlobHolder::BlobHolder(content::WebContents* web_contents)
+    : content::WebContentsObserver(web_contents) {
+}
+
+bool BlobHolder::ContainsUUID(const std::string& uuid) const {
+  for (ScopedVector<BlobHolderData>::const_iterator it = held_blobs_.begin();
+         it != held_blobs_.end(); ++it) {
+    if ((*it)->blob_handle->GetUUID() == uuid)
+      return true;
+  }
+
+  return false;
+}
+
+void BlobHolder::RenderViewDeleted(content::RenderViewHost* render_view_host) {
+  for (ScopedVector<BlobHolderData>::iterator it = held_blobs_.begin();
+         it != held_blobs_.end(); ++it) {
+    if ((*it)->render_view_host == render_view_host)
+      it = held_blobs_.erase(it);
+  }
+}
+
+bool BlobHolder::OnMessageReceived(const IPC::Message& message) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(BlobHolder, message)
+    IPC_MESSAGE_HANDLER(ExtensionHostMsg_BlobOwnershipTaken,
+                        OnBlobOwnershipTaken)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+  return handled;
+}
+
+void BlobHolder::OnBlobOwnershipTaken(const std::string& uuid) {
+  for (ScopedVector<BlobHolderData>::iterator it = held_blobs_.begin();
+       it != held_blobs_.end(); ++it) {
+    if ((*it)->blob_handle->GetUUID() == uuid) {
+      it = held_blobs_.erase(it);
+      return;
+    }
+  }
+
+  DLOG(ERROR) << "Tried to release a Blob we don't have ownership to. UUID: "
+      << uuid;
+  web_contents()->GetRenderProcessHost()->ReceivedBadMessage();
+}
+
+}  // namespace extensions