android: Async setupConnection binder call

content/public/android/java/src/org/chromium/content/app/ChildProcessServiceImpl.java

Index: content/public/android/java/src/org/chromium/content/app/ChildProcessServiceImpl.java
diff --git a/content/public/android/java/src/org/chromium/content/app/ChildProcessServiceImpl.java b/content/public/android/java/src/org/chromium/content/app/ChildProcessServiceImpl.java
index e74e97f00e19285c5acc92d0db208924c1010b2f..7a8f92c04e3c28a529dd049f4bfbeb67e420d1a3 100644
--- a/content/public/android/java/src/org/chromium/content/app/ChildProcessServiceImpl.java
+++ b/content/public/android/java/src/org/chromium/content/app/ChildProcessServiceImpl.java
@@ -32,6 +32,7 @@ import org.chromium.base.library_loader.Linker;
 import org.chromium.base.library_loader.ProcessInitException;
 import org.chromium.base.process_launcher.ChildProcessCreationParams;
 import org.chromium.base.process_launcher.FileDescriptorInfo;
+import org.chromium.base.process_launcher.ICallbackInt;
 import org.chromium.base.process_launcher.IChildProcessService;
 import org.chromium.content.browser.ChildProcessConstants;
 import org.chromium.content.common.ContentSwitches;
@@ -126,23 +127,20 @@ public class ChildProcessServiceImpl {
         }
 
         @Override
-        public int setupConnection(Bundle args, IBinder callback) {
-            int callingPid = Binder.getCallingPid();
+        public void setupConnection(Bundle args, ICallbackInt pidCallback, IBinder gpuCallback)
+                throws RemoteException {
             synchronized (mBinderLock) {
-                if (mBindToCallerCheck && mBoundCallingPid != callingPid) {
-                    if (mBoundCallingPid == 0) {
-                        Log.e(TAG, "Service has not been bound with bindToCaller()");
-                    } else {
-                        Log.e(TAG, "Client pid %d does not match the bound pid %d", callingPid,

[Robert Sesek, 2017/04/10 16:17:58]

This is removing the bindToCaller check?

[boliu, 2017/04/10 16:23:05]

Yeah I put this in the description. getCallingPid returns 0 for a oneway call.
And this appears to be undocumented behavior, yay android.

So can have browser pass its pid her, or just don't check it, since it's not
strictly necessary. If bindToCaller fails first, browser should not call
setupConnection.

[Robert Sesek, 2017/04/10 16:42:44]

Ah, sorry, yes missed that. It seems that the kernel driver indeed doesn't put
the "from" task into the transaction data for ONE_WAY, but the calling EUID does
get put. (Probably because there's no guarantee that the calling PID doesn't go
away during the async transaction?)

Agree it should be fine to drop this, then.

-                                mBoundCallingPid);
-                    }
-                    return -1;
+                if (mBindToCallerCheck && mBoundCallingPid == 0) {
+                    Log.e(TAG, "Service has not been bound with bindToCaller()");
+                    pidCallback.call(-1);
+                    return;
                 }
             }
 
-            mGpuCallback = callback != null ? IGpuProcessCallback.Stub.asInterface(callback) : null;
+            pidCallback.call(Process.myPid());
+            mGpuCallback =
+                    gpuCallback != null ? IGpuProcessCallback.Stub.asInterface(gpuCallback) : null;
             getServiceInfo(args);
-            return Process.myPid();
         }
 
         @Override