Pepper: Make pending_sync_msgs_ local to IO thread.

components/nacl/loader/nacl_ipc_adapter.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/nacl/loader/nacl_ipc_adapter.h"
 
 #include <limits.h>
 #include <string.h>
 
 #include "base/basictypes.h"
@@ skipping 446 matching lines @@
   return MakeNaClDescCustom(this);
 }
 
 #if defined(OS_POSIX)
 int NaClIPCAdapter::TakeClientFileDescriptor() {
   return io_thread_data_.channel_->TakeClientFileDescriptor();
 }
 #endif
 
 bool NaClIPCAdapter::OnMessageReceived(const IPC::Message& msg) {
+  uint32_t type = msg.type();
+  if (type == IPC_REPLY_ID) {
+    int id = IPC::SyncMessage::GetMessageId(msg);
+    IOThreadData::PendingSyncMsgMap::iterator it =
+        io_thread_data_.pending_sync_msgs_.find(id);
+    DCHECK(it != io_thread_data_.pending_sync_msgs_.end());
+    if (it != io_thread_data_.pending_sync_msgs_.end()) {
+      type = it->second;
+      io_thread_data_.pending_sync_msgs_.erase(it);
+    }
+  }
+
   {
     base::AutoLock lock(lock_);
-
     scoped_refptr<RewrittenMessage> rewritten_msg(new RewrittenMessage);
 
     typedef std::vector<ppapi::proxy::SerializedHandle> Handles;
     Handles handles;
     scoped_ptr<IPC::Message> new_msg;
-    if (!locked_data_.nacl_msg_scanner_.ScanMessage(msg, &handles, &new_msg))
+
+    if (!locked_data_.nacl_msg_scanner_.ScanMessage(
+            msg, type, &handles, &new_msg))
       return false;
 
     // Now add any descriptors we found to rewritten_msg. |handles| is usually
     // empty, unless we read a message containing a FD or handle.
     for (Handles::const_iterator iter = handles.begin();
          iter != handles.end();
          ++iter) {
       scoped_ptr<NaClDescWrapper> nacl_desc;
       switch (iter->type()) {
         case ppapi::proxy::SerializedHandle::SHARED_MEMORY: {
@@ skipping 153 matching lines @@
 void NaClIPCAdapter::ConnectChannelOnIOThread() {
   if (!io_thread_data_.channel_->Connect())
     NOTREACHED();
 }
 
 void NaClIPCAdapter::CloseChannelOnIOThread() {
   io_thread_data_.channel_->Close();
 }
 
 void NaClIPCAdapter::SendMessageOnIOThread(scoped_ptr<IPC::Message> message) {
+  int id = IPC::SyncMessage::GetMessageId(*message.get());
+  DCHECK(io_thread_data_.pending_sync_msgs_.find(id) ==
+         io_thread_data_.pending_sync_msgs_.end());
+
+  io_thread_data_.pending_sync_msgs_[id] = message->type();

[dmichael (off chromium), 2014/08/18 20:06:09]

It kind of looks like you are adding the id to the map even for messages that
are async? If that's the case, the map is growing unbounded with each async
message.

   io_thread_data_.channel_->Send(message.release());
 }
 
 void NaClIPCAdapter::SaveMessage(const IPC::Message& msg,
                                  RewrittenMessage* rewritten_msg) {
   lock_.AssertAcquired();
   // There is some padding in this structure (the "padding" member is 16
   // bits but this then gets padded to 32 bits). We want to be sure not to
   // leak data to the untrusted plugin, so zero everything out first.
   NaClMessageHeader header;
   memset(&header, 0, sizeof(NaClMessageHeader));
 
   header.payload_size = static_cast<uint32>(msg.payload_size());
   header.routing = msg.routing_id();
   header.type = msg.type();
   header.flags = msg.flags();
   header.num_fds = static_cast<int>(rewritten_msg->desc_count());
 
   rewritten_msg->SetData(header, msg.payload(), msg.payload_size());
   locked_data_.to_be_received_.push(rewritten_msg);
 }
 
 int TranslatePepperFileReadWriteOpenFlagsForTesting(int32_t pp_open_flags) {
   return TranslatePepperFileReadWriteOpenFlags(pp_open_flags);
 }