Index: ppapi/shared_impl/resource_tracker.cc |
diff --git a/ppapi/shared_impl/resource_tracker.cc b/ppapi/shared_impl/resource_tracker.cc |
index 70968125ab865b0d3819f06fbef1d887dc75d45c..6762aea6d61836215a43686d402d08aff496e6f0 100644 |
--- a/ppapi/shared_impl/resource_tracker.cc |
+++ b/ppapi/shared_impl/resource_tracker.cc |
@@ -56,7 +56,7 @@ void ResourceTracker::ReleaseResource(PP_Resource res) { |
i->second.second--; |
if (i->second.second == 0) { |
- i->second.first->LastPluginRefWasDeleted(); |
+ LastPluginRefWasDeleted(i->second.first); |
// When we go from 1 to 0 plugin ref count, free the additional "real" ref |
// on its behalf. THIS WILL MOST LIKELY RELEASE THE OBJECT AND REMOVE IT |
@@ -100,7 +100,7 @@ void ResourceTracker::DidDeleteInstance(PP_Instance instance) { |
if (found_resource != live_resources_.end()) { |
Resource* resource = found_resource->second.first; |
if (found_resource->second.second > 0) { |
- resource->LastPluginRefWasDeleted(); |
+ LastPluginRefWasDeleted(resource); |
found_resource->second.second = 0; |
// This will most likely delete the resource object and remove it |
@@ -142,10 +142,16 @@ PP_Resource ResourceTracker::AddResource(Resource* object) { |
// If you hit this somebody forgot to call DidCreateInstance or the resource |
// was created with an invalid PP_Instance. |
- DCHECK(instance_map_.find(object->pp_instance()) != instance_map_.end()); |
+ // |
+ // This is specifically a check even in release mode. When creating resources |
+ // it can be easy to forget to validate the instance parameter. If somebody |
+ // does forget, we don't want to introduce a vulnerability with invalid |
+ // pointers floating around, so we die ASAP. |
+ InstanceMap::iterator found = instance_map_.find(object->pp_instance()); |
+ CHECK(found != instance_map_.end()); |
PP_Resource new_id = MakeTypedId(++last_resource_value_, PP_ID_TYPE_RESOURCE); |
- instance_map_[object->pp_instance()]->resources.insert(new_id); |
+ found->second->resources.insert(new_id); |
live_resources_[new_id] = ResourceAndRefCount(object, 0); |
return new_id; |
@@ -158,4 +164,8 @@ void ResourceTracker::RemoveResource(Resource* object) { |
live_resources_.erase(pp_resource); |
} |
+void ResourceTracker::LastPluginRefWasDeleted(Resource* object) { |
+ object->LastPluginRefWasDeleted(); |
+} |
+ |
} // namespace ppapi |