| Index: ppapi/shared_impl/resource_tracker.cc
|
| diff --git a/ppapi/shared_impl/resource_tracker.cc b/ppapi/shared_impl/resource_tracker.cc
|
| index 70968125ab865b0d3819f06fbef1d887dc75d45c..6762aea6d61836215a43686d402d08aff496e6f0 100644
|
| --- a/ppapi/shared_impl/resource_tracker.cc
|
| +++ b/ppapi/shared_impl/resource_tracker.cc
|
| @@ -56,7 +56,7 @@ void ResourceTracker::ReleaseResource(PP_Resource res) {
|
|
|
| i->second.second--;
|
| if (i->second.second == 0) {
|
| - i->second.first->LastPluginRefWasDeleted();
|
| + LastPluginRefWasDeleted(i->second.first);
|
|
|
| // When we go from 1 to 0 plugin ref count, free the additional "real" ref
|
| // on its behalf. THIS WILL MOST LIKELY RELEASE THE OBJECT AND REMOVE IT
|
| @@ -100,7 +100,7 @@ void ResourceTracker::DidDeleteInstance(PP_Instance instance) {
|
| if (found_resource != live_resources_.end()) {
|
| Resource* resource = found_resource->second.first;
|
| if (found_resource->second.second > 0) {
|
| - resource->LastPluginRefWasDeleted();
|
| + LastPluginRefWasDeleted(resource);
|
| found_resource->second.second = 0;
|
|
|
| // This will most likely delete the resource object and remove it
|
| @@ -142,10 +142,16 @@ PP_Resource ResourceTracker::AddResource(Resource* object) {
|
|
|
| // If you hit this somebody forgot to call DidCreateInstance or the resource
|
| // was created with an invalid PP_Instance.
|
| - DCHECK(instance_map_.find(object->pp_instance()) != instance_map_.end());
|
| + //
|
| + // This is specifically a check even in release mode. When creating resources
|
| + // it can be easy to forget to validate the instance parameter. If somebody
|
| + // does forget, we don't want to introduce a vulnerability with invalid
|
| + // pointers floating around, so we die ASAP.
|
| + InstanceMap::iterator found = instance_map_.find(object->pp_instance());
|
| + CHECK(found != instance_map_.end());
|
|
|
| PP_Resource new_id = MakeTypedId(++last_resource_value_, PP_ID_TYPE_RESOURCE);
|
| - instance_map_[object->pp_instance()]->resources.insert(new_id);
|
| + found->second->resources.insert(new_id);
|
|
|
| live_resources_[new_id] = ResourceAndRefCount(object, 0);
|
| return new_id;
|
| @@ -158,4 +164,8 @@ void ResourceTracker::RemoveResource(Resource* object) {
|
| live_resources_.erase(pp_resource);
|
| }
|
|
|
| +void ResourceTracker::LastPluginRefWasDeleted(Resource* object) {
|
| + object->LastPluginRefWasDeleted();
|
| +}
|
| +
|
| } // namespace ppapi
|
|
|