Tracking push events for lucid sleep

extensions/browser/extension_host.cc

Index: extensions/browser/extension_host.cc
diff --git a/extensions/browser/extension_host.cc b/extensions/browser/extension_host.cc
index e4bc35e0b64edbd8c6723e991b56a9b30c198797..a2c2f170bb18e6dca24ade412ce9a0c7c5a6b249 100644
--- a/extensions/browser/extension_host.cc
+++ b/extensions/browser/extension_host.cc
@@ -29,6 +29,7 @@
 #include "extensions/browser/event_router.h"
 #include "extensions/browser/extension_error.h"
 #include "extensions/browser/extension_host_delegate.h"
+#include "extensions/browser/extension_host_observer.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/extensions_browser_client.h"
 #include "extensions/browser/notification_types.h"
@@ -159,6 +160,8 @@ ExtensionHost::~ExtensionHost() {
       extensions::NOTIFICATION_EXTENSION_HOST_DESTROYED,
       content::Source<BrowserContext>(browser_context_),
       content::Details<ExtensionHost>(this));
+  FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                    OnExtensionHostDestroyed(this));
   ProcessCreationQueue::GetInstance()->Remove(this);
 }
 
@@ -205,6 +208,31 @@ void ExtensionHost::CreateRenderViewNow() {
   }
 }
 
+void ExtensionHost::AddObserver(ExtensionHostObserver* observer) {
+  observer_list_.AddObserver(observer);
+}
+
+void ExtensionHost::RemoveObserver(ExtensionHostObserver* observer) {
+  observer_list_.RemoveObserver(observer);
+}
+
+void ExtensionHost::OnMessageDispatched(const std::string& event_name,
+                                        int message_id) {
+  unacked_messages_.insert(message_id);

[not at google - send to devlin, 2015/02/26 23:24:32]

This method is called on the IO thread, but below unacked_messages_ is accessed
on the UI thread (I believe that WebContentsObserver dispatches its IPC on the
UI thread).

[Chirantan Ekbote, 2015/02/26 23:38:57]

This method is called by NotifyEventDispatched in event_router.cc.  The first
thing that function does is make sure it is running on the UI thread.

[not at google - send to devlin, 2015/02/26 23:52:33]

Ah, you're right. NotifyEventDispatched tricked me.

In that case, in crazy-land (but perhaps this power-on case is crazy land) this
is racy: it's possible for the message to be sent and acked all on the IO
thread, meaning this code may never get hit, and hence the message ID not being
found.

[Chirantan Ekbote, 2015/02/27 00:15:00]

I don't understand this.  Both this function and ExtensionHost::OnEventAck have
to be called on the UI thread because the ExtensionHost object lives on the UI
thread.  How can the message be sent and acked all on the IO thread?

[not at google - send to devlin, 2015/02/27 01:00:50]

Yep you're right, sorry.

+  FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                    OnExtensionMessageDispatched(this, event_name, message_id));
+}
+
+void ExtensionHost::OnNetworkRequestStarted(uint64 request_id) {
+  FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                    OnNetworkRequestStarted(this, request_id));
+}
+
+void ExtensionHost::OnNetworkRequestDone(uint64 request_id) {
+  FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                    OnNetworkRequestDone(this, request_id));
+}
+
 const GURL& ExtensionHost::GetURL() const {
   return host_contents()->GetURL();
 }
@@ -353,10 +381,20 @@ void ExtensionHost::OnRequest(const ExtensionHostMsg_Request_Params& params) {
   extension_function_dispatcher_.Dispatch(params, render_view_host());
 }
 
-void ExtensionHost::OnEventAck() {
+void ExtensionHost::OnEventAck(int message_id) {
   EventRouter* router = EventRouter::Get(browser_context_);
   if (router)
     router->OnEventAck(browser_context_, extension_id());
+
+  // A compromised renderer could start sending out arbitrary message ids, which
+  // may affect other renderers by causing downstream methods to think that
+  // messages for other extensions have been acked.  Make sure that the message
+  // id sent by the renderer is one that this ExtensionHost expects to receive.
+  // This way if a renderer _is_ compromised, it can really only affect itself.
+  if (unacked_messages_.erase(message_id) > 0) {
+    FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                      OnExtensionMessageAcked(this, message_id));
+  }

[jln (very slow on Chromium), 2015/01/28 01:18:27]

We should kill the renderer in the else {} clause here.

Could you please call BadMessageReceived()?
(content/public/browser/browser_message_filter.h)

[Chirantan Ekbote, 2015/01/28 22:11:52]

Done.

 }
 
 void ExtensionHost::OnIncrementLazyKeepaliveCount() {