Linux: Catch plugin crashes.

BUG=25964
TEST=none
Review URL: http://codereview.chromium.org/371015

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@31416 0039d316-1c4b-4281-b951-d872f2087c98

12 files changed, 223 insertions, 163 deletions

diff --git a/chrome/app/breakpad_linux.cc b/chrome/app/breakpad_linux.cc
index fe47108..ba9edbf 100644
--- a/chrome/app/breakpad_linux.cc
+++ b/chrome/app/breakpad_linux.cc
@@ -450,8 +450,8 @@ pid_t HandleCrashDump(const BreakpadInfo& info) {
   const pid_t child = sys_fork();
   if (!child) {
     // This code is called both when a browser is crashing (in which case,
-    // nothing really matters any more) and when a renderer crashes, in which
-    // case we need to continue.
+    // nothing really matters any more) and when a renderer/plugin crashes, in
+    // which case we need to continue.
     //
     // Since we are a multithreaded app, if we were just to fork(), we might
     // grab file descriptors which have just been created in another thread and
@@ -608,9 +608,10 @@ namespace child_process_logging {
 extern std::string active_url;
 }
 
+// Currently Non-Browser = Renderer and Plugins
 static bool
-RendererCrashHandler(const void* crash_context, size_t crash_context_size,
-             void* context) {
+NonBrowserCrashHandler(const void* crash_context, size_t crash_context_size,
+                       void* context) {
   const int fd = reinterpret_cast<intptr_t>(context);
   int fds[2];
   socketpair(AF_UNIX, SOCK_STREAM, 0, fds);
@@ -664,13 +665,13 @@ RendererCrashHandler(const void* crash_context, size_t crash_context_size,
   return true;
 }
 
-void EnableRendererCrashDumping() {
+void EnableNonBrowserCrashDumping() {
   const int fd = Singleton<base::GlobalDescriptors>()->Get(kCrashDumpSignal);
   // We deliberately leak this object.
   google_breakpad::ExceptionHandler* handler =
       new google_breakpad::ExceptionHandler("" /* unused */, NULL, NULL,
                                             (void*) fd, true);
-  handler->set_crash_handler(RendererCrashHandler);
+  handler->set_crash_handler(NonBrowserCrashHandler);
 }
 
 void InitCrashReporter() {
@@ -684,10 +685,13 @@ void InitCrashReporter() {
       return;
     EnableCrashDumping(unattended);
   } else if (process_type == switches::kRendererProcess ||
+             process_type == switches::kPluginProcess ||
              process_type == switches::kZygoteProcess) {
     // We might be chrooted in a zygote or renderer process so we cannot call
     // GetCollectStatsConsent because that needs access the the user's home
     // dir. Instead, we set a command line flag for these processes.
+    // Even though plugins are not chrooted, we share the same code path for
+    // simplicity.
     if (!parsed_command_line.HasSwitch(switches::kEnableCrashReporter))
       return;
     // Get the guid and linux distro from the command line switch.
@@ -700,7 +704,7 @@ void InitCrashReporter() {
     } else {
       google_update::posix_guid = switch_value;
     }
-    EnableRendererCrashDumping();
+    EnableNonBrowserCrashDumping();
   }
 
   // Set the base process uptime value.
diff --git a/chrome/browser/renderer_host/render_crash_handler_host_linux.cc b/chrome/browser/crash_handler_host_linux.cc
index 5a8ff89..d8d0da4 100644
--- a/chrome/browser/renderer_host/render_crash_handler_host_linux.cc
+++ b/chrome/browser/crash_handler_host_linux.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/renderer_host/render_crash_handler_host_linux.h"
+#include "chrome/browser/crash_handler_host_linux.h"
 
 #include <stdint.h>
 #include <stdlib.h>
@@ -10,9 +10,6 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-#include <string>
-#include <vector>
-
 #include "base/eintr_wrapper.h"
 #include "base/file_path.h"
 #include "base/format_macros.h"
@@ -29,21 +26,21 @@
 #include "chrome/browser/chrome_thread.h"
 #include "chrome/common/chrome_paths.h"
 
-// Since RenderCrashHandlerHostLinux is a singleton, it's only destroyed at the
-// end of the processes lifetime, which is greater in span then the lifetime of
-// the IO message loop.
-template<> struct RunnableMethodTraits<RenderCrashHandlerHostLinux> {
-  void RetainCallee(RenderCrashHandlerHostLinux*) { }
-  void ReleaseCallee(RenderCrashHandlerHostLinux*) { }
+// Since classes derived from CrashHandlerHostLinux are singletons, it's only
+// destroyed at the end of the processes lifetime, which is greater in span than
+// the lifetime of the IO message loop.
+template<> struct RunnableMethodTraits<CrashHandlerHostLinux> {
+  void RetainCallee(CrashHandlerHostLinux*) { }
+  void ReleaseCallee(CrashHandlerHostLinux*) { }
 };
 
-RenderCrashHandlerHostLinux::RenderCrashHandlerHostLinux()
-    : renderer_socket_(-1),
+CrashHandlerHostLinux::CrashHandlerHostLinux()
+    : process_socket_(-1),
       browser_socket_(-1) {
   int fds[2];
-  // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the renderer from
+  // We use SOCK_SEQPACKET rather than SOCK_DGRAM to prevent the process from
   // sending datagrams to other sockets on the system. The sandbox may prevent
-  // the renderer from calling socket() to create new sockets, but it'll still
+  // the process from calling socket() to create new sockets, but it'll still
   // inherit some sockets. With PF_UNIX+SOCK_DGRAM, it can call sendmsg to send
   // a datagram to any (abstract) socket on the same system. With
   // SOCK_SEQPACKET, this is prevented.
@@ -53,20 +50,20 @@ RenderCrashHandlerHostLinux::RenderCrashHandlerHostLinux()
   // Enable passcred on the server end of the socket
   CHECK(setsockopt(fds[1], SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)) == 0);
 
-  renderer_socket_ = fds[0];
+  process_socket_ = fds[0];
   browser_socket_ = fds[1];
 
   ChromeThread::PostTask(
       ChromeThread::IO, FROM_HERE,
-      NewRunnableMethod(this, &RenderCrashHandlerHostLinux::Init));
+      NewRunnableMethod(this, &CrashHandlerHostLinux::Init));
 }
 
-RenderCrashHandlerHostLinux::~RenderCrashHandlerHostLinux() {
-  HANDLE_EINTR(close(renderer_socket_));
+CrashHandlerHostLinux::~CrashHandlerHostLinux() {
+  HANDLE_EINTR(close(process_socket_));
   HANDLE_EINTR(close(browser_socket_));
 }
 
-void RenderCrashHandlerHostLinux::Init() {
+void CrashHandlerHostLinux::Init() {
   MessageLoopForIO* ml = MessageLoopForIO::current();
   CHECK(ml->WatchFileDescriptor(
       browser_socket_, true /* persistent */,
@@ -75,14 +72,14 @@ void RenderCrashHandlerHostLinux::Init() {
   ml->AddDestructionObserver(this);
 }
 
-void RenderCrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
+void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
   DCHECK(false);
 }
 
-void RenderCrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
+void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
   DCHECK_EQ(fd, browser_socket_);
 
-  // A renderer process has crashed and has signaled us by writing a datagram
+  // A process has crashed and has signaled us by writing a datagram
   // to the death signal socket. The datagram contains the crash context needed
   // for writing the minidump as well as a file descriptor and a credentials
   // block so that they can't lie about their pid.
@@ -150,7 +147,7 @@ void RenderCrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
       DCHECK_EQ(len % sizeof(int), 0u);
       const unsigned num_fds = len / sizeof(int);
       if (num_fds > 1 || num_fds == 0) {
-        // A nasty renderer could try and send us too many descriptors and
+        // A nasty process could try and send us too many descriptors and
         // force a leak.
         LOG(ERROR) << "Death signal contained too many descriptors;"
                    << " num_fds:" << num_fds;
@@ -203,8 +200,8 @@ void RenderCrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
   }
   const uint64 rand = base::RandUint64();
   const std::string minidump_filename =
-      StringPrintf("%s/chromium-renderer-minidump-%016" PRIx64 ".dmp",
-                   dumps_path.value().c_str(), rand);
+      StringPrintf("%s/chromium-%s-minidump-%016" PRIx64 ".dmp",
+                   dumps_path.value().c_str(), process_type_.c_str(), rand);
   if (!google_breakpad::WriteMinidump(minidump_filename.c_str(),
                                       crashing_pid, crash_context,
                                       kCrashContextSize)) {
@@ -212,7 +209,7 @@ void RenderCrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
     HANDLE_EINTR(close(signal_fd));
   }
 
-  // Send the done signal to the renderer: it can exit now.
+  // Send the done signal to the process: it can exit now.
   memset(&msg, 0, sizeof(msg));
   struct iovec done_iov;
   done_iov.iov_base = const_cast<char*>("\x42");
@@ -228,8 +225,8 @@ void RenderCrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
 
   BreakpadInfo info;
   info.filename = minidump_filename.c_str();
-  info.process_type = "renderer";
-  info.process_type_length = 8;
+  info.process_type = process_type_.c_str();
+  info.process_type_length = process_type_.length();
   info.crash_url = crash_url;
   info.crash_url_length = strlen(crash_url);
   info.guid = guid;
@@ -240,6 +237,6 @@ void RenderCrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
   HandleCrashDump(info);
 }
 
-void RenderCrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
+void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
   file_descriptor_watcher_.StopWatchingFileDescriptor();
 }
diff --git a/chrome/browser/crash_handler_host_linux.h b/chrome/browser/crash_handler_host_linux.h
new file mode 100644
index 0000000..3f1ea2e
--- /dev/null
+++ b/chrome/browser/crash_handler_host_linux.h
@@ -0,0 +1,87 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CRASH_HANDLER_HOST_LINUX_H_
+#define CHROME_BROWSER_CRASH_HANDLER_HOST_LINUX_H_
+
+#include <string>
+
+#include "base/singleton.h"
+#include "base/message_loop.h"
+
+// This is the base class for singleton objects which crash dump renderers and
+// plugins on Linux. We perform the crash dump from the browser because it
+// allows us to be outside the sandbox.
+//
+// PluginCrashHandlerHostLinux and RendererCrashHandlerHostLinux are singletons
+// that handle plugin and renderer crashes, respectively.
+//
+// Processes signal that they need to be dumped by sending a datagram over a
+// UNIX domain socket. All processes of the same type share the client end of
+// this socket which is installed in their descriptor table before exec.
+class CrashHandlerHostLinux : public MessageLoopForIO::Watcher,
+                              public MessageLoop::DestructionObserver {
+ public:
+  // Get the file descriptor which processes should be given in order to signal
+  // crashes to the browser.
+  int GetDeathSignalSocket() const {
+    return process_socket_;
+  }
+
+  // MessagePumbLibevent::Watcher impl:
+  virtual void OnFileCanWriteWithoutBlocking(int fd);
+  virtual void OnFileCanReadWithoutBlocking(int fd);
+
+  // MessageLoop::DestructionObserver impl:
+  virtual void WillDestroyCurrentMessageLoop();
+
+ protected:
+  CrashHandlerHostLinux();
+  ~CrashHandlerHostLinux();
+  // This is here on purpose to make CrashHandlerHostLinux abstract.
+  virtual void SetProcessType() = 0;
+
+  std::string process_type_;
+
+ private:
+  void Init();
+
+  int process_socket_;
+  int browser_socket_;
+  MessageLoopForIO::FileDescriptorWatcher file_descriptor_watcher_;
+
+  DISALLOW_COPY_AND_ASSIGN(CrashHandlerHostLinux);
+};
+
+class PluginCrashHandlerHostLinux : public CrashHandlerHostLinux {
+ private:
+  friend struct DefaultSingletonTraits<PluginCrashHandlerHostLinux>;
+  PluginCrashHandlerHostLinux() {
+    SetProcessType();
+  }
+  ~PluginCrashHandlerHostLinux() {}
+
+  virtual void SetProcessType() {
+    process_type_ = "plugin";
+  }
+
+  DISALLOW_COPY_AND_ASSIGN(PluginCrashHandlerHostLinux);
+};
+
+class RendererCrashHandlerHostLinux : public CrashHandlerHostLinux {
+ private:
+  friend struct DefaultSingletonTraits<RendererCrashHandlerHostLinux>;
+  RendererCrashHandlerHostLinux() {
+    SetProcessType();
+  }
+  ~RendererCrashHandlerHostLinux() {}
+
+  virtual void SetProcessType() {
+    process_type_ = "renderer";
+  }
+
+  DISALLOW_COPY_AND_ASSIGN(RendererCrashHandlerHostLinux);
+};
+
+#endif  // CHROME_BROWSER_CRASH_HANDLER_HOST_LINUX_H_
diff --git a/chrome/browser/crash_handler_host_linux_stub.cc b/chrome/browser/crash_handler_host_linux_stub.cc
new file mode 100644
index 0000000..e95f679
--- /dev/null
+++ b/chrome/browser/crash_handler_host_linux_stub.cc
@@ -0,0 +1,25 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This is a stub file which is compiled in when we are building without
+// breakpad support.
+
+#include "chrome/browser/crash_handler_host_linux.h"
+
+CrashHandlerHostLinux::CrashHandlerHostLinux()
+    : process_socket_(-1),
+      browser_socket_(-1) {
+}
+
+CrashHandlerHostLinux::~CrashHandlerHostLinux() {
+}
+
+void CrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
+}
+
+void CrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
+}
+
+void CrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
+}
diff --git a/chrome/browser/plugin_process_host.cc b/chrome/browser/plugin_process_host.cc
index 681ca2f..4d5cd22 100644
--- a/chrome/browser/plugin_process_host.cc
+++ b/chrome/browser/plugin_process_host.cc
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "build/build_config.h"
-
 #include "chrome/browser/plugin_process_host.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
+#elif defined(OS_POSIX)
+#include <utility>  // for pair<>
 #endif
 
 #include <vector>
@@ -15,22 +15,12 @@
 #include "app/app_switches.h"
 #include "app/gfx/native_widget_types.h"
 #include "base/command_line.h"
-#if defined(OS_POSIX)
-#include "base/global_descriptors_posix.h"
-#endif
 #include "base/file_path.h"
 #include "base/file_util.h"
-#include "base/file_version_info.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/process_util.h"
-#include "base/scoped_ptr.h"
 #include "base/string_util.h"
-#include "base/thread.h"
-#include "chrome/browser/browser.h"
-#include "chrome/browser/browser_list.h"
-#include "chrome/browser/browser_process.h"
-#include "chrome/browser/browser_window.h"
 #include "chrome/browser/child_process_security_policy.h"
 #include "chrome/browser/chrome_plugin_browsing_context.h"
 #include "chrome/browser/chrome_thread.h"
@@ -38,36 +28,36 @@
 #include "chrome/browser/net/url_request_tracking.h"
 #include "chrome/browser/plugin_service.h"
 #include "chrome/browser/profile.h"
-#include "chrome/browser/renderer_host/browser_render_process_host.h"
-#include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
+#include "chrome/common/chrome_descriptors.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_plugin_lib.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/logging_chrome.h"
 #include "chrome/common/plugin_messages.h"
 #include "chrome/common/render_messages.h"
-#include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_descriptors.h"
 #include "ipc/ipc_switches.h"
 #include "net/base/file_stream.h"
 #include "net/base/io_buffer.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
-#include "webkit/glue/plugins/plugin_constants_win.h"
 
 #if defined(OS_WIN)
 #include "app/win_util.h"
 #include "chrome/browser/sandbox_policy.h"
 #include "sandbox/src/sandbox.h"
+#include "webkit/glue/plugins/plugin_constants_win.h"
 #endif
 
 #if defined(OS_POSIX)
+#include "base/global_descriptors_posix.h"
 #include "ipc/ipc_channel_posix.h"
 #endif
 
 #if defined(OS_LINUX)
 #include "app/gfx/gtk_native_view_id_manager.h"
+#include "chrome/browser/crash_handler_host_linux.h"
 #endif
 
 #if defined(OS_MACOSX)
@@ -122,7 +112,7 @@ class PluginDownloadUrlHelper : public URLRequest::Delegate {
   std::string download_url_;
   int download_source_child_unique_id_;
 
-  DISALLOW_EVIL_CONSTRUCTORS(PluginDownloadUrlHelper);
+  DISALLOW_COPY_AND_ASSIGN(PluginDownloadUrlHelper);
 };
 
 PluginDownloadUrlHelper::PluginDownloadUrlHelper(
@@ -433,6 +423,32 @@ bool PluginProcessHost::Init(const WebPluginInfo& info,
 #if defined(OS_WIN)
   process = sandbox::StartProcess(&cmd_line);
 #else
+  process = InitHelperPosix(cmd_line);
+#endif  // OS_WIN
+
+  if (!process)
+    return false;
+  SetHandle(process);
+
+  FilePath gears_path;
+  if (PathService::Get(chrome::FILE_GEARS_PLUGIN, &gears_path)) {
+    FilePath::StringType gears_path_lc = StringToLowerASCII(gears_path.value());
+    FilePath::StringType plugin_path_lc =
+        StringToLowerASCII(info.path.value());
+    if (plugin_path_lc == gears_path_lc) {
+      // Give Gears plugins "background" priority.  See
+      // http://b/issue?id=1280317.
+      SetProcessBackgrounded();
+    }
+  }
+
+  return true;
+}
+
+#if defined(OS_POSIX)
+base::ProcessHandle PluginProcessHost::InitHelperPosix(
+    const CommandLine& cmd_line) {
+  base::ProcessHandle process = 0;
   // This code is duplicated with browser_render_process_host.cc, but
   // there's not a good place to de-duplicate it.
   base::file_handle_mapping_vector fds_to_map;
@@ -454,29 +470,19 @@ bool PluginProcessHost::Init(const WebPluginInfo& info,
   env.push_back(std::pair<const char*, const char*>(
       plugin_interpose_strings::kDYLDInsertLibrariesKey,
       interpose_list.c_str()));
+#elif defined(OS_LINUX)
+  const int crash_signal_fd =
+      Singleton<PluginCrashHandlerHostLinux>()->GetDeathSignalSocket();
+  if (crash_signal_fd >= 0) {
+    fds_to_map.push_back(std::pair<int, uint32_t>(crash_signal_fd,
+                                                  kCrashDumpSignal + 3));
+  }
 #endif  // OS_MACOSX
   if (!base::LaunchApp(cmd_line.argv(), env, fds_to_map, false, &process))
-    return false;
-#endif  // OS_WIN
-
-  if (!process)
-    return false;
-  SetHandle(process);
-
-  FilePath gears_path;
-  if (PathService::Get(chrome::FILE_GEARS_PLUGIN, &gears_path)) {
-    FilePath::StringType gears_path_lc = StringToLowerASCII(gears_path.value());
-    FilePath::StringType plugin_path_lc =
-        StringToLowerASCII(info.path.value());
-    if (plugin_path_lc == gears_path_lc) {
-      // Give Gears plugins "background" priority.  See
-      // http://b/issue?id=1280317.
-      SetProcessBackgrounded();
-    }
-  }
-
-  return true;
+    process = 0;
+  return process;
 }
+#endif  // OS_POSIX
 
 void PluginProcessHost::OnMessageReceived(const IPC::Message& msg) {
   IPC_BEGIN_MESSAGE_MAP(PluginProcessHost, msg)
diff --git a/chrome/browser/plugin_process_host.h b/chrome/browser/plugin_process_host.h
index 2717e0c..5d0c7e3 100644
--- a/chrome/browser/plugin_process_host.h
+++ b/chrome/browser/plugin_process_host.h
@@ -7,8 +7,9 @@
 
 #include "build/build_config.h"
 
-#include <set>
 #include <queue>
+#include <set>
+#include <string>
 #include <vector>
 
 #include "app/gfx/native_widget_types.h"
@@ -114,6 +115,10 @@ class PluginProcessHost : public ChildProcessHost,
                      gfx::NativeWindow caller_window);
 #endif
 
+#if defined(OS_POSIX)
+  base::ProcessHandle InitHelperPosix(const CommandLine& cmd_line);
+#endif
+
 #if defined(OS_LINUX)
   void OnMapNativeViewId(gfx::NativeViewId id, gfx::PluginWindowHandle* output);
 #endif
diff --git a/chrome/browser/renderer_host/browser_render_process_host.cc b/chrome/browser/renderer_host/browser_render_process_host.cc
index ff9b60d..144fb37 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.cc
+++ b/chrome/browser/renderer_host/browser_render_process_host.cc
@@ -7,8 +7,6 @@
 
 #include "chrome/browser/renderer_host/browser_render_process_host.h"
 
-#include "build/build_config.h"
-
 #include <algorithm>
 #include <limits>
 #include <vector>
@@ -66,8 +64,8 @@
 #include "chrome/browser/sandbox_policy.h"
 #elif defined(OS_LINUX)
 #include "base/singleton.h"
+#include "chrome/browser/crash_handler_host_linux.h"
 #include "chrome/browser/zygote_host_linux.h"
-#include "chrome/browser/renderer_host/render_crash_handler_host_linux.h"
 #include "chrome/browser/renderer_host/render_sandbox_host_linux.h"
 #endif
 
@@ -594,7 +592,7 @@ base::ProcessHandle BrowserRenderProcessHost::ExecuteRenderer(
     const int ipcfd = channel_->GetClientFileDescriptor();
     mapping.push_back(std::pair<uint32_t, int>(kPrimaryIPCChannel, ipcfd));
     const int crash_signal_fd =
-        Singleton<RenderCrashHandlerHostLinux>()->GetDeathSignalSocket();
+        Singleton<RendererCrashHandlerHostLinux>()->GetDeathSignalSocket();
     if (crash_signal_fd >= 0) {
       mapping.push_back(std::pair<uint32_t, int>(kCrashDumpSignal,
                                                  crash_signal_fd));
@@ -614,7 +612,7 @@ base::ProcessHandle BrowserRenderProcessHost::ExecuteRenderer(
   // On Linux, we need to add some extra file descriptors for crash handling and
   // the sandbox.
   const int crash_signal_fd =
-      Singleton<RenderCrashHandlerHostLinux>()->GetDeathSignalSocket();
+      Singleton<RendererCrashHandlerHostLinux>()->GetDeathSignalSocket();
   if (crash_signal_fd >= 0) {
     fds_to_map.push_back(std::make_pair(crash_signal_fd,
                                         kCrashDumpSignal + 3));
@@ -914,7 +912,6 @@ void BrowserRenderProcessHost::OnChannelConnected(int32 peer_pid) {
   bool enabled = IPC::Logging::current()->Enabled();
   Send(new ViewMsg_SetIPCLoggingEnabled(enabled));
 #endif
-
 }
 
 // Static. This function can be called from any thread.
diff --git a/chrome/browser/renderer_host/render_crash_handler_host_linux.h b/chrome/browser/renderer_host/render_crash_handler_host_linux.h
deleted file mode 100644
index 78a97ba..0000000
--- a/chrome/browser/renderer_host/render_crash_handler_host_linux.h
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_RENDERER_HOST_RENDER_CRASH_HANDLER_HOST_LINUX_H_
-#define CHROME_BROWSER_RENDERER_HOST_RENDER_CRASH_HANDLER_HOST_LINUX_H_
-
-#include "base/singleton.h"
-#include "base/message_loop.h"
-
-// This is a singleton object which crash dumps renderers on Linux. We perform
-// the crash dump from the browser because it allows us to be outside the
-// sandbox.
-//
-// Renderers signal that they need to be dumped by sending a datagram over a
-// UNIX domain socket. All renderers share the client end of this socket which
-// is installed in their descriptor table before exec.
-class RenderCrashHandlerHostLinux : public MessageLoopForIO::Watcher,
-                                    public MessageLoop::DestructionObserver {
- public:
-  // Get the file descriptor which renderers should be given in order to signal
-  // crashes to the browser.
-  int GetDeathSignalSocket() const {
-    return renderer_socket_;
-  }
-
-  // MessagePumbLibevent::Watcher impl:
-  virtual void OnFileCanWriteWithoutBlocking(int fd);
-  virtual void OnFileCanReadWithoutBlocking(int fd);
-
-  // MessageLoop::DestructionObserver impl:
-  virtual void WillDestroyCurrentMessageLoop();
-
- private:
-  friend struct DefaultSingletonTraits<RenderCrashHandlerHostLinux>;
-  RenderCrashHandlerHostLinux();
-  ~RenderCrashHandlerHostLinux();
-  void Init();
-
-  int renderer_socket_;
-  int browser_socket_;
-  MessageLoopForIO::FileDescriptorWatcher file_descriptor_watcher_;
-
-  DISALLOW_EVIL_CONSTRUCTORS(RenderCrashHandlerHostLinux);
-};
-
-#endif  // CHROME_BROWSER_RENDERER_HOST_RENDER_CRASH_HANDLER_HOST_LINUX_H_
diff --git a/chrome/browser/renderer_host/render_crash_handler_host_linux_stub.cc b/chrome/browser/renderer_host/render_crash_handler_host_linux_stub.cc
deleted file mode 100644
index 2410bc1..0000000
--- a/chrome/browser/renderer_host/render_crash_handler_host_linux_stub.cc
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This is a stub file which is compiled in when we are building without
-// breakpad support.
-
-#include "chrome/browser/renderer_host/render_crash_handler_host_linux.h"
-
-RenderCrashHandlerHostLinux::RenderCrashHandlerHostLinux()
-    : renderer_socket_(-1),
-      browser_socket_(-1) {
-}
-
-RenderCrashHandlerHostLinux::~RenderCrashHandlerHostLinux() {
-}
-
-void RenderCrashHandlerHostLinux::OnFileCanReadWithoutBlocking(int fd) {
-}
-
-void RenderCrashHandlerHostLinux::OnFileCanWriteWithoutBlocking(int fd) {
-}
-
-void RenderCrashHandlerHostLinux::WillDestroyCurrentMessageLoop() {
-}
diff --git a/chrome/chrome.gyp b/chrome/chrome.gyp
index 9371aba..69f9687 100755
--- a/chrome/chrome.gyp
+++ b/chrome/chrome.gyp
@@ -2536,6 +2536,7 @@
             'browser/password_manager/password_store_win.h',
           ],
           'sources': [
+            'browser/crash_handler_host_linux.h',
             'browser/net/ssl_config_service_manager_pref.cc',
             'browser/spellcheck_host.cc',
             'browser/spellcheck_host.h',
@@ -2548,9 +2549,9 @@
           'conditions': [
             ['linux_breakpad==1', {
               'sources': [
-                'browser/renderer_host/render_crash_handler_host_linux.cc',
                 'app/breakpad_linux.cc',
                 'app/breakpad_linux.h',
+                'browser/crash_handler_host_linux.cc',
               ],
               'dependencies': [
                 '../breakpad/breakpad.gyp:breakpad_client',
@@ -2561,7 +2562,7 @@
               ],
             }, {  # linux_breakpad==0
               'sources': [
-                'browser/renderer_host/render_crash_handler_host_linux_stub.cc',
+                'browser/crash_handler_host_linux_stub.cc',
               ],
             }],
           ],
diff --git a/chrome/plugin/DEPS b/chrome/plugin/DEPS
index 0d9d3a6..08fd485 100644
--- a/chrome/plugin/DEPS
+++ b/chrome/plugin/DEPS
@@ -1,9 +1,10 @@
-include_rules = [

-  "+chrome/renderer",

-  "+sandbox/src",

-  "+skia/ext",

-  "+third_party/npapi",

-  "+webkit/glue",

-  "+webkit/glue/plugins",

-]

-

+include_rules = [
+  "+chrome/app",
+  "+chrome/renderer",
+  "+sandbox/src",
+  "+skia/ext",
+  "+third_party/npapi",
+  "+webkit/glue",
+  "+webkit/glue/plugins",
+]
+
diff --git a/chrome/plugin/plugin_main.cc b/chrome/plugin/plugin_main.cc
index b051501..0b67360 100644
--- a/chrome/plugin/plugin_main.cc
+++ b/chrome/plugin/plugin_main.cc
@@ -28,6 +28,10 @@
 #include "chrome/common/plugin_carbon_interpose_constants_mac.h"
 #endif
 
+#if defined(USE_LINUX_BREAKPAD)
+#include "chrome/app/breakpad_linux.h"
+#endif
+
 #if defined(OS_MACOSX)
 // Removes our Carbon library interposing from the environment so that it
 // doesn't carry into any processes that plugins might start.
@@ -65,6 +69,11 @@ static void TrimInterposeEnvironment() {
 
 // main() routine for running as the plugin process.
 int PluginMain(const MainFunctionParams& parameters) {
+#if defined(USE_LINUX_BREAKPAD)
+  // Needs to be called after we have chrome::DIR_USER_DATA.
+  InitCrashReporter();
+#endif
+
   // The main thread of the plugin services UI.
 #if defined(OS_MACOSX)
   // For Mac NPAPI plugins, we don't want a MessageLoop::TYPE_UI because