Fix renderer hang if plugin process crashes while initializing a plugin.

BUG=25104
Review URL: http://codereview.chromium.org/315012

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@29806 0039d316-1c4b-4281-b951-d872f2087c98

8 files changed, 35 insertions, 20 deletions

diff --git a/chrome/browser/plugin_process_host.cc b/chrome/browser/plugin_process_host.cc
index 10fd62c9..35dcda3 100644
--- a/chrome/browser/plugin_process_host.cc
+++ b/chrome/browser/plugin_process_host.cc
@@ -523,11 +523,19 @@ void PluginProcessHost::OnChannelError() {
   for (size_t i = 0; i < pending_requests_.size(); ++i) {
     ReplyToRenderer(pending_requests_[i].renderer_message_filter_.get(),
                     IPC::ChannelHandle(),
-                    WebPluginInfo(),
+                    info_,
                     pending_requests_[i].reply_msg);
   }
 
   pending_requests_.clear();
+
+  while (!sent_requests_.empty()) {
+    ReplyToRenderer(sent_requests_.front().renderer_message_filter_.get(),
+                    IPC::ChannelHandle(),
+                    info_,
+                    sent_requests_.front().reply_msg);
+    sent_requests_.pop();
+  }
 }
 
 void PluginProcessHost::OpenChannelToPlugin(
@@ -631,7 +639,7 @@ void PluginProcessHost::RequestPluginChannel(
   } else {
     ReplyToRenderer(renderer_message_filter,
                     IPC::ChannelHandle(),
-                    WebPluginInfo(),
+                    info_,
                     reply_msg);
   }
 }
diff --git a/chrome/browser/renderer_host/render_view_host.cc b/chrome/browser/renderer_host/render_view_host.cc
index 054332b..5fe0b05 100644
--- a/chrome/browser/renderer_host/render_view_host.cc
+++ b/chrome/browser/renderer_host/render_view_host.cc
@@ -1464,8 +1464,7 @@ void RenderViewHost::OnMissingPluginStatus(int status) {
     integration_delegate->OnMissingPluginStatus(status);
 }
 
-void RenderViewHost::OnCrashedPlugin(base::ProcessId pid,
-                                     const FilePath& plugin_path) {
+void RenderViewHost::OnCrashedPlugin(const FilePath& plugin_path) {
   RenderViewHostDelegate::BrowserIntegration* integration_delegate =
       delegate_->GetBrowserIntegrationDelegate();
   if (integration_delegate)
diff --git a/chrome/browser/renderer_host/render_view_host.h b/chrome/browser/renderer_host/render_view_host.h
index 1a651fc..8bfb591 100644
--- a/chrome/browser/renderer_host/render_view_host.h
+++ b/chrome/browser/renderer_host/render_view_host.h
@@ -557,7 +557,7 @@ class RenderViewHost : public RenderWidgetHost,
 
   void OnUserMetricsRecordAction(const std::wstring& action);
   void OnMissingPluginStatus(int status);
-  void OnCrashedPlugin(base::ProcessId pid, const FilePath& plugin_path);
+  void OnCrashedPlugin(const FilePath& plugin_path);
 
   void OnReceivedSavableResourceLinksForCurrentPage(
       const std::vector<GURL>& resources_list,
diff --git a/chrome/common/render_messages_internal.h b/chrome/common/render_messages_internal.h
index 40736b4..1b39dae 100644
--- a/chrome/common/render_messages_internal.h
+++ b/chrome/common/render_messages_internal.h
@@ -1415,8 +1415,7 @@ IPC_BEGIN_MESSAGES(ViewHost)
 
   // Sent by the renderer process to indicate that a plugin instance has
   // crashed.
-  IPC_MESSAGE_ROUTED2(ViewHostMsg_CrashedPlugin,
-                      base::ProcessId /* plugin process id */,
+  IPC_MESSAGE_ROUTED1(ViewHostMsg_CrashedPlugin,
                       FilePath /* plugin_path */)
 
   // Displays a JavaScript out-of-memory message in the infobar.
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index d25f439..89d67f8 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -321,9 +321,8 @@ void RenderView::UserMetricsRecordAction(const std::wstring& action) {
   Send(new ViewHostMsg_UserMetricsRecordAction(routing_id_, action));
 }
 
-void RenderView::PluginCrashed(base::ProcessId pid,
-                               const FilePath& plugin_path) {
-  Send(new ViewHostMsg_CrashedPlugin(routing_id_, pid, plugin_path));
+void RenderView::PluginCrashed(const FilePath& plugin_path) {
+  Send(new ViewHostMsg_CrashedPlugin(routing_id_, plugin_path));
 }
 
 void RenderView::Init(gfx::NativeViewId parent_hwnd,
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index c63ca9f..b77dc2a 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -383,7 +383,7 @@ class RenderView : public RenderWidget,
   virtual ~RenderView();
 
   // Called when a plugin has crashed.
-  void PluginCrashed(base::ProcessId pid, const FilePath& plugin_path);
+  void PluginCrashed(const FilePath& plugin_path);
 
   // Called from JavaScript window.external.AddSearchProvider() to add a
   // keyword for a provider described in the given OpenSearch document.
diff --git a/chrome/renderer/webplugin_delegate_proxy.cc b/chrome/renderer/webplugin_delegate_proxy.cc
index 9faed18..20cea7f 100644
--- a/chrome/renderer/webplugin_delegate_proxy.cc
+++ b/chrome/renderer/webplugin_delegate_proxy.cc
@@ -217,21 +217,27 @@ bool WebPluginDelegateProxy::Initialize(const GURL& url,
     webkit_glue::WebPlugin* plugin,
     bool load_manually) {
   IPC::ChannelHandle channel_handle;
-  WebPluginInfo info;
   if (!RenderThread::current()->Send(new ViewHostMsg_OpenChannelToPlugin(
           url, mime_type_, webkit_glue::GetWebKitLocale(),
-          &channel_handle, &info))) {
+          &channel_handle, &info_))) {
     return false;
   }
 
-#if defined(OS_POSIX)
   if (channel_handle.name.empty()) {
-    // We got an invalid handle. Possibly the plugin process is stale? In any
-    // case, don't try to connect to it, the empty name represents the host
-    // channel, and connecting to it again does bad things.
+    // We got an invalid handle.  Either the plugin couldn't be found (which
+    // shouldn't happen, since if we got here the plugin should exist) or the
+    // plugin crashed on initialization.
+    if (!info_.path.empty()) {
+      render_view_->PluginCrashed(info_.path);
+
+      // Return true so that the plugin widget is created and we can paint the
+      // crashed plugin there.
+      return true;
+    }
     return false;
   }
 
+#if defined(OS_POSIX)
   // If we received a ChannelHandle, register it now.
   if (channel_handle.socket.fd >= 0)
     IPC::AddChannelSocket(channel_handle.name, channel_handle.socket.fd);
@@ -249,7 +255,6 @@ bool WebPluginDelegateProxy::Initialize(const GURL& url,
   if (!result)
     return false;
 
-  info_ = info;
   channel_host_ = channel_host;
   instance_id_ = instance_id;
 
@@ -379,7 +384,7 @@ void WebPluginDelegateProxy::OnChannelError() {
     }
     plugin_->Invalidate();
   }
-  render_view_->PluginCrashed(GetProcessId(), info_.path);
+  render_view_->PluginCrashed(info_.path);
 }
 
 void WebPluginDelegateProxy::UpdateGeometry(const gfx::Rect& window_rect,
@@ -517,7 +522,7 @@ void WebPluginDelegateProxy::Paint(gfx::NativeDrawingContext context,
 
   // If the plugin is no longer connected (channel crashed) draw a crashed
   // plugin bitmap
-  if (!channel_host_->channel_valid()) {
+  if (!channel_host_ || !channel_host_->channel_valid()) {
     PaintSadPlugin(context, rect);
     return;
   }
@@ -1040,6 +1045,9 @@ webkit_glue::WebPluginResourceClient*
 WebPluginDelegateProxy::CreateResourceClient(
     int resource_id, const GURL& url, bool notify_needed,
     intptr_t notify_data, intptr_t npstream) {
+  if (!channel_host_)
+    return NULL;
+
   ResourceClientProxy* proxy = new ResourceClientProxy(channel_host_,
                                                        instance_id_);
   proxy->Initialize(resource_id, url, notify_needed, notify_data, npstream);
diff --git a/webkit/glue/webplugin_impl.cc b/webkit/glue/webplugin_impl.cc
index 7d4bbdc..6c67b92 100644
--- a/webkit/glue/webplugin_impl.cc
+++ b/webkit/glue/webplugin_impl.cc
@@ -835,6 +835,8 @@ void WebPluginImpl::HandleURLRequestInternal(
     int resource_id = GetNextResourceId();
     WebPluginResourceClient* resource_client = delegate_->CreateResourceClient(
         resource_id, complete_url, notify, notify_data, NULL);
+    if (!resource_client)
+      return;
 
     // If the RouteToFrame call returned a failure then inform the result
     // back to the plugin asynchronously.