Move ExtensionFunctionDispatcher to ExtensionTabHelper. This

sets the stage for us to expose certain extension functions
to content scripts and normal web pages.

This required two major structural changes:

1. Made EFD stateless, except for the pointer to its
delegate. This is important to gracefully handle the case
of a RVH navigating between different extensions or even
to normal web content. Especially in the case of
TabContents, where the entire RVH can be torn down and
replaced during navigation.

2. Centralize all per-(extension, RVH) setup in
ChromeContentBrowserClient::RenderViewCreated(). In
particular, responsibility for enabling extension bindings
was very spread out before, making it hard to follow when
exactly they were enabled.

BUG=80308

Review URL: http://codereview.chromium.org/6927076

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@84928 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 41 insertions, 3 deletions

diff --git a/chrome/browser/extensions/extension_function.h b/chrome/browser/extensions/extension_function.h
index 7913703..517719fe 100644
--- a/chrome/browser/extensions/extension_function.h
+++ b/chrome/browser/extensions/extension_function.h
@@ -11,6 +11,9 @@
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
+#include "content/browser/browser_thread.h"
+#include "content/common/notification_observer.h"
+#include "content/common/notification_registrar.h"
 #include "chrome/browser/extensions/extension_function_dispatcher.h"
 
 class ExtensionFunctionDispatcher;
@@ -37,10 +40,14 @@ class Value;
 
 // Abstract base class for extension functions the ExtensionFunctionDispatcher
 // knows how to dispatch to.
-class ExtensionFunction : public base::RefCountedThreadSafe<ExtensionFunction> {
+class ExtensionFunction
+    : public base::RefCountedThreadSafe<ExtensionFunction,
+                                        BrowserThread::DeleteOnUIThread> {
  public:
   ExtensionFunction();
 
+  virtual ~ExtensionFunction();
+
   // Specifies the name of the function.
   void set_name(const std::string& name) { name_ = name; }
   const std::string name() const { return name_; }
@@ -56,6 +63,9 @@ class ExtensionFunction : public base::RefCountedThreadSafe<ExtensionFunction> {
   }
   std::string extension_id() const { return extension_id_; }
 
+  void SetRenderViewHost(RenderViewHost* render_view_host);
+  RenderViewHost* render_view_host() const { return render_view_host_; }
+
   // Specifies the raw arguments to the function, as a JSON value.
   virtual void SetArgs(const ListValue* args) = 0;
 
@@ -102,8 +112,6 @@ class ExtensionFunction : public base::RefCountedThreadSafe<ExtensionFunction> {
  protected:
   friend class base::RefCountedThreadSafe<ExtensionFunction>;
 
-  virtual ~ExtensionFunction();
-
   // Gets the extension that called this function. This can return NULL for
   // async functions, for example if the extension is unloaded while the
   // function is running.
@@ -130,6 +138,9 @@ class ExtensionFunction : public base::RefCountedThreadSafe<ExtensionFunction> {
   // The peer to the dispatcher that will service this extension function call.
   scoped_refptr<ExtensionFunctionDispatcher::Peer> peer_;
 
+  // The RenderViewHost we will send responses too.
+  RenderViewHost* render_view_host_;
+
   // Id of this request, used to map the response back to the caller.
   int request_id_;
 
@@ -158,6 +169,26 @@ class ExtensionFunction : public base::RefCountedThreadSafe<ExtensionFunction> {
   // True if the call was made in response of user gesture.
   bool user_gesture_;
 
+ private:
+  // Helper class to track the lifetime of ExtensionFunction's RenderViewHost
+  // pointer and NULL it out when it dies. We use this separate class (instead
+  // of implementing NotificationObserver on ExtensionFunction) because it is
+  // common for subclasses of ExtensionFunction to be NotificationObservers, and
+  // it would be an easy error to forget to call the base class's Observe()
+  // method.
+  class RenderViewHostTracker : public NotificationObserver {
+   public:
+    explicit RenderViewHostTracker(ExtensionFunction* extension_function);
+   private:
+    void Observe(NotificationType type,
+                 const NotificationSource& source,
+                 const NotificationDetails& details);
+    ExtensionFunction* function_;
+    NotificationRegistrar registrar_;
+  };
+
+  scoped_ptr<RenderViewHostTracker> tracker_;
+
   DISALLOW_COPY_AND_ASSIGN(ExtensionFunction);
 };
 
@@ -204,6 +235,13 @@ class AsyncExtensionFunction : public ExtensionFunction {
   // returning.  The calling renderer process will be killed.
   bool bad_message_;
 
+ private:
+  // Called when we receive an extension api request that is invalid in a way
+  // that JSON validation in the renderer should have caught. This should never
+  // happen and could be an attacker trying to exploit the browser, so we crash
+  // the renderer instead.
+  void HandleBadMessage();
+
   DISALLOW_COPY_AND_ASSIGN(AsyncExtensionFunction);
 };