Make shared memory allocation possible for all child process types.

Review URL: http://codereview.chromium.org/8229039

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@105621 0039d316-1c4b-4281-b951-d872f2087c98

12 files changed, 133 insertions, 67 deletions

diff --git a/content/browser/renderer_host/render_message_filter.cc b/content/browser/renderer_host/render_message_filter.cc
index 0f81b6d..9c1fb9d 100644
--- a/content/browser/renderer_host/render_message_filter.cc
+++ b/content/browser/renderer_host/render_message_filter.cc
@@ -29,6 +29,8 @@
 #include "content/browser/renderer_host/render_widget_helper.h"
 #include "content/browser/resource_context.h"
 #include "content/browser/user_metrics.h"
+#include "content/common/child_process_host.h"
+#include "content/common/child_process_messages.h"
 #include "content/common/desktop_notification_messages.h"
 #include "content/common/notification_service.h"
 #include "content/common/view_messages.h"
@@ -62,10 +64,6 @@
 #if defined(OS_POSIX)
 #include "base/file_descriptor_posix.h"
 #endif
-#if defined(OS_WIN)
-#include "content/common/child_process_host.h"
-#include "content/common/child_process_messages.h"
-#endif
 
 using net::CookieStore;
 using content::PluginServiceFilter;
@@ -348,8 +346,8 @@ bool RenderMessageFilter::OnMessageReceived(const IPC::Message& message,
         render_widget_helper_->DidReceiveUpdateMsg(message))
     IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_CheckPermission,
                         OnCheckNotificationPermission)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_AllocateSharedMemoryBuffer,
-                        OnAllocateSharedMemoryBuffer)
+    IPC_MESSAGE_HANDLER(ChildProcessHostMsg_SyncAllocateSharedMemory,
+                        OnAllocateSharedMemory)
 #if defined(OS_MACOSX)
     IPC_MESSAGE_HANDLER(ViewHostMsg_AllocTransportDIB, OnAllocTransportDIB)
     IPC_MESSAGE_HANDLER(ViewHostMsg_FreeTransportDIB, OnFreeTransportDIB)
@@ -638,16 +636,11 @@ void RenderMessageFilter::OnCheckNotificationPermission(
       CheckDesktopNotificationPermission(source_url, resource_context_);
 }
 
-void RenderMessageFilter::OnAllocateSharedMemoryBuffer(
+void RenderMessageFilter::OnAllocateSharedMemory(
     uint32 buffer_size,
     base::SharedMemoryHandle* handle) {
-  base::SharedMemory shared_buf;
-  if (!shared_buf.CreateAndMapAnonymous(buffer_size)) {
-    *handle = base::SharedMemory::NULLHandle();
-    NOTREACHED() << "Cannot map shared memory buffer";
-    return;
-  }
-  shared_buf.GiveToProcess(peer_handle(), handle);
+  ChildProcessHost::OnAllocateSharedMemory(
+      buffer_size, peer_handle(), handle);
 }
 
 net::URLRequestContext* RenderMessageFilter::GetRequestContextForURL(
diff --git a/content/browser/renderer_host/render_message_filter.h b/content/browser/renderer_host/render_message_filter.h
index 37a259c..1fbf322 100644
--- a/content/browser/renderer_host/render_message_filter.h
+++ b/content/browser/renderer_host/render_message_filter.h
@@ -187,8 +187,8 @@ class RenderMessageFilter : public BrowserMessageFilter {
   // Used to ask the browser to allocate a block of shared memory for the
   // renderer to send back data in, since shared memory can't be created
   // in the renderer on POSIX due to the sandbox.
-  void OnAllocateSharedMemoryBuffer(uint32 buffer_size,
-                                    base::SharedMemoryHandle* handle);
+  void OnAllocateSharedMemory(uint32 buffer_size,
+                              base::SharedMemoryHandle* handle);
   void OnResolveProxy(const GURL& url, IPC::Message* reply_msg);
 
   // Browser side transport DIB allocation
diff --git a/content/common/child_process_host.cc b/content/common/child_process_host.cc
index 3ac362a..66ba3a0 100644
--- a/content/common/child_process_host.cc
+++ b/content/common/child_process_host.cc
@@ -9,6 +9,7 @@
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/path_service.h"
+#include "base/process_util.h"
 #include "base/third_party/dynamic_annotations/dynamic_annotations.h"
 #include "content/common/child_process_info.h"
 #include "content/common/child_process_messages.h"
@@ -264,6 +265,9 @@ void ChildProcessHost::ReleaseCachedFonts(int pid) {
 }
 #endif  // OS_WIN
 
+void ChildProcessHost::ForceShutdown() {
+  Send(new ChildProcessMsg_Shutdown());
+}
 
 bool ChildProcessHost::CreateChannel() {
   channel_id_ = ChildProcessInfo::GenerateRandomChannelID(this);
@@ -310,6 +314,18 @@ bool ChildProcessHost::Send(IPC::Message* message) {
   return channel_->Send(message);
 }
 
+void ChildProcessHost::OnAllocateSharedMemory(
+      uint32 buffer_size, base::ProcessHandle child_process_handle,
+      base::SharedMemoryHandle* shared_memory_handle) {
+  base::SharedMemory shared_buf;
+  if (!shared_buf.CreateAndMapAnonymous(buffer_size)) {
+    *shared_memory_handle = base::SharedMemory::NULLHandle();
+    NOTREACHED() << "Cannot map shared memory buffer";
+    return;
+  }
+  shared_buf.GiveToProcess(child_process_handle, shared_memory_handle);
+}
+
 void ChildProcessHost::OnChildDied() {
   delete this;
 }
@@ -325,7 +341,11 @@ void ChildProcessHost::Notify(int type) {
 }
 
 ChildProcessHost::ListenerHook::ListenerHook(ChildProcessHost* host)
-    : host_(host) {
+    : host_(host), peer_handle_(base::kNullProcessHandle) {
+}
+
+ChildProcessHost::ListenerHook::~ListenerHook() {
+  base::CloseProcessHandle(peer_handle_);
 }
 
 void ChildProcessHost::ListenerHook::Shutdown() {
@@ -356,15 +376,21 @@ bool ChildProcessHost::ListenerHook::OnMessageReceived(
     }
   }
 
-  if (!handled && msg.type() == ChildProcessHostMsg_ShutdownRequest::ID) {
-    if (host_->CanShutdown())
-      host_->Send(new ChildProcessMsg_Shutdown());
+  if (!handled) {
+    bool msg_is_good = false;
     handled = true;
+    IPC_BEGIN_MESSAGE_MAP_EX(ListenerHook, msg, msg_is_good)
+      IPC_MESSAGE_HANDLER(ChildProcessHostMsg_ShutdownRequest,
+                          OnShutdownRequest)
+      IPC_MESSAGE_HANDLER(ChildProcessHostMsg_SyncAllocateSharedMemory,
+                          OnAllocateSharedMemory)
+      IPC_MESSAGE_UNHANDLED(handled = false)
+    IPC_END_MESSAGE_MAP_EX()
+
+    if (!handled)
+      handled = host_->OnMessageReceived(msg);
   }
 
-  if (!handled)
-    handled = host_->OnMessageReceived(msg);
-
 #ifdef IPC_MESSAGE_LOG_ENABLED
   if (logger->Enabled())
     logger->OnPostDispatchMessage(msg, host_->channel_id_);
@@ -375,6 +401,9 @@ bool ChildProcessHost::ListenerHook::OnMessageReceived(
 void ChildProcessHost::ListenerHook::OnChannelConnected(int32 peer_pid) {
   if (!host_)
     return;
+  if (!base::OpenProcessHandle(peer_pid, &peer_handle_)) {
+    NOTREACHED();
+  }
   host_->opening_channel_ = false;
   host_->OnChannelConnected(peer_pid);
   // Notify in the main loop of the connection.
@@ -397,6 +426,18 @@ void ChildProcessHost::ListenerHook::OnChannelError() {
   host_->OnChildDisconnected();
 }
 
-void ChildProcessHost::ForceShutdown() {
-  Send(new ChildProcessMsg_Shutdown());
+bool ChildProcessHost::ListenerHook::Send(IPC::Message* message) {
+  return host_->Send(message);
+}
+
+void ChildProcessHost::ListenerHook::OnAllocateSharedMemory(
+    uint32 buffer_size,
+    base::SharedMemoryHandle* handle) {
+  ChildProcessHost::OnAllocateSharedMemory(
+      buffer_size, peer_handle_, handle);
+}
+
+void ChildProcessHost::ListenerHook::OnShutdownRequest() {
+  if (host_->CanShutdown())
+    host_->Send(new ChildProcessMsg_Shutdown());
 }
diff --git a/content/common/child_process_host.h b/content/common/child_process_host.h
index a4a7c55..b5b0803 100644
--- a/content/common/child_process_host.h
+++ b/content/common/child_process_host.h
@@ -19,6 +19,7 @@
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/singleton.h"
+#include "base/shared_memory.h"
 #include "base/string16.h"
 #include "content/common/content_export.h"
 #include "content/common/content_notification_types.h"
@@ -100,6 +101,11 @@ class CONTENT_EXPORT ChildProcessHost : public IPC::Channel::Listener,
   // Adds an IPC message filter.  A reference will be kept to the filter.
   void AddFilter(IPC::ChannelProxy::MessageFilter* filter);
 
+  // Public and static for reuse by RenderMessageFilter.
+  static void OnAllocateSharedMemory(
+      uint32 buffer_size, base::ProcessHandle child_process,
+      base::SharedMemoryHandle* handle);
+
  protected:
   ChildProcessHost();
 
@@ -146,6 +152,7 @@ class CONTENT_EXPORT ChildProcessHost : public IPC::Channel::Listener,
   class ListenerHook : public IPC::Channel::Listener {
    public:
     explicit ListenerHook(ChildProcessHost* host);
+    virtual ~ListenerHook();
 
     void Shutdown();
 
@@ -153,8 +160,15 @@ class CONTENT_EXPORT ChildProcessHost : public IPC::Channel::Listener,
     virtual bool OnMessageReceived(const IPC::Message& msg) OVERRIDE;
     virtual void OnChannelConnected(int32 peer_pid) OVERRIDE;
     virtual void OnChannelError() OVERRIDE;
+
+    bool Send(IPC::Message* message);
+
    private:
+    void OnShutdownRequest();
+    void OnAllocateSharedMemory(uint32 buffer_size,
+                                base::SharedMemoryHandle* handle);
     ChildProcessHost* host_;
+    base::ProcessHandle peer_handle_;
     DISALLOW_COPY_AND_ASSIGN(ListenerHook);
   };
 
diff --git a/content/common/child_process_messages.h b/content/common/child_process_messages.h
index e465b59..cdb402c 100644
--- a/content/common/child_process_messages.h
+++ b/content/common/child_process_messages.h
@@ -5,6 +5,7 @@
 // Common IPC messages used for child processes.
 // Multiply-included message file, hence no include guard.
 
+#include "base/shared_memory.h"
 #include "content/common/content_export.h"
 #include "googleurl/src/gurl.h"
 #include "ipc/ipc_message_macros.h"
@@ -78,3 +79,9 @@ IPC_SYNC_MESSAGE_CONTROL1_0(ChildProcessHostMsg_PreCacheFont,
 // Release the cached font
 IPC_MESSAGE_CONTROL0(ChildProcessHostMsg_ReleaseCachedFonts)
 #endif  // defined(OS_WIN)
+
+// Asks the browser to create a block of shared memory for the child process to
+// fill in and pass back to the browser.
+IPC_SYNC_MESSAGE_CONTROL1_1(ChildProcessHostMsg_SyncAllocateSharedMemory,
+                            uint32 /* buffer size */,
+                            base::SharedMemoryHandle)
diff --git a/content/common/child_thread.cc b/content/common/child_thread.cc
index 9c163ea..ff34f0b 100644
--- a/content/common/child_thread.cc
+++ b/content/common/child_thread.cc
@@ -125,6 +125,39 @@ webkit_glue::ResourceLoaderBridge* ChildThread::CreateBridge(
   return resource_dispatcher()->CreateBridge(request_info);
 }
 
+base::SharedMemory* ChildThread::AllocateSharedMemory(
+    size_t buf_size) {
+  scoped_ptr<base::SharedMemory> shared_buf;
+#if defined(OS_WIN)
+  shared_buf.reset(new base::SharedMemory);
+  if (!shared_buf->CreateAndMapAnonymous(buf_size)) {
+    NOTREACHED();
+    return NULL;
+  }
+#else
+  // On POSIX, we need to ask the browser to create the shared memory for us,
+  // since this is blocked by the sandbox.
+  base::SharedMemoryHandle shared_mem_handle;
+  if (Send(new ChildProcessHostMsg_SyncAllocateSharedMemory(
+                   buf_size, &shared_mem_handle))) {
+    if (base::SharedMemory::IsHandleValid(shared_mem_handle)) {
+      shared_buf.reset(new base::SharedMemory(shared_mem_handle, false));
+      if (!shared_buf->Map(buf_size)) {
+        NOTREACHED() << "Map failed";
+        return NULL;
+      }
+    } else {
+      NOTREACHED() << "Browser failed to allocate shared memory";
+      return NULL;
+    }
+  } else {
+    NOTREACHED() << "Browser allocation request message failed";
+    return NULL;
+  }
+#endif
+  return shared_buf.release();
+}
+
 ResourceDispatcher* ChildThread::resource_dispatcher() {
   return resource_dispatcher_.get();
 }
diff --git a/content/common/child_thread.h b/content/common/child_thread.h
index 356ffd5..a58fecf 100644
--- a/content/common/child_thread.h
+++ b/content/common/child_thread.h
@@ -8,6 +8,7 @@
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/shared_memory.h"
 #include "content/common/content_export.h"
 #include "content/common/message_router.h"
 #include "webkit/glue/resource_loader_bridge.h"
@@ -50,6 +51,12 @@ class CONTENT_EXPORT ChildThread : public IPC::Channel::Listener,
   virtual webkit_glue::ResourceLoaderBridge* CreateBridge(
       const webkit_glue::ResourceLoaderBridge::RequestInfo& request_info);
 
+  // Allocates a block of shared memory of the given size and
+  // maps in into the address space. Returns NULL of failure.
+  // Note: On posix, this requires a sync IPC to the browser process,
+  // but on windows the child process directly allocates the block.
+  base::SharedMemory* AllocateSharedMemory(size_t buf_size);
+
   ResourceDispatcher* resource_dispatcher();
 
   SocketStreamDispatcher* socket_stream_dispatcher() {
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index f19fe7f..a5927ef 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -1756,12 +1756,6 @@ IPC_MESSAGE_ROUTED3(ViewHostMsg_UpdateZoomLimits,
                     int /* maximum_percent */,
                     bool /* remember */)
 
-// Asks the browser to create a block of shared memory for the renderer to
-// fill in and pass back to the browser.
-IPC_SYNC_MESSAGE_CONTROL1_1(ViewHostMsg_AllocateSharedMemoryBuffer,
-                            uint32 /* buffer size */,
-                            base::SharedMemoryHandle /* browser handle */)
-
 // Notify the browser that this render process can or can't be suddenly
 // terminated.
 IPC_MESSAGE_CONTROL1(ViewHostMsg_SuddenTerminationChanged,
diff --git a/content/renderer/gpu/command_buffer_proxy.cc b/content/renderer/gpu/command_buffer_proxy.cc
index 4e68cb1..c4562b8 100644
--- a/content/renderer/gpu/command_buffer_proxy.cc
+++ b/content/renderer/gpu/command_buffer_proxy.cc
@@ -10,6 +10,7 @@
 #include "base/shared_memory.h"
 #include "base/stl_util.h"
 #include "base/task.h"
+#include "content/common/child_process_messages.h"
 #include "content/common/child_thread.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/plugin_messages.h"
@@ -100,7 +101,7 @@ bool CommandBufferProxy::Initialize(int32 size) {
     return false;
 
   base::SharedMemoryHandle handle;
-  if (!child_thread->Send(new ViewHostMsg_AllocateSharedMemoryBuffer(
+  if (!child_thread->Send(new ChildProcessHostMsg_SyncAllocateSharedMemory(
       size,
       &handle))) {
     return false;
@@ -221,7 +222,7 @@ int32 CommandBufferProxy::CreateTransferBuffer(size_t size, int32 id_request) {
     return -1;
 
   base::SharedMemoryHandle handle;
-  if (!child_thread->Send(new ViewHostMsg_AllocateSharedMemoryBuffer(
+  if (!child_thread->Send(new ChildProcessHostMsg_SyncAllocateSharedMemory(
       size,
       &handle))) {
     return -1;
diff --git a/content/renderer/pepper_plugin_delegate_impl.cc b/content/renderer/pepper_plugin_delegate_impl.cc
index f78f281..5790970 100644
--- a/content/renderer/pepper_plugin_delegate_impl.cc
+++ b/content/renderer/pepper_plugin_delegate_impl.cc
@@ -19,6 +19,7 @@
 #include "base/task.h"
 #include "base/time.h"
 #include "content/common/child_process.h"
+#include "content/common/child_process_messages.h"
 #include "content/common/child_thread.h"
 #include "content/common/file_system/file_system_dispatcher.h"
 #include "content/common/file_system_messages.h"
@@ -1656,7 +1657,7 @@ base::SharedMemory* PepperPluginDelegateImpl::CreateAnonymousSharedMemory(
     return NULL;
   base::SharedMemoryHandle handle;
   if (!render_view_->Send(
-          new ViewHostMsg_AllocateSharedMemoryBuffer(size, &handle))) {
+          new ChildProcessHostMsg_SyncAllocateSharedMemory(size, &handle))) {
     DLOG(WARNING) << "Browser allocation request message failed";
     return NULL;
   }
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index c02c765..509339d 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -22,6 +22,7 @@
 #include "base/threading/thread_local.h"
 #include "base/values.h"
 #include "content/common/appcache/appcache_dispatcher.h"
+#include "content/common/child_process_messages.h"
 #include "content/common/database_messages.h"
 #include "content/common/db_message_filter.h"
 #include "content/common/dom_storage_messages.h"
@@ -73,9 +74,7 @@
 #include "webkit/glue/webkit_glue.h"
 
 // TODO(port)
-#if defined(OS_WIN)
-#include "content/common/child_process_messages.h"
-#else
+#if !defined(OS_WIN)
 #include "base/memory/scoped_handle.h"
 #include "content/common/np_channel_base.h"
 #endif
@@ -523,9 +522,10 @@ void RenderThreadImpl::RecordUserMetrics(const std::string& action) {
 }
 
 base::SharedMemoryHandle RenderThreadImpl::HostAllocateSharedMemoryBuffer(
-  uint32 buffer_size) {
+    uint32 buffer_size) {
   base::SharedMemoryHandle mem_handle;
-  Send(new ViewHostMsg_AllocateSharedMemoryBuffer(buffer_size, &mem_handle));
+  Send(new ChildProcessHostMsg_SyncAllocateSharedMemory(
+                buffer_size, &mem_handle));
   return mem_handle;
 }
 
diff --git a/content/renderer/renderer_glue.cc b/content/renderer/renderer_glue.cc
index 52a6a26..f873993 100644
--- a/content/renderer/renderer_glue.cc
+++ b/content/renderer/renderer_glue.cc
@@ -51,37 +51,12 @@ void ScopedClipboardWriterGlue::WriteBitmapFromPixels(const void* pixels,
   uint32 buf_size = 4 * size.width() * size.height();
 
   // Allocate a shared memory buffer to hold the bitmap bits.
-#if defined(OS_POSIX)
-  // On POSIX, we need to ask the browser to create the shared memory for us,
-  // since this is blocked by the sandbox.
-  base::SharedMemoryHandle shared_mem_handle;
-  ViewHostMsg_AllocateSharedMemoryBuffer *msg =
-      new ViewHostMsg_AllocateSharedMemoryBuffer(buf_size,
-                                                 &shared_mem_handle);
-  if (RenderThreadImpl::current()->Send(msg)) {
-    if (base::SharedMemory::IsHandleValid(shared_mem_handle)) {
-      shared_buf_ = new base::SharedMemory(shared_mem_handle, false);
-      if (!shared_buf_ || !shared_buf_->Map(buf_size)) {
-        NOTREACHED() << "Map failed";
-        return;
-      }
-    } else {
-      NOTREACHED() << "Browser failed to allocate shared memory";
-      return;
-    }
-  } else {
-    NOTREACHED() << "Browser allocation request message failed";
+  shared_buf_ = ChildThread::current()->AllocateSharedMemory(buf_size);
+  if (!shared_buf_)
     return;
-  }
-#else  // !OS_POSIX
-  shared_buf_ = new base::SharedMemory;
-  if (!shared_buf_->CreateAndMapAnonymous(buf_size)) {
-    NOTREACHED();
-    return;
-  }
-#endif
 
   // Copy the bits into shared memory
+  DCHECK(shared_buf_->memory());
   memcpy(shared_buf_->memory(), pixels, buf_size);
   shared_buf_->Unmap();