Merge trunk r33351 to the 249 branch.

Don't reuse the initial IPC channel.

I was seeing a noninitial IPC channel getting closed in a renderer, and then
when someone tried to reuse that channel by name,
IPC::Channel::ChannelImpl::CreatePipe would assign the initial pipe.  The
initial pipe was already in use, and things would fall apart pretty rapidly.

I'm making this FATAL because the renderer's probably going to be unusable if
it gets into this state anyway, and a sad tab is probably more useful than a
tab that appears to be loading indefinitely.

BUG=26754
TEST=Test case from bug 26754 comment 9 (affected machines only):
      a. Have lots of bookmarks (import Safari defaults)
      b. Right-click on bookmark bar, and choose "Open All Bookmarks"
     Expect: no crash.
Review URL: http://codereview.chromium.org/452021

TBR=mark@chromium.org
Review URL: http://codereview.chromium.org/449029

git-svn-id: svn://svn.chromium.org/chrome/branches/249/src@33353 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 10 insertions, 0 deletions

diff --git a/ipc/ipc_channel_posix.cc b/ipc/ipc_channel_posix.cc
index 5800f92..c1afd76 100644
--- a/ipc/ipc_channel_posix.cc
+++ b/ipc/ipc_channel_posix.cc
@@ -339,6 +339,16 @@ bool Channel::ChannelImpl::CreatePipe(const std::string& channel_id,
           return false;
         AddChannelSocket(pipe_name_, client_pipe_);
       } else {
+        // Guard against inappropriate reuse of the initial IPC channel.  If
+        // an IPC channel closes and someone attempts to reuse it by name, the
+        // initial channel must not be recycled here.  http://crbug.com/26754.
+        static bool used_initial_channel = false;
+        if (used_initial_channel) {
+          LOG(FATAL) << "Denying attempt to reuse initial IPC channel";
+          return false;
+        }
+        used_initial_channel = true;
+
         pipe_ = Singleton<base::GlobalDescriptors>()->Get(kPrimaryIPCChannel);
       }
     } else {