Don't use crashed plugins when instantiating new ones. Before, when a plugin

crashed and was still referenced by a plugin in the same renderer, it would try
to re-use the crashed one, which obviously doesn't work very well. This change
removes crashed plugins from the renderer's list.

TEST=Manual: instantiate two tabs sharing the same renderer using a plugin,
     kill the plugin, then reload one of the tabs.
BUG=none
Review URL: http://codereview.chromium.org/6594036

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@76194 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 22 insertions, 7 deletions

diff --git a/webkit/plugins/ppapi/plugin_delegate.h b/webkit/plugins/ppapi/plugin_delegate.h
index 72d5c9b..3aead21 100644
--- a/webkit/plugins/ppapi/plugin_delegate.h
+++ b/webkit/plugins/ppapi/plugin_delegate.h
@@ -85,10 +85,12 @@ class PluginDelegate {
   // have PluginDelegates).
   class ModuleLifetime {
    public:
-    // Notification that the given plugin object has been deleted. This is
-    // called from the module's destructor, so you should not dereference the
-    // given pointer.
-    virtual void PluginModuleDestroyed(PluginModule* destroyed_module) = 0;
+    // Notification that the given plugin object is no longer usable. It either
+    // indicates the module was deleted, or that it has crashed.
+    //
+    // This can be called from the module's destructor, so you should not
+    // dereference the given pointer.
+    virtual void PluginModuleDead(PluginModule* dead_module) = 0;
   };
 
   // This class is implemented by the PluginDelegate implementation and is
diff --git a/webkit/plugins/ppapi/plugin_module.cc b/webkit/plugins/ppapi/plugin_module.cc
index da30e42..2f155c6 100644
--- a/webkit/plugins/ppapi/plugin_module.cc
+++ b/webkit/plugins/ppapi/plugin_module.cc
@@ -374,6 +374,7 @@ PluginModule::PluginModule(const std::string& name,
                            PluginDelegate::ModuleLifetime* lifetime_delegate)
     : lifetime_delegate_(lifetime_delegate),
       callback_tracker_(new CallbackTracker),
+      is_crashed_(false),
       library_(NULL),
       name_(name) {
   pp_module_ = ResourceTracker::Get()->AddModule(this);
@@ -397,7 +398,11 @@ PluginModule::~PluginModule() {
     base::UnloadNativeLibrary(library_);
 
   ResourceTracker::Get()->ModuleDeleted(pp_module_);
-  lifetime_delegate_->PluginModuleDestroyed(this);
+
+  // When the plugin crashes, we immediately tell the lifetime delegate that
+  // we're gone, so we don't want to tell it again.
+  if (!is_crashed_)
+    lifetime_delegate_->PluginModuleDead(this);
 }
 
 bool PluginModule::InitAsInternalPlugin(const EntryPoints& entry_points) {
@@ -483,10 +488,15 @@ scoped_refptr<CallbackTracker> PluginModule::GetCallbackTracker() {
 }
 
 void PluginModule::PluginCrashed() {
+  DCHECK(!is_crashed_);  // Should only get one notification.
+  is_crashed_ = true;
+
   // Notify all instances that they crashed.
   for (PluginInstanceSet::iterator i = instances_.begin();
        i != instances_.end(); ++i)
     (*i)->InstanceCrashed();
+
+  lifetime_delegate_->PluginModuleDead(this);
 }
 
 bool PluginModule::InitializeModule() {
diff --git a/webkit/plugins/ppapi/plugin_module.h b/webkit/plugins/ppapi/plugin_module.h
index f21dbde..39aa878 100644
--- a/webkit/plugins/ppapi/plugin_module.h
+++ b/webkit/plugins/ppapi/plugin_module.h
@@ -140,6 +140,9 @@ class PluginModule : public base::RefCounted<PluginModule>,
 
   PP_Module pp_module_;
 
+  // True if the plugin is running out-of-process and has crashed.
+  bool is_crashed_;
+
   // Manages the out of process proxy interface. The presence of this
   // pointer indicates that the plugin is running out of process and that the
   // entry_points_ aren't valid.
diff --git a/webkit/plugins/ppapi/ppapi_unittest.cc b/webkit/plugins/ppapi/ppapi_unittest.cc
index a9a3637..56464e6 100644
--- a/webkit/plugins/ppapi/ppapi_unittest.cc
+++ b/webkit/plugins/ppapi/ppapi_unittest.cc
@@ -117,7 +117,7 @@ void PpapiUnittest::ShutdownModule() {
   module_ = NULL;
 }
 
-void PpapiUnittest::PluginModuleDestroyed(PluginModule* destroyed_module) {
+void PpapiUnittest::PluginModuleDead(PluginModule* /* dead_module */) {
   // Nothing needed (this is necessary to make the module compile).
 }
 
diff --git a/webkit/plugins/ppapi/ppapi_unittest.h b/webkit/plugins/ppapi/ppapi_unittest.h
index a48e620..fa24432 100644
--- a/webkit/plugins/ppapi/ppapi_unittest.h
+++ b/webkit/plugins/ppapi/ppapi_unittest.h
@@ -46,7 +46,7 @@ class PpapiUnittest : public testing::Test,
   scoped_refptr<PluginInstance> instance_;
 
   // ModuleLifetime implementation.
-  virtual void PluginModuleDestroyed(PluginModule* destroyed_module);
+  virtual void PluginModuleDead(PluginModule* dead_module);
 
   DISALLOW_COPY_AND_ASSIGN(PpapiUnittest);
 };