Actually free plugin implement vars when running out of process when the

ppapi/proxy/plugin_var_tracker.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/plugin_var_tracker.h"
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/singleton.h"
+#include "ppapi/c/dev/ppp_class_deprecated.h"
 #include "ppapi/c/ppb_var.h"
 #include "ppapi/proxy/plugin_array_buffer_var.h"
 #include "ppapi/proxy/plugin_dispatcher.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/proxy/proxy_object_var.h"
 #include "ppapi/shared_impl/api_id.h"
 #include "ppapi/shared_impl/var.h"
 
 namespace ppapi {
 namespace proxy {
@@ skipping 125 matching lines @@
       HostVar(dispatcher, static_cast<int32>(host_object.value.as_id)));
   if (found == host_var_to_plugin_var_.end()) {
     NOTREACHED();
     return;
   }
 
   // Now just release the object given the plugin var ID.
   ReleaseVar(found->second);
 }
 
+void PluginVarTracker::DidDeleteInstance(PP_Instance instance) {
+  // See the comment above user_data_to_plugin_ in the header file. We assume
+  // there aren't that many objects so a brute-force search is reasonable.
+  UserDataToPluginImplementedVarMap::iterator i =
+      user_data_to_plugin_.begin();
+  while (i != user_data_to_plugin_.end()) {
+    if (i->second.instance == instance) {
+      if (!i->second.plugin_object_id) {
+        // This object is for the freed instance and the plugin is not holding
+        // any references to it. Deallocate immediately.
+        UserDataToPluginImplementedVarMap::iterator to_remove = i;
+        ++i;
+        to_remove->second.ppp_class->Deallocate(to_remove->first);
+        user_data_to_plugin_.erase(to_remove);
+      } else {
+        // The plugin is holding refs to this object. We don't want to call
+        // Deallocate since the plugin may be depending on those refs to keep
+        // its data alive. To avoid crashes in this case, just clear out the
+        // instance to mark it and continue. When the plugin refs go to 0,
+        // we'll notice there is no instance and call Deallocate.
+        i->second.instance = 0;
+        ++i;
+      }
+    } else {
+      ++i;
+    }
+  }
+}
+
 ArrayBufferVar* PluginVarTracker::CreateArrayBuffer(uint32 size_in_bytes) {
   return new PluginArrayBufferVar(size_in_bytes);
 }
 
+void PluginVarTracker::PluginImplementedObjectCreated(
+    PP_Instance instance,
+    const PP_Var& created_var,
+    const PPP_Class_Deprecated* ppp_class,
+    void* ppp_class_data) {
+  PluginImplementedVar p;
+  p.ppp_class = ppp_class;
+  p.instance = instance;
+  p.plugin_object_id = created_var.value.as_id;
+  user_data_to_plugin_[ppp_class_data] = p;
+
+  // Link the user data to the object.
+  ProxyObjectVar* object = GetVar(created_var)->AsProxyObjectVar();
+  object->set_user_data(ppp_class_data);
+}
+
+void PluginVarTracker::PluginImplementedObjectDestroyed(void* user_data) {
+  UserDataToPluginImplementedVarMap::iterator found =
+      user_data_to_plugin_.find(user_data);
+  if (found == user_data_to_plugin_.end()) {
+    NOTREACHED();
+    return;
+  }
+  user_data_to_plugin_.erase(found);
+}
+
+bool PluginVarTracker::IsPluginImplementedObjectAlive(void* user_data) {
+  return user_data_to_plugin_.find(user_data) != user_data_to_plugin_.end();
+}
+
+bool PluginVarTracker::ValidatePluginObjectCall(
+    const PPP_Class_Deprecated* ppp_class,
+    void* user_data) {
+  UserDataToPluginImplementedVarMap::iterator found =
+      user_data_to_plugin_.find(user_data);
+  if (found == user_data_to_plugin_.end())
+    return false;
+  return found->second.ppp_class == ppp_class;
+}
+
 int32 PluginVarTracker::AddVarInternal(Var* var, AddVarRefMode mode) {
   // Normal adding.
   int32 new_id = VarTracker::AddVarInternal(var, mode);
 
   // Need to add proxy objects to the host var map.
   ProxyObjectVar* proxy_object = var->AsProxyObjectVar();
   if (proxy_object) {
     HostVar host_var(proxy_object->dispatcher(), proxy_object->host_var_id());
     DCHECK(host_var_to_plugin_var_.find(host_var) ==
            host_var_to_plugin_var_.end());  // Adding an object twice, use
@@ skipping 25 matching lines @@
   ProxyObjectVar* object = iter->second.var->AsProxyObjectVar();
   if (!object) {
     NOTREACHED();
     return;
   }
 
   // Notify the host we're no longer holding our ref.
   DCHECK(iter->second.ref_count == 0);
   SendReleaseObjectMsg(*object);
 
+  UserDataToPluginImplementedVarMap::iterator found =
+      user_data_to_plugin_.find(object->user_data());
+  if (found != user_data_to_plugin_.end()) {
+    // This object is implemented in the plugin.
+    if (found->second.instance == 0) {
+      // Instance is destroyed. This means that we'll never get a Deallocate
+      // call from the renderer and we should do so now.
+      found->second.ppp_class->Deallocate(found->first);
+      user_data_to_plugin_.erase(found);
+    } else {
+      // The plugin is releasing its last reference to an object it implements.
+      // Clear the tracking data that links our "plugin implemented object" to
+      // the var. If the instance is destroyed and there is no ID, we know that
+      // we should just call Deallocate on the object data.
+      //
+      // See the plugin_object_id declaration for more info.
+      found->second.plugin_object_id = 0;
+    }
+  }
+
   // This will optionally delete the info from live_vars_.
   VarTracker::ObjectGettingZeroRef(iter);
 }
 
 bool PluginVarTracker::DeleteObjectInfoIfNecessary(VarMap::iterator iter) {
   // Get the info before calling the base class's version of this function,
   // which may delete the object.
   ProxyObjectVar* object = iter->second.var->AsProxyObjectVar();
   HostVar host_var(object->dispatcher(), object->host_var_id());
 
@@ skipping 52 matching lines @@
   VarMap::iterator ret = live_vars_.find(found->second);
   DCHECK(ret != live_vars_.end());
 
   // All objects should be proxy objects.
   DCHECK(ret->second.var->AsProxyObjectVar());
   return scoped_refptr<ProxyObjectVar>(ret->second.var->AsProxyObjectVar());
 }
 
 }  // namesace proxy
 }  // namespace ppapi