On Posix, make all child processes quit when the browser dies, not just the renderers.

content/common/child_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/child_thread.h"
 
 #include "base/allocator/allocator_extension.h"
 #include "base/command_line.h"
 #include "base/message_loop.h"
 #include "base/process.h"
@@ skipping 14 matching lines @@
 #include "ipc/ipc_sync_message_filter.h"
 #include "webkit/glue/webkit_glue.h"
 
 #if defined(OS_WIN)
 #include "content/common/handle_enumerator_win.h"
 #endif
 
 using content::ResourceDispatcher;
 using tracked_objects::ThreadData;
 
+namespace {
+
+#if defined(OS_POSIX)
+
+class SuicideOnChannelErrorFilter : public IPC::ChannelProxy::MessageFilter {
+ public:
+  // IPC::ChannelProxy::MessageFilter
+  virtual void OnChannelError() OVERRIDE {
+    // For renderer/worker processes:
+    // On POSIX, at least, one can install an unload handler which loops
+    // forever and leave behind a renderer process which eats 100% CPU forever.
+    //
+    // This is because the terminate signals (ViewMsg_ShouldClose and the error
+    // from the IPC channel) are routed to the main message loop but never
+    // processed (because that message loop is stuck in V8).
+    //
+    // One could make the browser SIGKILL the renderers, but that leaves open a
+    // large window where a browser failure (or a user, manually terminating
+    // the browser because "it's stuck") will leave behind a process eating all
+    // the CPU.
+    //
+    // So, we install a filter on the channel so that we can process this event
+    // here and kill the process.
+    //
+    // We want to kill this process after giving it 30 seconds to run the exit
+    // handlers. SIGALRM has a default disposition of terminating the
+    // application.
+    if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kChildCleanExit))
+      alarm(30);
+    else
+      _exit(0);
+  }
+
+ protected:
+  virtual ~SuicideOnChannelErrorFilter() {}
+};
+
+#endif  // OS(POSIX)
+
+}  // namespace
+
 ChildThread::ChildThread() {
   channel_name_ = CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
       switches::kProcessChannelID);
   Init();
 }
 
 ChildThread::ChildThread(const std::string& channel_name)
     : channel_name_(channel_name) {
   Init();
 }
@@ skipping 14 matching lines @@
   file_system_dispatcher_.reset(new FileSystemDispatcher());
   quota_dispatcher_.reset(new QuotaDispatcher());
 
   sync_message_filter_ =
       new IPC::SyncMessageFilter(ChildProcess::current()->GetShutDownEvent());
   histogram_message_filter_ = new content::ChildHistogramMessageFilter();
 
   channel_->AddFilter(histogram_message_filter_.get());
   channel_->AddFilter(sync_message_filter_.get());
   channel_->AddFilter(new ChildTraceMessageFilter());
+
+#if defined(OS_POSIX)
+  // Check that --process-type is specified so we don't do this in unit tests
+  // and single-process mode.
+  if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kProcessType))
+    channel_->AddFilter(new SuicideOnChannelErrorFilter());
+#endif
 }
 
 ChildThread::~ChildThread() {
 #ifdef IPC_MESSAGE_LOG_ENABLED
   IPC::Logging::GetInstance()->SetIPCSender(NULL);
 #endif
 
   channel_->RemoveFilter(histogram_message_filter_.get());
   channel_->RemoveFilter(sync_message_filter_.get());
 
@@ skipping 198 matching lines @@
   }
 
   // The child process shutdown sequence is a request response based mechanism,
   // where we send out an initial feeler request to the child process host
   // instance in the browser to verify if it's ok to shutdown the child process.
   // The browser then sends back a response if it's ok to shutdown. This avoids
   // race conditions if the process refcount is 0 but there's an IPC message
   // inflight that would addref it.
   Send(new ChildProcessHostMsg_ShutdownRequest);
 }