Remove NPChannelBase from cache on error.

Normal channel shutdown (as for navigation) goes via RemoveRoute(),
which removes the channel from the cache.  It looks like
OnChannelError() is expected to call RemoveRoute() at some point
during cleanup, but sometimes the channel is left in the cache and
re-vended (as measured by previous instrumentation).  Defensively
rename channels which see an error so that they aren't found in the
cache in the future.

BUG=97285
TEST=no user-visible change


Review URL: https://chromiumcodereview.appspot.com/10544075

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@141279 0039d316-1c4b-4281-b951-d872f2087c98

content/common/np_channel_base.cc

@@ -253,6 +253,20 @@ bool NPChannelBase::OnControlMessageReceived(const IPC::Message& msg) {
 
 void NPChannelBase::OnChannelError() {
   channel_valid_ = false;
+
+  // TODO(shess): http://crbug.com/97285
+  // Once an error is seen on a channel, remap the channel to prevent
+  // it from being vended again.  Keep the channel in the map so
+  // RemoveRoute() can clean things up correctly.
+  for (ChannelMap::iterator iter = g_channels.Get().begin();
+       iter != g_channels.Get().end(); ++iter) {
+    if (iter->second == this) {
+      // Insert new element before invalidating |iter|.
+      g_channels.Get()[iter->first + "-error"] = iter->second;
+      g_channels.Get().erase(iter);
+      break;
+    }
+  }
 }
 
 NPObject* NPChannelBase::GetExistingNPObjectProxy(int route_id) {