Make WebURLLoader capable of retaining received buffers.

content/child/resource_dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/child/resource_dispatcher.h"
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/debug/alias.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/files/file_path.h"
 #include "base/memory/shared_memory.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/string_util.h"
 #include "content/child/request_extra_data.h"
 #include "content/child/request_info.h"
+#include "content/child/shared_memory_received_data_factory.h"
 #include "content/child/site_isolation_policy.h"
 #include "content/child/sync_load_response.h"
 #include "content/child/threaded_data_provider.h"
 #include "content/common/inter_process_time_ticks_converter.h"
 #include "content/common/resource_messages.h"
 #include "content/public/child/request_peer.h"
 #include "content/public/child/resource_dispatcher_delegate.h"
 #include "content/public/common/resource_response.h"
 #include "content/public/common/resource_type.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_response_headers.h"
 
 namespace content {
 
 namespace {
 
+class StringReceivedData final : public RequestPeer::ReceivedData {
+ public:
+  explicit StringReceivedData(scoped_ptr<std::string> string)
+      : string_(string.Pass()) {}
+
+  const char* payload() const override { return string_->data(); }
+  int length() const override { return string_->size(); }
+  int encoded_length() const override { return string_->size(); }
+
+ private:
+  const scoped_ptr<std::string> string_;
+};
+
 // Converts |time| from a remote to local TimeTicks, overwriting the original
 // value.
 void RemoteToLocalTimeTicks(
     const InterProcessTimeTicksConverter& converter,
     base::TimeTicks* time) {
   RemoteTimeTicks remote_time = RemoteTimeTicks::FromTimeTicks(*time);
   *time = converter.ToLocalTimeTicks(remote_time).ToTimeTicks();
 }
 
 void CrashOnMapFailure() {
@@ skipping 135 matching lines @@
   TRACE_EVENT0("loader", "ResourceDispatcher::OnSetDataBuffer");
   PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
   if (!request_info)
     return;
 
   bool shm_valid = base::SharedMemory::IsHandleValid(shm_handle);
   CHECK((shm_valid && shm_size > 0) || (!shm_valid && !shm_size));
 
   request_info->buffer.reset(
       new base::SharedMemory(shm_handle, true));  // read only
+  request_info->received_data_factory =
+      make_scoped_refptr(new SharedMemoryReceivedDataFactory(
+          message_sender_, request_id, request_info->buffer));
 
   bool ok = request_info->buffer->Map(shm_size);
   if (!ok) {
     // Added to help debug crbug/160401.
     base::ProcessId renderer_pid_copy = renderer_pid;
     base::debug::Alias(&renderer_pid_copy);
 
     base::SharedMemoryHandle shm_handle_copy = shm_handle;
     base::debug::Alias(&shm_handle_copy);
 
@@ skipping 11 matching lines @@
   TRACE_EVENT0("loader", "ResourceDispatcher::OnReceivedData");
   DCHECK_GT(data_length, 0);
   PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
   bool send_ack = true;
   if (request_info && data_length > 0) {
     CHECK(base::SharedMemory::IsHandleValid(request_info->buffer->handle()));
     CHECK_GE(request_info->buffer_size, data_offset + data_length);
 
     // Ensure that the SHM buffer remains valid for the duration of this scope.
     // It is possible for Cancel() to be called before we exit this scope.
-    linked_ptr<base::SharedMemory> retain_buffer(request_info->buffer);
+    // SharedMemoryReceivedDataFactory stores the SHM buffer inside it.
+    scoped_refptr<SharedMemoryReceivedDataFactory> factory(
+        request_info->received_data_factory);
 
     base::TimeTicks time_start = base::TimeTicks::Now();
 
     const char* data_start = static_cast<char*>(request_info->buffer->memory());
     CHECK(data_start);
     CHECK(data_start + data_offset);
     const char* data_ptr = data_start + data_offset;
 
     // Check whether this response data is compliant with our cross-site
     // document blocking policy. We only do this for the first packet.
-    std::string alternative_data;
+    scoped_ptr<std::string> alternative_data;
     if (request_info->site_isolation_metadata.get()) {
-      request_info->blocked_response =
-          SiteIsolationPolicy::ShouldBlockResponse(
-              request_info->site_isolation_metadata, data_ptr, data_length,
-              &alternative_data);
+      alternative_data = make_scoped_ptr(new std::string);
+      request_info->blocked_response = SiteIsolationPolicy::ShouldBlockResponse(
+          request_info->site_isolation_metadata, data_ptr, data_length,
+          alternative_data.get());
       request_info->site_isolation_metadata.reset();
 
       // When the response is blocked we may have any alternative data to
-      // send to the renderer. When |alternative_data| is zero-sized, we do not
-      // call peer's callback.
-      if (request_info->blocked_response && !alternative_data.empty()) {
-        data_ptr = alternative_data.data();
-        data_length = alternative_data.size();
-        encoded_data_length = alternative_data.size();
+      // send to the renderer.
+      // When |alternative_data| is zero-sized, we do not call peer's callback.
+      if (alternative_data->empty())
+        alternative_data.reset();
+    }
+
+    if (!request_info->blocked_response || alternative_data) {
+      if (request_info->threaded_data_provider) {
+        // TODO(yhirano): Use |alternative_data| when it is not null.
+        // A threaded data provider will take care of its own ACKing, as the
+        // data may be processed later on another thread.

[tyoshino (SeeGerritForStatus), 2015/05/27 04:32:08]

write the reason why we can stop using alternative_data temporary in the CL
description

[yhirano, 2015/05/27 04:51:37]

Done. Note that I don't break a working code here: If |alternative_data| is used
with |threaded_data_provider|, it leads to a UAF.

+        send_ack = false;
+        request_info->threaded_data_provider->OnReceivedDataOnForegroundThread(
+            data_ptr, data_length, encoded_data_length);
+      } else {
+        scoped_ptr<RequestPeer::ReceivedData> data;
+        if (alternative_data) {
+          data =
+              make_scoped_ptr(new StringReceivedData(alternative_data.Pass()));
+        } else {
+          data = factory->Create(data_offset, data_length, encoded_data_length);
+          // |data| takes care of ACKing.
+          send_ack = false;
+        }
+        if (data)

[tyoshino (SeeGerritForStatus), 2015/05/27 04:32:08]

Can data be null?

[yhirano, 2015/05/27 04:51:37]

Done.

+          request_info->peer->OnReceivedData(data.Pass());
       }
     }
 
-    if (!request_info->blocked_response || !alternative_data.empty()) {
-      if (request_info->threaded_data_provider) {
-        request_info->threaded_data_provider->OnReceivedDataOnForegroundThread(
-            data_ptr, data_length, encoded_data_length);
-        // A threaded data provider will take care of its own ACKing, as the
-        // data may be processed later on another thread.
-        send_ack = false;
-      } else {
-        request_info->peer->OnReceivedData(
-            data_ptr, data_length, encoded_data_length);
-      }
-    }
-
     UMA_HISTOGRAM_TIMES("ResourceDispatcher.OnReceivedDataTime",
                         base::TimeTicks::Now() - time_start);
   }
 
   // Acknowledge the reception of this data.
   if (send_ack)
     message_sender_->Send(new ResourceHostMsg_DataReceived_ACK(request_id));
 }
 
 void ResourceDispatcher::OnDownloadedData(int request_id,
@@ skipping 52 matching lines @@
 void ResourceDispatcher::OnRequestComplete(
     int request_id,
     const ResourceMsg_RequestCompleteData& request_complete_data) {
   TRACE_EVENT0("loader", "ResourceDispatcher::OnRequestComplete");
 
   PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
   if (!request_info)
     return;
   request_info->completion_time = ConsumeIOTimestamp();
   request_info->buffer.reset();
+  if (request_info->received_data_factory)
+    request_info->received_data_factory->Stop();
+  request_info->received_data_factory = nullptr;
   request_info->buffer_size = 0;
 
   RequestPeer* peer = request_info->peer;
 
   if (delegate_) {
     RequestPeer* new_peer =
         delegate_->OnRequestComplete(
             request_info->peer, request_info->resource_type,
             request_complete_data.error_code);
     if (new_peer)
@@ skipping 446 matching lines @@
       extra_data->transferred_request_request_id();
   request->service_worker_provider_id =
       extra_data->service_worker_provider_id();
   request->request_body = request_body;
   if (frame_origin)
     *frame_origin = extra_data->frame_origin();
   return request.Pass();
 }
 
 }  // namespace content