Crash on nested IPC handlers in PrintWebViewHelper

components/printing/renderer/print_web_view_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/printing/renderer/print_web_view_helper.h"
 
 #include <string>
 
 #include "base/auto_reset.h"
 #include "base/json/json_writer.h"
@@ skipping 797 matching lines @@
       reset_prep_frame_view_(false),
       is_print_ready_metafile_sent_(false),
       ignore_css_margins_(false),
       is_scripted_printing_blocked_(false),
       notify_browser_of_print_failure_(true),
       print_for_preview_(false),
       delegate_(delegate.Pass()),
       print_node_in_progress_(false),
       is_loading_(false),
       is_scripted_preview_delayed_(false),
+      ipc_nesting_level_(0),
       weak_ptr_factory_(this) {
   if (!delegate_->IsPrintPreviewEnabled())
     DisablePreview();
 }
 
 PrintWebViewHelper::~PrintWebViewHelper() {
 }
 
 // static
 void PrintWebViewHelper::DisablePreview() {
@@ skipping 43 matching lines @@
 
   if (!g_is_preview_enabled_) {
     Print(frame, blink::WebNode(), true);
   } else {
     print_preview_context_.InitWithFrame(frame);
     RequestPrintPreview(PRINT_PREVIEW_SCRIPTED);
   }
 }
 
 bool PrintWebViewHelper::OnMessageReceived(const IPC::Message& message) {
+  // The class is not designed to handle recursive messages. This is not
+  // expected during regular flow. However, during rendering of content for
+  // printing, lower level code may run nested message loop. E.g. PDF may has
+  // script to show message box http://crbug.com/502562. In that moment browser

[Vitaly Buka (NO REVIEWS), 2015/07/09 05:54:33]

Added explanation.

+  // may receive updated printer capabilities and decide to restart print
+  // preview generation.
+  // When this happened message handling function may choose to ignore message
+  // or safely crash process.
+  ++ipc_nesting_level_;
+
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(PrintWebViewHelper, message)
 #if defined(ENABLE_BASIC_PRINTING)
     IPC_MESSAGE_HANDLER(PrintMsg_PrintPages, OnPrintPages)
     IPC_MESSAGE_HANDLER(PrintMsg_PrintForSystemDialog, OnPrintForSystemDialog)
 #endif  // ENABLE_BASIC_PRINTING
     IPC_MESSAGE_HANDLER(PrintMsg_InitiatePrintPreview, OnInitiatePrintPreview)
     IPC_MESSAGE_HANDLER(PrintMsg_PrintPreview, OnPrintPreview)
     IPC_MESSAGE_HANDLER(PrintMsg_PrintForPrintPreview, OnPrintForPrintPreview)
     IPC_MESSAGE_HANDLER(PrintMsg_PrintingDone, OnPrintingDone)
     IPC_MESSAGE_HANDLER(PrintMsg_SetScriptedPrintingBlocked,
                         SetScriptedPrintBlocked)
     IPC_MESSAGE_UNHANDLED(handled = false)
-    IPC_END_MESSAGE_MAP()
+  IPC_END_MESSAGE_MAP()
+
+  --ipc_nesting_level_;
   return handled;
 }
 
 void PrintWebViewHelper::OnPrintForPrintPreview(
     const base::DictionaryValue& job_settings) {
+  CHECK_LE(ipc_nesting_level_, 1);
   // If still not finished with earlier print request simply ignore.
   if (prep_frame_view_)
     return;
 
   if (!render_view()->GetWebView())
     return;
   blink::WebFrame* main_frame = render_view()->GetWebView()->mainFrame();
   if (!main_frame)
     return;
 
@@ skipping 61 matching lines @@
   blink::WebLocalFrame* focusedFrame =
       webView->focusedFrame()->toWebLocalFrame();
   *frame = focusedFrame->hasSelection()
                ? focusedFrame
                : webView->mainFrame()->toWebLocalFrame();
   return true;
 }
 
 #if defined(ENABLE_BASIC_PRINTING)
 void PrintWebViewHelper::OnPrintPages() {
+  CHECK_LE(ipc_nesting_level_, 1);
   blink::WebLocalFrame* frame;
   if (!GetPrintFrame(&frame))
     return;
   // If we are printing a PDF extension frame, find the plugin node and print
   // that instead.
   auto plugin = delegate_->GetPdfElement(frame);
   Print(frame, plugin, false);
 }
 
 void PrintWebViewHelper::OnPrintForSystemDialog() {
+  CHECK_LE(ipc_nesting_level_, 1);
   blink::WebLocalFrame* frame = print_preview_context_.source_frame();
   if (!frame) {
     NOTREACHED();
     return;
   }
   Print(frame, print_preview_context_.source_node(), false);
 }
 #endif  // ENABLE_BASIC_PRINTING
 
 void PrintWebViewHelper::GetPageSizeAndContentAreaFromPageLayout(
@@ skipping 21 matching lines @@
 
 bool PrintWebViewHelper::IsPrintToPdfRequested(
     const base::DictionaryValue& job_settings) {
   bool print_to_pdf = false;
   if (!job_settings.GetBoolean(kSettingPrintToPDF, &print_to_pdf))
     NOTREACHED();
   return print_to_pdf;
 }
 
 void PrintWebViewHelper::OnPrintPreview(const base::DictionaryValue& settings) {
+  CHECK_LE(ipc_nesting_level_, 1);
+
   print_preview_context_.OnPrintPreview();
 
   UMA_HISTOGRAM_ENUMERATION("PrintPreview.PreviewEvent",
                             PREVIEW_EVENT_REQUESTED, PREVIEW_EVENT_MAX);
 
   if (!print_preview_context_.source_frame()) {
     DidFinishPrinting(FAIL_PREVIEW);
     return;
   }
 
@@ skipping 168 matching lines @@
     print_preview_context_.set_error(PREVIEW_ERROR_METAFILE_COPY_FAILED);
     return false;
   }
   is_print_ready_metafile_sent_ = true;
 
   Send(new PrintHostMsg_MetafileReadyForPrinting(routing_id(), preview_params));
   return true;
 }
 
 void PrintWebViewHelper::OnPrintingDone(bool success) {
+  CHECK_LE(ipc_nesting_level_, 1);
   notify_browser_of_print_failure_ = false;
   if (!success)
     LOG(ERROR) << "Failure in OnPrintingDone";
   DidFinishPrinting(success ? OK : FAIL_PRINT);
 }
 
 void PrintWebViewHelper::SetScriptedPrintBlocked(bool blocked) {
   is_scripted_printing_blocked_ = blocked;
 }
 
 void PrintWebViewHelper::OnInitiatePrintPreview(bool selection_only) {
+  CHECK_LE(ipc_nesting_level_, 1);
   blink::WebLocalFrame* frame = NULL;
   GetPrintFrame(&frame);
   DCHECK(frame);
   // If we are printing a PDF extension frame, find the plugin node and print
   // that instead.
   auto plugin = delegate_->GetPdfElement(frame);
   if (!plugin.isNull()) {
     PrintNode(plugin);
     return;
   }
@@ skipping 837 matching lines @@
       blink::WebConsoleMessage::LevelWarning, message));
   return false;
 }
 
 void PrintWebViewHelper::ScriptingThrottler::Reset() {
   // Reset counter on successful print.
   count_ = 0;
 }
 
 }  // namespace printing