BrowserPlugin: Allow stack to unwind before denying permission.

content/browser/browser_plugin/browser_plugin_guest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 
 #include <algorithm>
 
 #include "base/message_loop/message_loop.h"
 #include "base/strings/string_util.h"
@@ skipping 45 matching lines @@
 namespace content {
 
 // static
 BrowserPluginHostFactory* BrowserPluginGuest::factory_ = NULL;
 
 // Parent class for the various types of permission requests, each of which
 // should be able to handle the response to their permission request.
 class BrowserPluginGuest::PermissionRequest :
     public base::RefCounted<BrowserPluginGuest::PermissionRequest> {
  public:
-  virtual void Respond(bool should_allow, const std::string& user_input) = 0;
+  void Respond(bool should_allow, const std::string& user_input) {
+    if (!guest_)
+      return;
+    RespondImpl(should_allow, user_input);
+  }
   virtual bool AllowedByDefault() const {
     return false;
   }
  protected:
-  PermissionRequest() {
+  explicit PermissionRequest(const base::WeakPtr<BrowserPluginGuest>& guest)
+      : guest_(guest) {
     RecordAction(
         base::UserMetricsAction("BrowserPlugin.Guest.PermissionRequest"));
   }
   virtual ~PermissionRequest() {}
+
+  virtual void RespondImpl(bool should_allow,
+                           const std::string& user_input) = 0;
   // Friend RefCounted so that the dtor can be non-public.
   friend class base::RefCounted<BrowserPluginGuest::PermissionRequest>;
+
+  base::WeakPtr<BrowserPluginGuest> guest_;
 };
 
 class BrowserPluginGuest::DownloadRequest : public PermissionRequest {
  public:
-  explicit DownloadRequest(base::Callback<void(bool)> callback)
-      : callback_(callback) {
+  DownloadRequest(const base::WeakPtr<BrowserPluginGuest>& guest,
+                  const base::Callback<void(bool)>& callback)
+      : PermissionRequest(guest),
+        callback_(callback) {
     RecordAction(
         base::UserMetricsAction("BrowserPlugin.Guest.PermissionRequest.Download"));
   }
-  virtual void Respond(bool should_allow,
-                       const std::string& user_input) OVERRIDE {
+  virtual void RespondImpl(bool should_allow,
+                           const std::string& user_input) OVERRIDE {
     callback_.Run(should_allow);
   }
 
  private:
   virtual ~DownloadRequest() {}
   base::Callback<void(bool)> callback_;
 };
 
 class BrowserPluginGuest::GeolocationRequest : public PermissionRequest {
  public:
-  GeolocationRequest(GeolocationCallback callback,
-                     int bridge_id,
-                     base::WeakPtrFactory<BrowserPluginGuest>* weak_ptr_factory)
-                     : callback_(callback),
-                       bridge_id_(bridge_id),
-                       weak_ptr_factory_(weak_ptr_factory) {
+  GeolocationRequest(const base::WeakPtr<BrowserPluginGuest>& guest,
+                     GeolocationCallback callback,
+                     int bridge_id)
+                     : PermissionRequest(guest),
+                       callback_(callback),
+                       bridge_id_(bridge_id) {
     RecordAction(
         base::UserMetricsAction("BrowserPlugin.Guest.PermissionRequest.Geolocation"));
   }
 
-  virtual void Respond(bool should_allow,
-                       const std::string& user_input) OVERRIDE {
-    base::WeakPtr<BrowserPluginGuest> guest(weak_ptr_factory_->GetWeakPtr());
-
-    WebContents* web_contents = guest->embedder_web_contents();
+  virtual void RespondImpl(bool should_allow,
+                           const std::string& user_input) OVERRIDE {
+    WebContents* web_contents = guest_->embedder_web_contents();
     if (should_allow && web_contents) {
       // If renderer side embedder decides to allow gelocation, we need to check
       // if the app/embedder itself has geolocation access.
       BrowserContext* browser_context = web_contents->GetBrowserContext();
       if (browser_context) {
         GeolocationPermissionContext* geolocation_context =
             browser_context->GetGeolocationPermissionContext();
         if (geolocation_context) {
           base::Callback<void(bool)> geolocation_callback = base::Bind(
               &BrowserPluginGuest::SetGeolocationPermission,
-              guest,
+              guest_,
               callback_,
               bridge_id_);
           geolocation_context->RequestGeolocationPermission(
               web_contents->GetRenderProcessHost()->GetID(),
               web_contents->GetRoutingID(),
               // The geolocation permission request here is not initiated
               // through WebGeolocationPermissionRequest. We are only interested
               // in the fact whether the embedder/app has geolocation
               // permission. Therefore we use an invalid |bridge_id|.
               -1 /* bridge_id */,
               web_contents->GetLastCommittedURL(),
               geolocation_callback);
           return;
         }
       }
     }
-    guest->SetGeolocationPermission(callback_, bridge_id_, false);
+    guest_->SetGeolocationPermission(callback_, bridge_id_, false);
   }
 
  private:
   virtual ~GeolocationRequest() {}
   base::Callback<void(bool)> callback_;
   int bridge_id_;
-  base::WeakPtrFactory<BrowserPluginGuest>* weak_ptr_factory_;
 };
 
 class BrowserPluginGuest::MediaRequest : public PermissionRequest {
  public:
-  MediaRequest(const MediaStreamRequest& request,
-               const MediaResponseCallback& callback,
-               BrowserPluginGuest* guest)
-               : request_(request),
-                 callback_(callback),
-                 guest_(guest) {
+  MediaRequest(const base::WeakPtr<BrowserPluginGuest>& guest,
+               const MediaStreamRequest& request,
+               const MediaResponseCallback& callback)
+               : PermissionRequest(guest),
+                 request_(request),
+                 callback_(callback) {
     RecordAction(
         base::UserMetricsAction("BrowserPlugin.Guest.PermissionRequest.Media"));
   }
 
-  virtual void Respond(bool should_allow,
-                       const std::string& user_input) OVERRIDE {
+  virtual void RespondImpl(bool should_allow,
+                           const std::string& user_input) OVERRIDE {
     WebContentsImpl* web_contents = guest_->embedder_web_contents();
     if (should_allow && web_contents) {
       // Re-route the request to the embedder's WebContents; the guest gets the
       // permission this way.
       web_contents->RequestMediaAccessPermission(request_, callback_);
     } else {
       // Deny the request.
       callback_.Run(MediaStreamDevices(), scoped_ptr<MediaStreamUI>());
     }
   }
 
  private:
   virtual ~MediaRequest() {}
   MediaStreamRequest request_;
   MediaResponseCallback callback_;
-  BrowserPluginGuest* guest_;
 };
 
 class BrowserPluginGuest::NewWindowRequest : public PermissionRequest {
  public:
-  NewWindowRequest(int instance_id, BrowserPluginGuest* guest)
-      : instance_id_(instance_id),
-        guest_(guest) {
+  NewWindowRequest(const base::WeakPtr<BrowserPluginGuest>& guest,
+                   int instance_id)
+      : PermissionRequest(guest),
+        instance_id_(instance_id) {
     RecordAction(
         base::UserMetricsAction("BrowserPlugin.Guest.PermissionRequest.NewWindow"));
   }
 
-  virtual void Respond(bool should_allow,
-                       const std::string& user_input) OVERRIDE {
+  virtual void RespondImpl(bool should_allow,
+                           const std::string& user_input) OVERRIDE {
     int embedder_render_process_id =
         guest_->embedder_web_contents()->GetRenderProcessHost()->GetID();
     BrowserPluginGuest* guest =
         guest_->GetWebContents()->GetBrowserPluginGuestManager()->
             GetGuestByInstanceID(instance_id_, embedder_render_process_id);
     if (!guest) {
       VLOG(0) << "Guest not found. Instance ID: " << instance_id_;
       return;
     }
 
     // If we do not destroy the guest then we allow the new window.
     if (!should_allow)
       guest->Destroy();
   }
 
  private:
   virtual ~NewWindowRequest() {}
   int instance_id_;
-  BrowserPluginGuest* guest_;
 };
 
 class BrowserPluginGuest::JavaScriptDialogRequest : public PermissionRequest {
  public:
-  JavaScriptDialogRequest(const DialogClosedCallback& callback)
-      : callback_(callback) {
+  JavaScriptDialogRequest(const base::WeakPtr<BrowserPluginGuest>& guest,
+                          const DialogClosedCallback& callback)
+      : PermissionRequest(guest),
+        callback_(callback) {
     RecordAction(
         base::UserMetricsAction("BrowserPlugin.Guest.PermissionRequest.JSDialog"));
   }
 
-  virtual void Respond(bool should_allow,
-                       const std::string& user_input) OVERRIDE {
+  virtual void RespondImpl(bool should_allow,
+                           const std::string& user_input) OVERRIDE {
     callback_.Run(should_allow, base::UTF8ToUTF16(user_input));
   }
 
  private:
   virtual ~JavaScriptDialogRequest() {}
   DialogClosedCallback callback_;
 };
 
 class BrowserPluginGuest::PointerLockRequest : public PermissionRequest {
  public:
-  PointerLockRequest(BrowserPluginGuest* guest)
-      : guest_(guest) {
+  explicit PointerLockRequest(const base::WeakPtr<BrowserPluginGuest>& guest)
+      : PermissionRequest(guest) {
     RecordAction(
         base::UserMetricsAction("BrowserPlugin.Guest.PermissionRequest.PointerLock"));
   }
 
-  virtual void Respond(bool should_allow,
-                       const std::string& user_input) OVERRIDE {
+  virtual void RespondImpl(bool should_allow,
+                           const std::string& user_input) OVERRIDE {
     guest_->SendMessageToEmbedder(
         new BrowserPluginMsg_SetMouseLock(guest_->instance_id(), should_allow));
   }
 
  private:
   virtual ~PointerLockRequest() {}
-  BrowserPluginGuest* guest_;
 };
 
 namespace {
 std::string WindowOpenDispositionToString(
   WindowOpenDisposition window_open_disposition) {
   switch (window_open_disposition) {
     case IGNORE_ACTION:
       return "ignore";
     case SAVE_TO_DISK:
       return "save_to_disk";
@@ skipping 159 matching lines @@
   }
   request_itr->second->Respond(should_allow, user_input);
   permission_request_map_.erase(request_itr);
 }
 
 int BrowserPluginGuest::RequestPermission(
     BrowserPluginPermissionType permission_type,
     scoped_refptr<BrowserPluginGuest::PermissionRequest> request,
     const base::DictionaryValue& request_info) {
   if (!delegate_) {
-    request->Respond(false, "");
+    // Let the stack unwind before we deny the permission request so that
+    // objects held by the permission request are not destroyed immediately
+    // after creation. This is to allow those same objects to be accessed again
+    // in the same scope without fear of use after freeing.
+    base::MessageLoop::current()->PostTask(
+        FROM_HERE,
+        base::Bind(&BrowserPluginGuest::PermissionRequest::Respond,
+                   request, false, ""));
     return browser_plugin::kInvalidPermissionRequestID;
   }
 
   int request_id = ++next_permission_request_id_;
   permission_request_map_[request_id] = request;
 
   BrowserPluginGuestDelegate::PermissionResponseCallback callback =
       base::Bind(&BrowserPluginGuest::RespondToPermissionRequest,
                   AsWeakPtr(),
                   request_id);
@@ skipping 503 matching lines @@
                    base::Value::CreateStringValue(new_window_info.url.spec()));
   request_info.Set(browser_plugin::kName,
                    base::Value::CreateStringValue(new_window_info.name));
   request_info.Set(browser_plugin::kWindowID,
                    base::Value::CreateIntegerValue(guest->instance_id()));
   request_info.Set(browser_plugin::kWindowOpenDisposition,
                    base::Value::CreateStringValue(
                        WindowOpenDispositionToString(disposition)));
 
   RequestPermission(BROWSER_PLUGIN_PERMISSION_TYPE_NEW_WINDOW,
-                    new NewWindowRequest(guest->instance_id(), this),
+                    new NewWindowRequest(weak_ptr_factory_.GetWeakPtr(),
+                                         guest->instance_id()),
                     request_info);
 }
 
 bool BrowserPluginGuest::UnlockMouseIfNecessary(
     const NativeWebKeyboardEvent& event) {
   if (!mouse_locked_)
     return false;
 
   embedder_web_contents()->GotResponseToLockMouseRequest(false);
   return true;
@@ skipping 44 matching lines @@
 void BrowserPluginGuest::AskEmbedderForGeolocationPermission(
     int bridge_id,
     const GURL& requesting_frame,
     const GeolocationCallback& callback) {
   base::DictionaryValue request_info;
   request_info.Set(browser_plugin::kURL,
                    base::Value::CreateStringValue(requesting_frame.spec()));
 
   int request_id =
       RequestPermission(BROWSER_PLUGIN_PERMISSION_TYPE_GEOLOCATION,
-                        new GeolocationRequest(
-                            callback, bridge_id, &weak_ptr_factory_),
+                        new GeolocationRequest(weak_ptr_factory_.GetWeakPtr(),
+                                               callback,
+                                               bridge_id),
                         request_info);
 
   DCHECK(bridge_id_to_request_id_map_.find(bridge_id) ==
          bridge_id_to_request_id_map_.end());
   bridge_id_to_request_id_map_[bridge_id] = request_id;
 }
 
 int BrowserPluginGuest::RemoveBridgeID(int bridge_id) {
   std::map<int, int>::iterator bridge_itr =
       bridge_id_to_request_id_map_.find(bridge_id);
@@ skipping 377 matching lines @@
   base::DictionaryValue request_info;
   request_info.Set(browser_plugin::kUserGesture,
                    base::Value::CreateBooleanValue(user_gesture));
   request_info.Set(browser_plugin::kLastUnlockedBySelf,
                    base::Value::CreateBooleanValue(last_unlocked_by_target));
   request_info.Set(browser_plugin::kURL,
                    base::Value::CreateStringValue(
                        web_contents()->GetLastCommittedURL().spec()));
 
   RequestPermission(BROWSER_PLUGIN_PERMISSION_TYPE_POINTER_LOCK,
-                    new PointerLockRequest(this),
+                    new PointerLockRequest(weak_ptr_factory_.GetWeakPtr()),
                     request_info);
 }
 
 void BrowserPluginGuest::OnLockMouseAck(int instance_id, bool succeeded) {
   Send(new ViewMsg_LockMouse_ACK(routing_id(), succeeded));
   pending_lock_request_ = false;
   if (succeeded)
     mouse_locked_ = true;
 }
 
@@ skipping 259 matching lines @@
 void BrowserPluginGuest::RequestMediaAccessPermission(
     WebContents* web_contents,
     const MediaStreamRequest& request,
     const MediaResponseCallback& callback) {
   base::DictionaryValue request_info;
   request_info.Set(
       browser_plugin::kURL,
       base::Value::CreateStringValue(request.security_origin.spec()));
 
   RequestPermission(BROWSER_PLUGIN_PERMISSION_TYPE_MEDIA,
-                    new MediaRequest(request, callback, this),
+                    new MediaRequest(weak_ptr_factory_.GetWeakPtr(),
+                                     request,
+                                     callback),
                     request_info);
 }
 
 void BrowserPluginGuest::RunJavaScriptDialog(
     WebContents* web_contents,
     const GURL& origin_url,
     const std::string& accept_lang,
     JavaScriptMessageType javascript_message_type,
     const base::string16& message_text,
     const base::string16& default_prompt_text,
     const DialogClosedCallback& callback,
     bool* did_suppress_message) {
   base::DictionaryValue request_info;
   request_info.Set(
       browser_plugin::kDefaultPromptText,
       base::Value::CreateStringValue(base::UTF16ToUTF8(default_prompt_text)));
   request_info.Set(
       browser_plugin::kMessageText,
       base::Value::CreateStringValue(base::UTF16ToUTF8(message_text)));
   request_info.Set(
       browser_plugin::kMessageType,
       base::Value::CreateStringValue(
           JavaScriptMessageTypeToString(javascript_message_type)));
   request_info.Set(
       browser_plugin::kURL,
       base::Value::CreateStringValue(origin_url.spec()));
 
   RequestPermission(BROWSER_PLUGIN_PERMISSION_TYPE_JAVASCRIPT_DIALOG,
-                    new JavaScriptDialogRequest(callback),
+                    new JavaScriptDialogRequest(weak_ptr_factory_.GetWeakPtr(),
+                                                callback),
                     request_info);
 }
 
 void BrowserPluginGuest::RunBeforeUnloadDialog(
     WebContents* web_contents,
     const base::string16& message_text,
     bool is_reload,
     const DialogClosedCallback& callback) {
   // This is called if the guest has a beforeunload event handler.
   // This callback allows navigation to proceed.
@@ skipping 109 matching lines @@
     callback.Run(false);
     return;
   }
 
   base::DictionaryValue request_info;
   request_info.Set(browser_plugin::kRequestMethod,
                    base::Value::CreateStringValue(request_method));
   request_info.Set(browser_plugin::kURL, base::Value::CreateStringValue(url));
 
   RequestPermission(BROWSER_PLUGIN_PERMISSION_TYPE_DOWNLOAD,
-                    new DownloadRequest(callback),
+                    new DownloadRequest(weak_ptr_factory_.GetWeakPtr(),
+                                        callback),
                     request_info);
 }
 
 }  // namespace content