Prevent markContainerChainForLayout to scheduleRelayout() if isInPerformLayout()

third_party/WebKit/Source/core/frame/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 1763 matching lines @@
             continue;
         }
         LayoutState layoutState(*root);
         root->layout();
     }
 }
 
 void FrameView::scheduleRelayout()
 {
     ASSERT(m_frame->view() == this);
+    RELEASE_ASSERT(!isInPerformLayout());

[kojii, 2016/04/22 05:29:05]

The critical error is to modify m_layoutSubtreeRootList (such as
clearLayoutSubtreeRootsAndMarkContainingBlocks()) while we're iterating it in:
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...
but we need to clear it after the iteration, so we can't assert in
DepthOrderedLayoutObjectList::clear().
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

RELEASE_ASSERT here is the lowest place where we can turn security issues to
crashes.

 
     if (!m_layoutSchedulingEnabled)
         return;
     if (!needsLayout())
         return;
     if (!m_frame->document()->shouldScheduleLayout())
         return;
     TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "InvalidateLayout", TRACE_EVENT_SCOPE_THREAD, "data", InspectorInvalidateLayoutEvent::data(m_frame.get()));
 
     clearLayoutSubtreeRootsAndMarkContainingBlocks();
 
     if (m_hasPendingLayout)
         return;
     m_hasPendingLayout = true;
 
     if (!shouldThrottleRendering())
         page()->animator().scheduleVisualUpdate(m_frame.get());
 }
 
 void FrameView::scheduleRelayoutOfSubtree(LayoutObject* relayoutRoot)
 {
     ASSERT(m_frame->view() == this);
+    RELEASE_ASSERT(!isInPerformLayout());
 
     // FIXME: Should this call shouldScheduleLayout instead?
     if (!m_frame->document()->isActive())
         return;
 
     LayoutView* layoutView = this->layoutView();
     if (layoutView && layoutView->needsLayout()) {
         if (relayoutRoot)
             relayoutRoot->markContainerChainForLayout(false);
         return;
@@ skipping 2244 matching lines @@
     return m_hiddenForThrottling && m_crossOriginForThrottling;
 }
 
 LayoutBox& FrameView::boxForScrollControlPaintInvalidation() const
 {
     ASSERT(layoutView());
     return *layoutView();
 }
 
 } // namespace blink