Support DirectWrite with sandbox on

content/renderer/renderer_main_platform_delegate_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/renderer_main_platform_delegate.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string16.h"
+#include "base/win/scoped_comptr.h"
 #include "base/win/win_util.h"
+#include "base/win/windows_version.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/injection_test_win.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/renderer/render_thread_impl.h"
 #include "sandbox/win/src/sandbox.h"
 #include "skia/ext/vector_platform_device_emf_win.h"
 #include "third_party/icu/source/i18n/unicode/timezone.h"
 #include "third_party/skia/include/ports/SkTypeface_win.h"
 
 #ifdef ENABLE_VTUNE_JIT_INTERFACE
 #include "v8/src/third_party/vtune/v8-vtune.h"
 #endif
 
+#include <dwrite.h>
+
 namespace content {
 namespace {
 
 // Windows-only skia sandbox support
+// These are used for GDI-path rendering.
 void SkiaPreCacheFont(const LOGFONT& logfont) {
   RenderThread* render_thread = RenderThread::Get();
   if (render_thread) {
     render_thread->PreCacheFont(logfont);
   }
 }
 
 void SkiaPreCacheFontCharacters(const LOGFONT& logfont,
                                 const wchar_t* text,
                                 unsigned int text_length) {
   RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
   if (render_thread_impl) {
     render_thread_impl->PreCacheFontCharacters(
         logfont,
         base::string16(text, text_length));
   }
 }
 
+// Windows-only DirectWrite support. These warm up the DirectWrite paths
+// before sandbox lock down to allow Skia access to font data.

[jschuh, 2014/03/25 04:03:48]

Nit: s/font data/the Font Manager service/

[scottmg, 2014/03/25 05:43:18]

Done.

+bool CreateDirectWriteFactory(IDWriteFactory** factory) {
+  typedef decltype(DWriteCreateFactory) * DWriteCreateFactoryProc;

[jschuh, 2014/03/25 04:03:48]

Nit: loose *

[scottmg, 2014/03/25 05:43:18]

clang-format. But Done.

[jschuh, 2014/03/25 12:42:02]

Yep, I've been bitten by clang-format repeatedly on template formatting. You
should file a bug with the Build-Tools flag against nick@chromium.org.

+  DWriteCreateFactoryProc dwrite_create_factory_proc =
+      reinterpret_cast<DWriteCreateFactoryProc>(
+          GetProcAddress(LoadLibraryW(L"dwrite.dll"), "DWriteCreateFactory"));
+  if (!dwrite_create_factory_proc)
+    return false;
+  CHECK(SUCCEEDED(
+      dwrite_create_factory_proc(DWRITE_FACTORY_TYPE_SHARED,
+                                 __uuidof(IDWriteFactory),
+                                 reinterpret_cast<IUnknown**>(factory))));
+  return true;
+}
+
+void WarmupDirectWrite() {
+  if (base::win::GetVersion() < base::win::VERSION_VISTA)
+    return;
+
+  base::win::ScopedComPtr<IDWriteFactory> factory;
+  if (!CreateDirectWriteFactory(factory.Receive()))
+    return;
+
+  base::win::ScopedComPtr<IDWriteFontCollection> font_collection;
+  CHECK(SUCCEEDED(
+      factory->GetSystemFontCollection(font_collection.Receive(), FALSE)));
+  base::win::ScopedComPtr<IDWriteFontFamily> font_family;
+
+  UINT32 index;
+  BOOL exists;
+  CHECK(SUCCEEDED(
+      font_collection->FindFamilyName(L"Times New Roman", &index, &exists)));
+  CHECK(exists);
+  CHECK(
+      SUCCEEDED(font_collection->GetFontFamily(index, font_family.Receive())));
+  const DWRITE_FONT_WEIGHT weights[] = {DWRITE_FONT_WEIGHT_NORMAL,
+                                        DWRITE_FONT_WEIGHT_BOLD};
+  base::win::ScopedComPtr<IDWriteFont> fonts[ARRAYSIZE(weights)];
+  base::win::ScopedComPtr<IDWriteFontFace> font_faces[ARRAYSIZE(weights)];
+  for (size_t i = 0; i < ARRAYSIZE(weights); ++i) {

[jschuh, 2014/03/25 04:03:48]

Do you really needed to enumerate through the weights, but just for one font?

[scottmg, 2014/03/25 05:43:18]

Oops, thanks, probably not any more. Done. I'll re-confirm on the various OS
levels.

+    CHECK(
+        SUCCEEDED(font_family->GetFirstMatchingFont(weights[i],
+                                                    DWRITE_FONT_STRETCH_NORMAL,
+                                                    DWRITE_FONT_STYLE_NORMAL,
+                                                    fonts[i].Receive())));
+    CHECK(SUCCEEDED(fonts[i]->CreateFontFace(font_faces[i].Receive())));
+    DWRITE_GLYPH_METRICS gm;
+    UINT16 glyph = L'S';
+    CHECK(SUCCEEDED(font_faces[i]->GetDesignGlyphMetrics(&glyph, 1, &gm)));
+  }
+}
+
 }  // namespace
 
 RendererMainPlatformDelegate::RendererMainPlatformDelegate(
     const MainFunctionParams& parameters)
         : parameters_(parameters),
           sandbox_test_module_(NULL) {
 }
 
 RendererMainPlatformDelegate::~RendererMainPlatformDelegate() {
 }
@@ skipping 11 matching lines @@
   bool no_sandbox = command_line.HasSwitch(switches::kNoSandbox);
 
   if (!no_sandbox) {
     // ICU DateFormat class (used in base/time_format.cc) needs to get the
     // Olson timezone ID by accessing the registry keys under
     // HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones.
     // After TimeZone::createDefault is called once here, the timezone ID is
     // cached and there's no more need to access the registry. If the sandbox
     // is disabled, we don't have to make this dummy call.
     scoped_ptr<icu::TimeZone> zone(icu::TimeZone::createDefault());
     SkTypeface_SetEnsureLOGFONTAccessibleProc(SkiaPreCacheFont);

[jschuh, 2014/03/25 04:03:48]

You'll need to disable the GDI setup and both ends of the FontCacheDispatcher
depending on whether DW is enabled.

[scottmg, 2014/03/25 05:43:18]

At the moment, the about:flag isn't conditionalized in any way, and Blink
decides (on a per-renderer basis, in theory) whether it wants to use DW or GDI.
In practice, it just tries to create a DW Skia FontMgr and if that fails it
falls back to GDI.
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

So... that's why I didn't do that here.

I guess to only enable one of either GDI or DW here, we could:
- move the equivalent of the Blink fallback code to somewhere in content/common
- update the command line near StartSandboxedProcess (i.e. remove
--enable-direct-write if it's unavailable) 
- make Blink CHECK if it can't create the expected font manager rather than fall
back (as it needs to match this side to work anyway)

Sound OK?

[jschuh, 2014/03/25 12:42:02]

Yeah, that works. As long as the browser makes the decision and the renderer
just does what it's told I'm happy on the security front.

     skia::SetSkiaEnsureTypefaceCharactersAccessible(
         SkiaPreCacheFontCharacters);
+
+    WarmupDirectWrite();

[jschuh, 2014/03/25 04:03:48]

This should be scoped to run only when DW is enabled.

   }
 }
 
 void RendererMainPlatformDelegate::PlatformUninitialize() {
 }
 
 bool RendererMainPlatformDelegate::InitSandboxTests(bool no_sandbox) {
   const CommandLine& command_line = parameters_.command_line;
 
   DVLOG(1) << "Started renderer with " << command_line.GetCommandLineString();
@@ skipping 42 matching lines @@
     if (run_security_tests) {
       int test_count = 0;
       DVLOG(1) << "Running renderer security tests";
       BOOL result = run_security_tests(&test_count);
       CHECK(result) << "Test number " << test_count << " has failed.";
     }
   }
 }
 
 }  // namespace content