[LazyParseCSS] Ensure UseCounting has parity with strict parsing

third_party/WebKit/Source/core/css/parser/CSSLazyParsingState.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/parser/CSSLazyParsingState.h"
 #include "core/css/parser/CSSLazyPropertyParserImpl.h"
 #include "core/css/parser/CSSParserTokenRange.h"
+#include "core/dom/Document.h"
 #include "core/frame/UseCounter.h"
 #include "platform/Histogram.h"
 
 namespace blink {
 
 CSSLazyParsingState::CSSLazyParsingState(const CSSParserContext& context,
                                          Vector<String> escapedStrings,
                                          const String& sheetText,
                                          StyleSheetContents* contents)
     : m_context(context),
       m_escapedStrings(std::move(escapedStrings)),
       m_sheetText(sheetText),
       m_owningContents(contents),
       m_parsedStyleRules(0),
       m_totalStyleRules(0),
       m_styleRulesNeededForNextMilestone(0),
-      m_usage(UsageGe0) {
+      m_usage(UsageGe0),
+      m_shouldUseCount(!!m_context.useCounter()) {
   recordUsageMetrics();
 }
 
 CSSLazyPropertyParserImpl* CSSLazyParsingState::createLazyParser(
     const CSSParserTokenRange& block) {
   ++m_totalStyleRules;
   return new CSSLazyPropertyParserImpl(std::move(block), this);
 }
 
 const CSSParserContext& CSSLazyParsingState::context() {
   DCHECK(m_owningContents);
-  UseCounter* sheetCounter = UseCounter::getFrom(m_owningContents);
-  if (sheetCounter != m_context.useCounter())
-    m_context = CSSParserContext(m_context, sheetCounter);
+  if (!m_shouldUseCount) {
+    DCHECK(!m_context.useCounter());
+    return m_context;
+  }
+
+  // Try as best as possible to grab a valid UseCounter if the underlying
+  // document has gone away.
+  if (!m_document)
+    m_document = m_owningContents->anyOwnerDocument();
+
+  // Always refresh the UseCounter, as the Document can outlive its
+  // underlying frame host causing a use-after-free of m_context's counter.
+  UseCounter* useCounter = UseCounter::getFrom(m_document);

[rune, 2016/12/05 22:21:05]

If we always retrieve the UseCounter, could we simple just return
CSSParserContext(m_context, UseCounter::getFrom(m_document)) instead? Or would
that be more expensive?

[Charlie Harrison, 2016/12/05 22:27:59]

I don't have the trace now, but I remember seeing the context initialization in
profiles before. It isn't a ton, but we have do a KURL copy, a String copy, and
a Referrer copy. These mostly do things like bumping ref counts and copying
simple structs like url::Parsed, but I'd like to avoid it if possible to keep
overhead low and consistent.

[rune, 2016/12/05 22:31:53]

Acknowledged.

+  if (useCounter != m_context.useCounter())
+    m_context = CSSParserContext(m_context, useCounter);
   return m_context;
 }
 
 void CSSLazyParsingState::countRuleParsed() {
   ++m_parsedStyleRules;
   while (m_parsedStyleRules > m_styleRulesNeededForNextMilestone) {
     DCHECK_NE(UsageAll, m_usage);
     ++m_usage;
     recordUsageMetrics();
   }
@@ skipping 50 matching lines @@
       m_styleRulesNeededForNextMilestone = m_totalStyleRules - 1;
       break;
     case UsageAll:
       m_styleRulesNeededForNextMilestone = m_totalStyleRules;
       break;
   }
 
   usageHistogram.count(m_usage);
 }
 
+DEFINE_TRACE(CSSLazyParsingState) {
+  visitor->trace(m_owningContents);
+  visitor->trace(m_document);
+}
+
 }  // namespace blink