Fix NavigationItem use-after-free crash in |-goToItemAtIndex:|

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <WebKit/WebKit.h>
 
 #import <objc/runtime.h>
 #include <stddef.h>
@@ skipping 459 matching lines @@
 @property(nonatomic, readonly) web::NavigationItemImpl* currentNavItem;
 // Returns the current transition type.
 @property(nonatomic, readonly) ui::PageTransition currentTransition;
 // Returns the referrer for current navigation item. May be empty.
 @property(nonatomic, readonly) web::Referrer currentNavItemReferrer;
 // The HTTP headers associated with the current navigation item. These are nil
 // unless the request was a POST.
 @property(nonatomic, readonly) NSDictionary* currentHTTPHeaders;
 
 // TODO(crbug.com/684098): Remove these methods and inline their content.
-// Called before finishing a history navigation from |item|.
-- (void)webWillFinishHistoryNavigationFromItem:(web::NavigationItem*)item;
+// Called before finishing a history navigation from a page with the given
+// UserAgentType.
+- (void)webWillFinishHistoryNavigationWithPreviousUserAgentType:
+    (web::UserAgentType)userAgentType;
 // Requires page reconstruction if |item| has a non-NONE UserAgentType and it
 // differs from that of |fromItem|.
 - (void)updateDesktopUserAgentForItem:(web::NavigationItem*)item
-                             fromItem:(web::NavigationItem*)fromItem;
+                previousUserAgentType:(web::UserAgentType)userAgentType;
 
 // Removes the container view from the hierarchy and resets the ivar.
 - (void)resetContainerView;
 // Called when the web page has changed document and/or URL, and so the page
 // navigation should be reported to the delegate, and internal state updated to
 // reflect the fact that the navigation has occurred.
 // TODO(stuartmorgan): The code conflates URL changes and document object
 // changes; the two need to be separated and handled differently.
 - (void)webPageChanged;
 // Resets any state that is associated with a specific document object (e.g.,
@@ skipping 99 matching lines @@
 // Update the appropriate parts of the model and broadcast to the embedder. This
 // may be called multiple times and thus must be idempotent.
 - (void)loadCompleteWithSuccess:(BOOL)loadSuccess;
 // Called after URL is finished loading and _loadPhase is set to PAGE_LOADED.
 - (void)didFinishWithURL:(const GURL&)currentURL loadSuccess:(BOOL)loadSuccess;
 // Navigates forwards or backwards by |delta| pages. No-op if delta is out of
 // bounds. Reloads if delta is 0.
 // TODO(crbug.com/661316): Move this method to NavigationManager.
 - (void)goDelta:(int)delta;
 // Loads a new URL if the current entry is not from a pushState() navigation.
-// |item| is the NavigationItem that was the current entry prior to the
-// navigation.
-- (void)finishHistoryNavigationFromItem:(web::NavigationItem*)item;
+// |fromURL| is the URL of the previous NavigationItem, |fromUserAgentType| is
+// that item's UserAgentType, and |sameDocument| is YES if the navigation is
+// between two pages with the same document.
+- (void)finishHistoryNavigationFromURL:(const GURL&)fromURL
+                         userAgentType:(web::UserAgentType)fromUserAgentType
+                          sameDocument:(BOOL)sameDocument;
 // Informs the native controller if web usage is allowed or not.
 - (void)setNativeControllerWebUsageEnabled:(BOOL)webUsageEnabled;
 // Called when web controller receives a new message from the web page.
 - (void)didReceiveScriptMessage:(WKScriptMessage*)message;
 // Returns a new script which wraps |script| with windowID check so |script| is
 // not evaluated on windowID mismatch.
 - (NSString*)scriptByAddingWindowIDCheckForScript:(NSString*)script;
 // Attempts to handle a script message. Returns YES on success, NO otherwise.
 - (BOOL)respondToWKScriptMessage:(WKScriptMessage*)scriptMessage;
 // Registers load request with empty referrer and link or client redirect
@@ skipping 91 matching lines @@
 
 // Inject windowID if not yet injected.
 - (void)injectWindowID;
 
 // Returns YES if the given WKBackForwardListItem is valid to use for
 // navigation.
 - (BOOL)isBackForwardListItemValid:(WKBackForwardListItem*)item;
 // Compares the two URLs being navigated between during a history navigation to
 // determine if a # needs to be appended to the URL of |toItem| to trigger a
 // hashchange event. If so, also saves the modified URL into |toItem|.
-- (GURL)URLForHistoryNavigationFromItem:(web::NavigationItem*)fromItem
-                                 toItem:(web::NavigationItem*)toItem;
-
+- (GURL)URLForHistoryNavigationToItem:(web::NavigationItem*)toItem
+                          previousURL:(const GURL&)previousURL;
 // Finds all the scrollviews in the view hierarchy and makes sure they do not
 // interfere with scroll to top when tapping the statusbar.
 - (void)optOutScrollsToTopForSubviews;
 // Tears down the old native controller, and then replaces it with the new one.
 - (void)setNativeController:(id<CRWNativeContent>)nativeController;
 // Returns whether |url| should be opened.
 - (BOOL)shouldOpenURL:(const GURL&)url
       mainDocumentURL:(const GURL&)mainDocumentURL
           linkClicked:(BOOL)linkClicked;
 // Called when |URL| needs to be opened in a matching native app.
@@ skipping 666 matching lines @@
 
 - (BOOL)isBackForwardListItemValid:(WKBackForwardListItem*)item {
   // The current back-forward list item MUST be in the WKWebView's back-forward
   // list to be valid.
   WKBackForwardList* list = [_webView backForwardList];
   return list.currentItem == item ||
          [list.forwardList indexOfObject:item] != NSNotFound ||
          [list.backList indexOfObject:item] != NSNotFound;
 }
 
-- (GURL)URLForHistoryNavigationFromItem:(web::NavigationItem*)fromItem
-                                 toItem:(web::NavigationItem*)toItem {
+- (GURL)URLForHistoryNavigationToItem:(web::NavigationItem*)toItem
+                          previousURL:(const GURL&)previousURL {
   // If navigating with native API, i.e. using a back forward list item,
   // hashchange events will be triggered automatically, so no URL tampering is
   // required.
   web::WKBackForwardListItemHolder* holder =
       web::WKBackForwardListItemHolder::FromNavigationItem(toItem);
   if (holder->back_forward_list_item()) {
     return toItem->GetURL();
   }
 
-  const GURL& startURL = fromItem->GetURL();
-  const GURL& endURL = toItem->GetURL();
+  const GURL& URL = toItem->GetURL();
 
   // Check the state of the fragments on both URLs (aka, is there a '#' in the
   // url or not).
-  if (!startURL.has_ref() || endURL.has_ref()) {
-    return endURL;
+  if (!previousURL.has_ref() || URL.has_ref()) {
+    return URL;
   }
 
   // startURL contains a fragment and endURL doesn't. Remove the fragment from
   // startURL and compare the resulting string to endURL. If they are equal, add
   // # to endURL to cause a hashchange event.
-  GURL hashless = web::GURLByRemovingRefFromGURL(startURL);
+  GURL hashless = web::GURLByRemovingRefFromGURL(previousURL);
 
-  if (hashless != endURL)
-    return endURL;
+  if (hashless != URL)
+    return URL;
 
   url::StringPieceReplacements<std::string> emptyRef;
   emptyRef.SetRefStr("");
-  GURL newEndURL = endURL.ReplaceComponents(emptyRef);
+  GURL newEndURL = URL.ReplaceComponents(emptyRef);
   toItem->SetURL(newEndURL);
   return newEndURL;
 }
 
 - (void)injectWindowID {
   // Default value for shouldSuppressDialogs is NO, so updating them only
   // when necessary is a good optimization.
   if (_shouldSuppressDialogsOnWindowIDInjection) {
     self.shouldSuppressDialogs = YES;
     _shouldSuppressDialogsOnWindowIDInjection = NO;
@@ skipping 660 matching lines @@
 - (void)goToItemAtIndex:(int)index {
   CRWSessionController* sessionController = self.sessionController;
   const web::ScopedNavigationItemImplList& items = sessionController.items;
   if (index < 0 || index >= static_cast<int>(items.size())) {
     NOTREACHED();
     return;
   }
 
   if (!_webStateImpl->IsShowingWebInterstitial())
     [self recordStateInHistory];
-  web::NavigationItem* fromItem = sessionController.currentItem;
+
+  web::NavigationItem* previousItem = sessionController.currentItem;
+  GURL previousURL = previousItem ? previousItem->GetURL() : GURL::EmptyGURL();
+  web::UserAgentType previousUserAgentType =
+      previousItem ? previousItem->GetUserAgentType()
+                   : web::UserAgentType::NONE;
   web::NavigationItem* toItem = items[index].get();
+  BOOL sameDocumentNavigation =
+      [sessionController isSameDocumentNavigationBetweenItem:previousItem
+                                                     andItem:toItem];
 
   NSUserDefaults* userDefaults = [NSUserDefaults standardUserDefaults];
   if (![userDefaults boolForKey:@"PendingIndexNavigationDisabled"]) {
     [self clearTransientContentView];
 
     // Update the user agent before attempting the navigation.
-    [self updateDesktopUserAgentForItem:toItem fromItem:fromItem];
+    [self updateDesktopUserAgentForItem:toItem
+                  previousUserAgentType:previousUserAgentType];
 
-    BOOL sameDocumentNavigation =
-        [sessionController isSameDocumentNavigationBetweenItem:fromItem
-                                                       andItem:toItem];
     if (sameDocumentNavigation) {
       [sessionController goToItemAtIndex:index];
       [self updateHTML5HistoryState];
     } else {
       [sessionController discardNonCommittedItems];
       [sessionController setPendingItemIndex:index];
 
       web::NavigationItemImpl* pendingItem = sessionController.pendingItem;
       pendingItem->SetTransitionType(ui::PageTransitionFromInt(
           pendingItem->GetTransitionType() | ui::PAGE_TRANSITION_FORWARD_BACK));
 
       [self loadCurrentURL];
     }
   } else {
     [sessionController goToItemAtIndex:index];
-    if (fromItem)
-      [self finishHistoryNavigationFromItem:fromItem];
+    if (previousURL.is_valid()) {
+      [self finishHistoryNavigationFromURL:previousURL
+                             userAgentType:previousUserAgentType
+                              sameDocument:sameDocumentNavigation];
+    }
   }
 }
 
 - (BOOL)isLoaded {
   return _loadPhase == web::PAGE_LOADED;
 }
 
 - (void)didFinishNavigation {
   // This can be called at multiple times after the document has loaded. Do
   // nothing if the document has already loaded.
@@ skipping 73 matching lines @@
     [self reload];
     return;
   }
 
   if (self.navigationManagerImpl->CanGoToOffset(delta)) {
     NSInteger index = self.navigationManagerImpl->GetIndexForOffset(delta);
     [self goToItemAtIndex:index];
   }
 }
 
-- (void)finishHistoryNavigationFromItem:(web::NavigationItem*)item {
-  [self webWillFinishHistoryNavigationFromItem:item];
+- (void)finishHistoryNavigationFromURL:(const GURL&)fromURL
+                         userAgentType:(web::UserAgentType)fromUserAgentType
+                          sameDocument:(BOOL)sameDocument {
+  [self webWillFinishHistoryNavigationWithPreviousUserAgentType:
+            fromUserAgentType];
 
   // Only load the new URL if it has a different document than |fromEntry| to
   // prevent extra page loads from NavigationItems created by hash changes or
   // calls to window.history.pushState().
-  BOOL shouldLoadURL = ![self.sessionController
-      isSameDocumentNavigationBetweenItem:item
-                                  andItem:self.currentNavItem];
   web::NavigationItem* currentItem = self.currentNavItem;
-  GURL endURL = [self URLForHistoryNavigationFromItem:item toItem:currentItem];
-  if (shouldLoadURL) {
+  GURL endURL =
+      [self URLForHistoryNavigationToItem:currentItem previousURL:fromURL];
+  if (!sameDocument) {
     ui::PageTransition transition = ui::PageTransitionFromInt(
         ui::PAGE_TRANSITION_RELOAD | ui::PAGE_TRANSITION_FORWARD_BACK);
 
     NavigationManager::WebLoadParams params(endURL);
     if (currentItem) {
       params.referrer = currentItem->GetReferrer();
     }
     params.transition_type = transition;
     [self loadWithParams:params];
   }
   // If this is a same-document navigation, update the HTML5 history state
   // immediately.  For cross-document navigations, the history state will be
   // updated after the navigation is committed, as attempting to replace the URL
   // here will result in a JavaScript SecurityError due to the URLs having
   // different origins.
-  if (!shouldLoadURL)
+  if (sameDocument)
     [self updateHTML5HistoryState];
 }
 
 - (void)addGestureRecognizerToWebView:(UIGestureRecognizer*)recognizer {
   if ([_gestureRecognizers containsObject:recognizer])
     return;
 
   [_webView addGestureRecognizer:recognizer];
   [_gestureRecognizers addObject:recognizer];
 }
@@ skipping 72 matching lines @@
       [delegate webController:strongSelf didLoadPassKitObject:data];
     }
   };
   web::BrowserState* browserState = self.webStateImpl->GetBrowserState();
   _passKitDownloader.reset([[CRWPassKitDownloader alloc]
       initWithContextGetter:browserState->GetRequestContext()
           completionHandler:passKitCompletion]);
   return _passKitDownloader.get();
 }
 
-- (void)webWillFinishHistoryNavigationFromItem:(web::NavigationItem*)item {
-  DCHECK(item);
-  [self updateDesktopUserAgentForItem:self.currentNavItem fromItem:item];
+- (void)webWillFinishHistoryNavigationWithPreviousUserAgentType:
+    (web::UserAgentType)userAgentType {
+  [self updateDesktopUserAgentForItem:self.currentNavItem
+                previousUserAgentType:userAgentType];
   [_delegate webWillFinishHistoryNavigation];
 }
 
 - (void)updateDesktopUserAgentForItem:(web::NavigationItem*)item
-                             fromItem:(web::NavigationItem*)fromItem {
-  if (!item || !fromItem)
+                previousUserAgentType:(web::UserAgentType)userAgentType {
+  if (!item)
     return;
   web::UserAgentType itemUserAgentType = item->GetUserAgentType();
   if (itemUserAgentType == web::UserAgentType::NONE)
     return;
-  if (itemUserAgentType != fromItem->GetUserAgentType())
+  if (itemUserAgentType != userAgentType)
     [self requirePageReconstruction];
 }
 
 #pragma mark -
 #pragma mark CRWWebControllerContainerViewDelegate
 
 - (CRWWebViewProxyImpl*)contentViewProxyForContainerView:
         (CRWWebControllerContainerView*)containerView {
   return _webViewProxy.get();
 }
@@ skipping 2819 matching lines @@
 - (void)simulateLoadRequestWithURL:(const GURL&)URL {
   _lastRegisteredRequestURL = URL;
   _loadPhase = web::LOAD_REQUESTED;
 }
 
 - (NSString*)referrerFromNavigationAction:(WKNavigationAction*)action {
   return [action.request valueForHTTPHeaderField:kReferrerHeaderName];
 }
 
 @end