BodyStreamBuffer: Avoid calling into V8 during construction

third_party/WebKit/Source/modules/fetch/Response.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/fetch/Response.h"
 
 #include <memory>
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/V8ArrayBuffer.h"
@@ skipping 130 matching lines @@
   if (body_value.IsUndefined() || body_value.IsNull()) {
     // Note: The IDL processor cannot handle this situation. See
     // https://crbug.com/335871.
   } else if (V8Blob::hasInstance(body, isolate)) {
     Blob* blob = V8Blob::toImpl(body.As<v8::Object>());
     body_buffer = new BodyStreamBuffer(
         script_state,
         new BlobBytesConsumer(execution_context, blob->GetBlobDataHandle()));
     content_type = blob->type();
   } else if (body->IsArrayBuffer()) {
+    // Avoid calling into V8 from the following constructor parameters, which
+    // is potentially unsafe.
+    DOMArrayBuffer* array_buffer = V8ArrayBuffer::toImpl(body.As<v8::Object>());
+    body_buffer = new BodyStreamBuffer(script_state,
+                                       new FormDataBytesConsumer(array_buffer));
+  } else if (body->IsArrayBufferView()) {
+    // Avoid calling into V8 from the following constructor parameters, which
+    // is potentially unsafe.
+    DOMArrayBufferView* array_buffer_view =
+        V8ArrayBufferView::toImpl(body.As<v8::Object>());
     body_buffer = new BodyStreamBuffer(
-        script_state, new FormDataBytesConsumer(
-                          V8ArrayBuffer::toImpl(body.As<v8::Object>())));

[haraken, 2017/05/10 09:05:16]

Isn't it guaranteed that V8ArrayBuffer::toImpl(body.As<v8::Object>()) gets
called before the construction of FormDataBytesConsumer starts?

[Michael Lippautz, 2017/05/10 10:51:25]

My C++ foo is not strong enough to answer this by pointing at the spec. What I
see from debugging though is that the MixinScope gets opened right before
evaluating the parameter.

So I assume that an uninitialized object is created before evaluating the
parameter.

-  } else if (body->IsArrayBufferView()) {
-    body_buffer = new BodyStreamBuffer(
-        script_state, new FormDataBytesConsumer(
-                          V8ArrayBufferView::toImpl(body.As<v8::Object>())));
+        script_state, new FormDataBytesConsumer(array_buffer_view));
   } else if (V8FormData::hasInstance(body, isolate)) {
     RefPtr<EncodedFormData> form_data =
         V8FormData::toImpl(body.As<v8::Object>())->EncodeMultiPartFormData();
     // Here we handle formData->boundary() as a C-style string. See
     // FormDataEncoder::generateUniqueBoundaryString.
     content_type = AtomicString("multipart/form-data; boundary=") +
                    form_data->Boundary().data();
     body_buffer = new BodyStreamBuffer(
         script_state,
         new FormDataBytesConsumer(execution_context, form_data.Release()));
@@ skipping 286 matching lines @@
       .Set(response.As<v8::Object>(), body_buffer);
 }
 
 DEFINE_TRACE(Response) {
   Body::Trace(visitor);
   visitor->Trace(response_);
   visitor->Trace(headers_);
 }
 
 }  // namespace blink