cc: Fix UAF in g_raster_required_for_activation_delay

cc/resources/raster_worker_pool.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/resources/raster_worker_pool.h"
 
 #include <algorithm>
 
 #include "base/debug/trace_event_synthetic_delay.h"
 #include "base/lazy_instance.h"
 #include "base/strings/stringprintf.h"
 #include "base/threading/simple_thread.h"
 #include "cc/base/scoped_ptr_deque.h"
 
 namespace cc {
 namespace {
 
-// Synthetic delay for raster tasks that are required for activation. Global to
-// avoid static initializer on critical path.
-struct RasterRequiredForActivationSyntheticDelayInitializer {
-  RasterRequiredForActivationSyntheticDelayInitializer()
-      : delay(base::debug::TraceEventSyntheticDelay::Lookup(
-            "cc.RasterRequiredForActivation")) {}
-  base::debug::TraceEventSyntheticDelay* delay;
-};
-static base::LazyInstance<RasterRequiredForActivationSyntheticDelayInitializer>
-    g_raster_required_for_activation_delay = LAZY_INSTANCE_INITIALIZER;
-
 class RasterTaskGraphRunner : public TaskGraphRunner,
                               public base::DelegateSimpleThread::Delegate {
  public:
-  RasterTaskGraphRunner() {
+  RasterTaskGraphRunner()
+      : trace_event_synthetic_delay_(
+            base::debug::TraceEventSyntheticDelay::Lookup(
+                "cc.RasterRequiredForActivation")) {
     size_t num_threads = RasterWorkerPool::GetNumRasterThreads();
     while (workers_.size() < num_threads) {
       scoped_ptr<base::DelegateSimpleThread> worker =
           make_scoped_ptr(new base::DelegateSimpleThread(
               this,
               base::StringPrintf("CompositorRasterWorker%u",
                                  static_cast<unsigned>(workers_.size() + 1))
                   .c_str()));
       worker->Start();
 #if defined(OS_ANDROID) || defined(OS_LINUX)
       worker->SetThreadPriority(base::kThreadPriority_Background);
 #endif
       workers_.push_back(worker.Pass());
     }
   }
 
   virtual ~RasterTaskGraphRunner() { NOTREACHED(); }
 
+  base::debug::TraceEventSyntheticDelay* trace_event_synthetic_delay() const {
+    return trace_event_synthetic_delay_;
+  }
+
  private:
   // Overridden from base::DelegateSimpleThread::Delegate:
   virtual void Run() OVERRIDE {
     TaskGraphRunner::Run();
   }
 
   ScopedPtrDeque<base::DelegateSimpleThread> workers_;
+  base::debug::TraceEventSyntheticDelay* trace_event_synthetic_delay_;

[reveman, 2014/08/27 00:34:37]

I think |synthetic_delay_| is verbose enough.

[boliu, 2014/08/27 01:14:49]

Done.

 };
 
 base::LazyInstance<RasterTaskGraphRunner>::Leaky g_task_graph_runner =
     LAZY_INSTANCE_INITIALIZER;
 
 const int kDefaultNumRasterThreads = 1;
 
 int g_num_raster_threads = 0;
 
 class RasterFinishedTaskImpl : public RasterizerTask {
@@ skipping 28 matching lines @@
 
   DISALLOW_COPY_AND_ASSIGN(RasterFinishedTaskImpl);
 };
 
 class RasterRequiredForActivationFinishedTaskImpl
     : public RasterFinishedTaskImpl {
  public:
   RasterRequiredForActivationFinishedTaskImpl(
       base::SequencedTaskRunner* task_runner,
       const base::Closure& on_raster_finished_callback,
-      size_t tasks_required_for_activation_count)
+      size_t tasks_required_for_activation_count,
+      base::debug::TraceEventSyntheticDelay* delay)
       : RasterFinishedTaskImpl(task_runner, on_raster_finished_callback),
+        delay_(delay),
         tasks_required_for_activation_count_(
             tasks_required_for_activation_count) {
     if (tasks_required_for_activation_count_) {
-      g_raster_required_for_activation_delay.Get().delay->BeginParallel(
-          &activation_delay_end_time_);
+      delay_->BeginParallel(&activation_delay_end_time_);
     }
   }
 
   // Overridden from Task:
   virtual void RunOnWorkerThread() OVERRIDE {
     TRACE_EVENT0(
         "cc", "RasterRequiredForActivationFinishedTaskImpl::RunOnWorkerThread");
 
     if (tasks_required_for_activation_count_) {
-      g_raster_required_for_activation_delay.Get().delay->EndParallel(
-          activation_delay_end_time_);
+      delay_->EndParallel(activation_delay_end_time_);
     }
     RasterFinished();
   }
 
  private:
   virtual ~RasterRequiredForActivationFinishedTaskImpl() {}
 
+  base::debug::TraceEventSyntheticDelay* delay_;

[reveman, 2014/08/27 00:34:37]

How about just using g_task_graph_runner.Get().synthetic_delay() above instead?
Technically a bit more efficient as we don't have to access
g_task_graph_runner.Get() each time we create one of these tasks and that's good
as we'll create many more of these tasks than we run.

[boliu, 2014/08/27 01:14:49]

Done.

   base::TimeTicks activation_delay_end_time_;
   const size_t tasks_required_for_activation_count_;
 
   DISALLOW_COPY_AND_ASSIGN(RasterRequiredForActivationFinishedTaskImpl);
 };
 
 }  // namespace
 
 // This allows an external rasterize on-demand system to run raster tasks
 // with highest priority using the same task graph runner instance.
@@ skipping 43 matching lines @@
 
 // static
 scoped_refptr<RasterizerTask>
 RasterWorkerPool::CreateRasterRequiredForActivationFinishedTask(
     size_t tasks_required_for_activation_count,
     base::SequencedTaskRunner* task_runner,
     const base::Closure& on_raster_finished_callback) {
   return make_scoped_refptr(new RasterRequiredForActivationFinishedTaskImpl(
       task_runner,
       on_raster_finished_callback,
-      tasks_required_for_activation_count));
+      tasks_required_for_activation_count,
+      g_task_graph_runner.Get().trace_event_synthetic_delay()));
 }
 
 // static
 void RasterWorkerPool::ScheduleTasksOnOriginThread(RasterizerTaskClient* client,
                                                    TaskGraph* graph) {
   TRACE_EVENT0("cc", "Rasterizer::ScheduleTasksOnOriginThread");
 
   for (TaskGraph::Node::Vector::iterator it = graph->nodes.begin();
        it != graph->nodes.end();
        ++it) {
@@ skipping 48 matching lines @@
     if (decode_it == graph->nodes.end())
       InsertNodeForTask(graph, decode_task, priority, 0u);
 
     graph->edges.push_back(TaskGraph::Edge(decode_task, raster_task));
   }
 
   InsertNodeForTask(graph, raster_task, priority, dependencies);
 }
 
 }  // namespace cc