Verify promise type before casting.

Verify promise type before casting.

If a CDM calls the wrong Resolved() method to resolve a promise, the
promise is cast to the wrong type and causes a crash. This fixes the
problem by verifying that the promise is the correct type before
casting it.

BUG=408319
TEST=existing EME tests pass

Committed: https://crrev.com/ddb0fcf8e56749647a5b41ac16c5f3b26e6962e1
Cr-Commit-Position: refs/heads/master@{#292440}

[jrummell, 2014-08-27 22:15:34]

jrummell@chromium.org changed reviewers:
+ ddorwin@chromium.org, xhwang@chromium.org

[jrummell, 2014-08-27 22:15:34]

PTAL.

[jrummell, 2014-08-27 22:18:13]

jrummell@chromium.org changed reviewers:
+ dmichael@chromium.org

[jrummell, 2014-08-27 22:18:13]

+dmichael@ for content/renderer/pepper/content_decryptor_delegate.cc.

This is part of https://codereview.chromium.org/496143002/ pulled out separately
(and already reviewed by you) as it will need to get merged into M38.

[ddorwin, 2014-08-27 22:36:08]

lgtm

Thanks.

[xhwang, 2014-08-27 22:49:26]

lgtm with nits

https://codereview.chromium.org/515753002/diff/1/content/renderer/pepper/cont...
File content/renderer/pepper/content_decryptor_delegate.cc (right):

https://codereview.chromium.org/515753002/diff/1/content/renderer/pepper/cont...
content/renderer/pepper/content_decryptor_delegate.cc:635: }
nit: A simpler version:

if (!promise || promise->GetResolveParameterType() !=
media::CdmPromise::VOID_TYPE) {
  NOTREACHED();
  return;
}

// static_cast and resolve...

https://codereview.chromium.org/515753002/diff/1/content/renderer/pepper/cont...
content/renderer/pepper/content_decryptor_delegate.cc:649:
promise->GetResolveParameterType() == media::CdmPromise::STRING_TYPE) {
ditto

https://codereview.chromium.org/515753002/diff/1/media/base/cdm_promise.h
File media/base/cdm_promise.h (right):

https://codereview.chromium.org/515753002/diff/1/media/base/cdm_promise.h#new...
media/base/cdm_promise.h:41: KEY_IDS_VECTOR_TYPE,
nit: no trailing comma to be consistent

[jrummell, 2014-08-27 23:05:13]

Updated.

https://codereview.chromium.org/515753002/diff/1/content/renderer/pepper/cont...
File content/renderer/pepper/content_decryptor_delegate.cc (right):

https://codereview.chromium.org/515753002/diff/1/content/renderer/pepper/cont...
content/renderer/pepper/content_decryptor_delegate.cc:635: }
On 2014/08/27 22:49:26, xhwang wrote:
> nit: A simpler version:
> 
> if (!promise || promise->GetResolveParameterType() !=
> media::CdmPromise::VOID_TYPE) {
>   NOTREACHED();
>   return;
> }
> 
> // static_cast and resolve...

Done.

https://codereview.chromium.org/515753002/diff/1/content/renderer/pepper/cont...
content/renderer/pepper/content_decryptor_delegate.cc:649:
promise->GetResolveParameterType() == media::CdmPromise::STRING_TYPE) {
On 2014/08/27 22:49:26, xhwang wrote:
> ditto

Done.

https://codereview.chromium.org/515753002/diff/1/media/base/cdm_promise.h
File media/base/cdm_promise.h (right):

https://codereview.chromium.org/515753002/diff/1/media/base/cdm_promise.h#new...
media/base/cdm_promise.h:41: KEY_IDS_VECTOR_TYPE,
On 2014/08/27 22:49:26, xhwang wrote:
> nit: no trailing comma to be consistent

Done. The enum above has NUM_RESULT_CODES as always the last enum, where here
the list may grow if we add new templated versions.

[dmichael (off chromium), 2014-08-27 23:05:18]

rubber-stamp lgtm

[jrummell, 2014-08-27 23:09:58]

The CQ bit was checked by jrummell@chromium.org

[commit-bot: I haz the power, 2014-08-27 23:12:07]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/jrummell@chromium.org/515753002/20001

[jrummell, 2014-08-28 17:02:26]

The CQ bit was checked by jrummell@chromium.org

[commit-bot: I haz the power, 2014-08-28 17:03:29]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/jrummell@chromium.org/515753002/60001

[commit-bot: I haz the power, 2014-08-28 17:58:14]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  ios_dbg_simulator on tryserver.chromium.mac
(http://build.chromium.org/p/tryserver.chromium.mac/builders/ios_dbg_simulator...)
  mac_chromium_rel_swarming on tryserver.chromium.mac
(http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)
  win_chromium_compile_dbg on tryserver.chromium.win
(http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_comp...)

[commit-bot: I haz the power, 2014-08-28 18:31:06]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-08-28 18:31:06]

Try jobs failed on following builders:
  mac_chromium_rel_swarming on tryserver.chromium.mac
(http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)
  win_chromium_compile_dbg on tryserver.chromium.win
(http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_comp...)

[jrummell, 2014-08-28 18:31:57]

The CQ bit was checked by jrummell@chromium.org

[commit-bot: I haz the power, 2014-08-28 18:33:20]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/jrummell@chromium.org/515753002/60001

[commit-bot: I haz the power, 2014-08-28 19:19:05]

Committed patchset #4 (id:60001) as 93a0981d0f978776075c6d589ec69c125e75e9c6

[commit-bot: I haz the power, 2014-09-10 03:01:28]

Patchset 4 (id:??) landed as
https://crrev.com/ddb0fcf8e56749647a5b41ac16c5f3b26e6962e1
Cr-Commit-Position: refs/heads/master@{#292440}