Reset accessibility if it gets out of sync.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
@@ skipping 50 matching lines @@
 #if defined(OS_MACOSX)
 #include "content/browser/frame_host/popup_menu_helper_mac.h"
 #endif
 
 using base::TimeDelta;
 
 namespace content {
 
 namespace {
 
+// An accessibility reset is only allowed to prevent very rare corner cases
+// or race conditions where the browser and renderer get out of sync. If
+// this happens more than this many times, kill the renderer.
+const int kMaxAccessibilityResets = 5;
+
 // The (process id, routing id) pair that identifies one RenderFrame.
 typedef std::pair<int32, int32> RenderFrameHostID;
 typedef base::hash_map<RenderFrameHostID, RenderFrameHostImpl*>
     RoutingIDFrameMap;
 base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
     LAZY_INSTANCE_INITIALIZER;
 
 class DesktopNotificationDelegateImpl : public DesktopNotificationDelegate {
  public:
   DesktopNotificationDelegateImpl(RenderFrameHost* render_frame_host,
@@ skipping 92 matching lines @@
     : render_view_host_(render_view_host),
       delegate_(delegate),
       cross_process_frame_connector_(NULL),
       render_frame_proxy_host_(NULL),
       frame_tree_(frame_tree),
       frame_tree_node_(frame_tree_node),
       routing_id_(routing_id),
       is_swapped_out_(is_swapped_out),
       render_frame_created_(false),
       navigations_suspended_(false),
+      waiting_on_accessibility_reset_(false),
+      accessibility_reset_count_(0),
+      disallow_browser_accessibility_manager_for_testing_(false),
       weak_ptr_factory_(this) {
   frame_tree_->RegisterRenderFrameHost(this);
   GetProcess()->AddRoute(routing_id_, this);
   g_routing_id_frame_map.Get().insert(std::make_pair(
       RenderFrameHostID(GetProcess()->GetID(), routing_id_),
       this));
 
   if (GetProcess()->GetServiceRegistry()) {
     RenderFrameSetupPtr setup;
     GetProcess()->GetServiceRegistry()->ConnectToRemoteService(&setup);
@@ skipping 253 matching lines @@
   if (view)
     return view->AccessibilityOriginInScreen(bounds);
   return gfx::Point();
 }
 
 void RenderFrameHostImpl::AccessibilityHitTest(const gfx::Point& point) {
   Send(new AccessibilityMsg_HitTest(routing_id_, point));
 }
 
 void RenderFrameHostImpl::AccessibilityFatalError() {
-  Send(new AccessibilityMsg_FatalError(routing_id_));
   browser_accessibility_manager_.reset(NULL);
+  if (waiting_on_accessibility_reset_)
+    return;
+
+  accessibility_reset_count_++;
+  if (accessibility_reset_count_ >= kMaxAccessibilityResets) {
+    Send(new AccessibilityMsg_FatalError(routing_id_));
+  } else {
+    Send(new AccessibilityMsg_Reset(routing_id_));
+    waiting_on_accessibility_reset_ = true;
+  }
 }
 
 gfx::AcceleratedWidget
     RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetView());
   if (view)
     return view->AccessibilityGetAcceleratedWidget();
   return gfx::kNullAcceleratedWidget;
 }
@@ skipping 553 matching lines @@
 }
 
 void RenderFrameHostImpl::OnBeginNavigation(
     const FrameHostMsg_BeginNavigation_Params& params) {
   CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kEnableBrowserSideNavigation));
   frame_tree_node()->render_manager()->OnBeginNavigation(params);
 }
 
 void RenderFrameHostImpl::OnAccessibilityEvents(
-    const std::vector<AccessibilityHostMsg_EventParams>& params) {
+    const std::vector<AccessibilityHostMsg_EventParams>& params,
+    bool is_reset) {
+  // Don't process this IPC if either we're waiting on a reset and this
+  // isn't a reset, or if we're not waiting on a reset but this is a reset.
+  if (waiting_on_accessibility_reset_ != is_reset) {
+    LOG(ERROR) << " *** Browser skipping *** ";

[Mike West, 2014/10/02 06:27:48]

Perhaps you could consider crashing the renderer if you get a reset message
while you're not waiting for a reset. That sounds like a good way for the
browser and renderer to get out of sync.

Also a nit: The log message should probably contain detail about what the
browser is skipping.

[dmazzoni, 2014/10/02 06:40:17]

Well, part of the point of this change is to avoid crashing the renderer,
because when we do it's almost impossible to decipher the crash logs. I'm hoping
that just ignoring those IPCs is pretty safe, that prevents them from being used
as an attack vector.
Oops, I didn't mean to leave the log in at all.

+    Send(new AccessibilityMsg_Events_ACK(routing_id_));
+    return;
+  }
+  waiting_on_accessibility_reset_ = false;
+
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetView());
 
   AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
   if ((accessibility_mode != AccessibilityModeOff) && view &&
       RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
     if (accessibility_mode & AccessibilityModeFlagPlatform) {
       GetOrCreateBrowserAccessibilityManager();
       if (browser_accessibility_manager_)
         browser_accessibility_manager_->OnAccessibilityEvents(params);
@@ skipping 54 matching lines @@
     } else {
       CHECK(ax_tree_for_testing_->Unserialize(param.update))
           << ax_tree_for_testing_->error();
     }
     accessibility_testing_callback_.Run(param.event_type, param.id);
   }
 }
 
 void RenderFrameHostImpl::OnAccessibilityLocationChanges(
     const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
+  if (waiting_on_accessibility_reset_)
+    return;
+
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetView());
   if (view &&
       RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
     AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
     if (accessibility_mode & AccessibilityModeFlagPlatform) {
       if (!browser_accessibility_manager_) {
         browser_accessibility_manager_.reset(
             view->CreateBrowserAccessibilityManager(this));
       }
@@ skipping 249 matching lines @@
     const base::Callback<void(ui::AXEvent, int)>& callback) {
   accessibility_testing_callback_ = callback;
 }
 
 const ui::AXTree* RenderFrameHostImpl::GetAXTreeForTesting() {
   return ax_tree_for_testing_.get();
 }
 
 BrowserAccessibilityManager*
     RenderFrameHostImpl::GetOrCreateBrowserAccessibilityManager() {
+  if (disallow_browser_accessibility_manager_for_testing_)
+    return NULL;

[Mike West, 2014/10/02 06:27:48]

Nit: nullptr?

+
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetView());
   if (view &&
       !browser_accessibility_manager_) {
     browser_accessibility_manager_.reset(
         view->CreateBrowserAccessibilityManager(this));
   }
   return browser_accessibility_manager_.get();
 }
 
@@ skipping 79 matching lines @@
   // Clear any state if a pending navigation is canceled or preempted.
   if (suspended_nav_params_)
     suspended_nav_params_.reset();
 
   TRACE_EVENT_ASYNC_END0("navigation",
                          "RenderFrameHostImpl navigation suspended", this);
   navigations_suspended_ = false;
 }
 
 }  // namespace content