Make CryptoResultImpl not to use WeakPtr.

Source/modules/crypto/CryptoResultImpl.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 32 matching lines @@
 #include "core/dom/ExecutionContext.h"
 #include "modules/crypto/CryptoKey.h"
 #include "modules/crypto/NormalizeAlgorithm.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCryptoAlgorithm.h"
 
 namespace blink {
 
 class CryptoResultImpl::WeakResolver : public ScriptPromiseResolver {
 public:
-    static WeakPtr<ScriptPromiseResolver> create(ScriptState* scriptState, CryptoResultImpl* result)
+    static PassRefPtr<ScriptPromiseResolver> create(ScriptState* scriptState, CryptoResultImpl* result)
     {
         RefPtr<WeakResolver> p = adoptRef(new WeakResolver(scriptState, result));
         p->suspendIfNeeded();
         p->keepAliveWhilePending();
-        return p->m_weakPtrFactory.createWeakPtr();
+        return p.release();
     }
 
-    virtual ~WeakResolver()
+private:
+    virtual void resolverCleared() override
     {
         m_result->cancel();
     }
 
-private:
     WeakResolver(ScriptState* scriptState, CryptoResultImpl* result)
         : ScriptPromiseResolver(scriptState)
-        , m_weakPtrFactory(this)
         , m_result(result) { }
-    WeakPtrFactory<ScriptPromiseResolver> m_weakPtrFactory;
-    RefPtr<CryptoResultImpl> m_result;
+    CryptoResultImpl* m_result;
 };
 
 ExceptionCode webCryptoErrorToExceptionCode(WebCryptoErrorType errorType)
 {
     switch (errorType) {
     case WebCryptoErrorTypeNotSupported:
         return NotSupportedError;
     case WebCryptoErrorTypeSyntax:
         return SyntaxError;
     case WebCryptoErrorTypeInvalidState:
@@ skipping 12 matching lines @@
         //        revisited.
         return DataError;
     }
 
     ASSERT_NOT_REACHED();
     return 0;
 }
 
 CryptoResultImpl::~CryptoResultImpl()
 {
+    ASSERT(!m_resolver || m_resolver->stopped());

[tasak, 2014/12/04 08:08:01]

Check whether WeakResoler has been already stopped or not.

If WeakResolver is still alive here, it might use CryptoResultImpl::cancel(),
i.e. heap-use-after-free.

 }
 
 PassRefPtr<CryptoResultImpl> CryptoResultImpl::create(ScriptState* scriptState)
 {
     return adoptRef(new CryptoResultImpl(scriptState));
 }
 
 void CryptoResultImpl::completeWithError(WebCryptoErrorType errorType, const WebString& errorDetails)
 {
     if (m_resolver)
@@ skipping 57 matching lines @@
 }
 
 bool CryptoResultImpl::cancelled() const
 {
     return acquireLoad(&m_cancelled);
 }
 
 void CryptoResultImpl::cancel()
 {
     releaseStore(&m_cancelled, 1);
+    m_resolver = nullptr;

[tasak, 2014/12/04 08:08:01]

To avoid the following ASSERTION failure, CryptoResultImpl needs to reset
m_resolver in cancel():

ASSERTION FAILED: m_verifier.isSafeToUse()
../../third_party/WebKit/Source/wtf/RefCounted.h(107) : bool
WTF::RefCountedBase::derefBase()
1   0x7fb8fd7ba113
...
19  0x7fb9082867a5 blink::WebCryptoResult::reset()
...
30  0x7fb907391e14
base::SequencedWorkerPool::Inner::ThreadLoop(base::SequencedWorkerPool::Worker*)
31  0x7fb90739175a base::SequencedWorkerPool::Worker::Run()

 }
 
 CryptoResultImpl::CryptoResultImpl(ScriptState* scriptState)
     : m_cancelled(0)
 {
     // Creating the WeakResolver may return nullptr if active dom objects have
     // been stopped. And in the process set m_cancelled to 1.
     m_resolver = WeakResolver::create(scriptState, this);
 }
 
 ScriptPromise CryptoResultImpl::promise()
 {
     return m_resolver ? m_resolver->promise() : ScriptPromise();
 }
 
 } // namespace blink