Protect XHR's wrapper while dispatching event.

Source/core/xmlhttprequest/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 57 matching lines @@
 #include "public/platform/WebURLRequest.h"
 #include "wtf/Assertions.h"
 #include "wtf/RefCountedLeakCounter.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/text/CString.h"
 
 namespace blink {
 
 DEFINE_DEBUG_ONLY_GLOBAL(WTF::RefCountedLeakCounter, xmlHttpRequestCounter, ("XMLHttpRequest"));
 
-static bool isSetCookieHeader(const AtomicString& name)
+namespace {
+
+// This class protects the wrapper of the associated XMLHttpRequest object
+// via hasPendingActivity method which returns true if
+// m_eventDispatchRecursionLevel is positive.
+class ScopedEventDispatchProtect final {
+public:
+    explicit ScopedEventDispatchProtect(int* level) : m_level(level)
+    {
+        ++*m_level;
+    }
+    ~ScopedEventDispatchProtect()
+    {
+        ASSERT(*m_level > 0);
+        --*m_level;
+    }
+
+private:
+    int* const m_level;
+};
+
+bool isSetCookieHeader(const AtomicString& name)
 {
     return equalIgnoringCase(name, "set-cookie") || equalIgnoringCase(name, "set-cookie2");
 }
 
-static void replaceCharsetInMediaType(String& mediaType, const String& charsetValue)
+void replaceCharsetInMediaType(String& mediaType, const String& charsetValue)
 {
     unsigned pos = 0, len = 0;
 
     findCharsetInMediaType(mediaType, pos, len);
 
     if (!len) {
         // When no charset found, do nothing.
         return;
     }
 
     // Found at least one existing charset, replace all occurrences with new charset.
     while (len) {
         mediaType.replace(pos, len, charsetValue);
         unsigned start = pos + charsetValue.length();
         findCharsetInMediaType(mediaType, pos, len, start);
     }
 }
 
-static void logConsoleError(ExecutionContext* context, const String& message)
+void logConsoleError(ExecutionContext* context, const String& message)
 {
     if (!context)
         return;
     // FIXME: It's not good to report the bad usage without indicating what source line it came from.
     // We should pass additional parameters so we can tell the console where the mistake occurred.
     context->addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
+} // namespace
+
 using Result = WebDataConsumerHandle::Result;
 
 // ReadableStreamSource is the underlying source for the response stream of
 // XHR. The class has two modes: with and without body stream (passed to the
 // constructor as the |body| argument).
 // 1) When an instance is constructed with a body stream, it receives data from
 // the body stream. The data reading is originated by a |pullSource| call.
 // 2) When an instance is constructed without a body stream, it receives data
 // from |didReceiveData| function. The associated XHR instance will push data
 // via the function.
@@ skipping 180 matching lines @@
     : ActiveDOMObject(context)
     , m_timeoutMilliseconds(0)
     , m_loaderIdentifier(0)
     , m_state(UNSENT)
     , m_lengthDownloadedToFile(0)
     , m_receivedLength(0)
     , m_exceptionCode(0)
     , m_progressEventThrottle(this)
     , m_responseTypeCode(ResponseTypeDefault)
     , m_securityOrigin(securityOrigin)
+    , m_eventDispatchRecursionLevel(0)
     , m_async(true)
     , m_includeCredentials(false)
     , m_parsedResponse(false)
     , m_error(false)
     , m_uploadEventsAllowed(true)
     , m_uploadComplete(false)
     , m_sameOriginRequest(true)
     , m_downloadingToFile(false)
     , m_responseTextOverflow(false)
 {
@@ skipping 786 matching lines @@
     //
     // If, window.onload contains open() and send(), m_loader will be set to
     // non 0 value. So, we cannot continue the outer open(). In such case,
     // just abort the outer open() by returning false.
     RefPtr<ThreadableLoader> loader = m_loader.release();
     loader->cancel();
 
     // If abort() called internalAbort() and a nested open() ended up
     // clearing the error flag, but didn't send(), make sure the error
     // flag is still set.
-    bool newLoadStarted = hasPendingActivity();
+    bool newLoadStarted = m_loader;
     if (!newLoadStarted)
         m_error = true;
 
     return !newLoadStarted;
 }
 
 void XMLHttpRequest::clearResponse()
 {
     // FIXME: when we add the support for multi-part XHR, we will have to
     // be careful with this initialization.
@@ skipping 44 matching lines @@
 }
 
 void XMLHttpRequest::handleNetworkError()
 {
     WTF_LOG(Network, "XMLHttpRequest %p handleNetworkError()", this);
 
     // Response is cleared next, save needed progress event data.
     long long expectedLength = m_response.expectedContentLength();
     long long receivedLength = m_receivedLength;
 
-    // Prevent the XMLHttpRequest instance from being destoryed during
-    // |internalAbort()|.
-    RefPtrWillBeRawPtr<XMLHttpRequest> protect(this);
-
     if (!internalAbort())
         return;
 
     handleRequestError(NetworkError, EventTypeNames::error, receivedLength, expectedLength);
 }
 
 void XMLHttpRequest::handleDidCancel()
 {
     WTF_LOG(Network, "XMLHttpRequest %p handleDidCancel()", this);
 
     // Response is cleared next, save needed progress event data.
     long long expectedLength = m_response.expectedContentLength();
     long long receivedLength = m_receivedLength;
 
-    // Prevent the XMLHttpRequest instance from being destoryed during
-    // |internalAbort()|.
-    RefPtrWillBeRawPtr<XMLHttpRequest> protect(this);
-
     if (!internalAbort())
         return;
 
     handleRequestError(AbortError, EventTypeNames::abort, receivedLength, expectedLength);
 }
 
 void XMLHttpRequest::handleRequestError(ExceptionCode exceptionCode, const AtomicString& type, long long receivedLength, long long expectedLength)
 {
     WTF_LOG(Network, "XMLHttpRequest %p handleRequestError()", this);
 
@@ skipping 179 matching lines @@
 
     if (!m_response.httpStatusText().isNull())
         return m_response.httpStatusText();
 
     return String();
 }
 
 void XMLHttpRequest::didFail(const ResourceError& error)
 {
     WTF_LOG(Network, "XMLHttpRequest %p didFail()", this);
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
 
     // If we are already in an error state, for instance we called abort(), bail out early.
     if (m_error)
         return;
 
     if (error.isCancellation()) {
         handleDidCancel();
         // Now the XMLHttpRequest instance may be dead.
         return;
     }
 
     if (error.isTimeout()) {
         handleDidTimeout();
         // Now the XMLHttpRequest instance may be dead.
         return;
     }
 
     // Network failures are already reported to Web Inspector by ResourceLoader.
     if (error.domain() == errorDomainBlinkInternal)
         logConsoleError(executionContext(), "XMLHttpRequest cannot load " + error.failingURL() + ". " + error.localizedDescription());
 
     handleNetworkError();
     // Now the XMLHttpRequest instance may be dead.
 }
 
 void XMLHttpRequest::didFailRedirectCheck()
 {
     WTF_LOG(Network, "XMLHttpRequest %p didFailRedirectCheck()", this);
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
 
     handleNetworkError();
     // Now the XMLHttpRequest instance may be dead.
 }
 
 void XMLHttpRequest::didFinishLoading(unsigned long identifier, double)
 {
     WTF_LOG(Network, "XMLHttpRequest %p didFinishLoading(%lu)", this, identifier);
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
 
     if (m_error)
         return;
 
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
 
     m_loaderIdentifier = identifier;
 
     if (m_downloadingToFile && m_responseTypeCode != ResponseTypeBlob && m_lengthDownloadedToFile) {
@@ skipping 33 matching lines @@
     if (m_responseStreamSource)
         m_responseStreamSource->didReceiveFinishLoadingNotification();
 
     clearVariablesForLoading();
     endLoading();
 }
 
 void XMLHttpRequest::didFinishLoadingFromBlob()
 {
     WTF_LOG(Network, "XMLHttpRequest %p didFinishLoadingFromBlob", this);
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
 
     didFinishLoadingInternal();
 }
 
 void XMLHttpRequest::didFailLoadingFromBlob()
 {
     WTF_LOG(Network, "XMLHttpRequest %p didFailLoadingFromBlob()", this);
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
 
     if (m_error)
         return;
     handleNetworkError();
 }
 
 PassRefPtr<BlobDataHandle> XMLHttpRequest::createBlobDataHandleFromResponse()
 {
     ASSERT(m_downloadingToFile);
     OwnPtr<BlobData> blobData = BlobData::create();
     String filePath = m_response.downloadedFilePath();
     // If we errored out or got no data, we return an empty handle.
     if (!filePath.isEmpty() && m_lengthDownloadedToFile) {
         blobData->appendFile(filePath);
         // FIXME: finalResponseMIMETypeWithFallback() defaults to
         // text/xml which may be incorrect. Replace it with
         // finalResponseMIMEType() after compatibility investigation.
         blobData->setContentType(finalResponseMIMETypeWithFallback().lower());
     }
     return BlobDataHandle::create(blobData.release(), m_lengthDownloadedToFile);
 }
 
 void XMLHttpRequest::notifyParserStopped()
 {
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
+
     // This should only be called when response document is parsed asynchronously.
     ASSERT(m_responseDocumentParser);
     ASSERT(!m_responseDocumentParser->isParsing());
     ASSERT(!m_responseLegacyStream);
     ASSERT(!m_responseStream);
 
     // Do nothing if we are called from |internalAbort()|.
     if (m_error)
         return;
 
@@ skipping 16 matching lines @@
     if (m_loader)
         m_loader = nullptr;
     m_loaderIdentifier = 0;
 
     changeState(DONE);
 }
 
 void XMLHttpRequest::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
     WTF_LOG(Network, "XMLHttpRequest %p didSendData(%llu, %llu)", this, bytesSent, totalBytesToBeSent);
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
 
     if (!m_upload)
         return;
 
     if (m_uploadEventsAllowed)
         m_upload->dispatchProgressEvent(bytesSent, totalBytesToBeSent);
 
     if (bytesSent == totalBytesToBeSent && !m_uploadComplete) {
         m_uploadComplete = true;
         if (m_uploadEventsAllowed)
             m_upload->dispatchEventAndLoadEnd(EventTypeNames::load, true, bytesSent, totalBytesToBeSent);
     }
 }
 
 void XMLHttpRequest::didReceiveResponse(unsigned long identifier, const ResourceResponse& response, PassOwnPtr<WebDataConsumerHandle> handle)
 {
     WTF_LOG(Network, "XMLHttpRequest %p didReceiveResponse(%lu)", this, identifier);
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
 
     m_response = response;
     if (!m_mimeTypeOverride.isEmpty()) {
         m_response.setHTTPHeaderField("Content-Type", m_mimeTypeOverride);
         m_finalResponseCharset = extractCharsetFromMediaType(m_mimeTypeOverride);
     }
 
     if (m_finalResponseCharset.isEmpty())
         m_finalResponseCharset = response.textEncodingName();
 
     if (handle) {
         ASSERT(!m_responseStream);
         ASSERT(!m_responseStreamSource);
         m_responseStreamSource = new ReadableStreamSource(this, handle);
         m_responseStream = new ReadableStreamImpl<ReadableStreamChunkTypeTraits<DOMArrayBuffer>>(executionContext(), m_responseStreamSource);
         m_responseStreamSource->startStream(m_responseStream);
 
-        // This protection seems needed to keep |this| alive after changeState
-        // calling which may call event listeners.
-        RefPtrWillBeRawPtr<XMLHttpRequest> protect(this);
         changeState(HEADERS_RECEIVED);
         if (m_error) {
             // We need to check for |m_error| because |changeState| may trigger
             // readystatechange, and user javascript can cause |abort()|.
             return;
         }
         changeState(LOADING);
     }
 }
 
@@ skipping 36 matching lines @@
     }
 
     if (responseIsHTML())
         return TextResourceDecoder::create("text/html", "UTF-8");
 
     return TextResourceDecoder::create("text/plain", "UTF-8");
 }
 
 void XMLHttpRequest::didReceiveData(const char* data, unsigned len)
 {
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
     if (m_error)
         return;
 
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
 
     // We need to check for |m_error| again, because |changeState| may trigger
     // readystatechange, and user javascript can cause |abort()|.
     if (m_error)
         return;
@@ skipping 34 matching lines @@
     if (m_blobLoader) {
         // In this case, the data is provided by m_blobLoader. As progress
         // events are already fired, we should return here.
         return;
     }
     trackProgress(len);
 }
 
 void XMLHttpRequest::didDownloadData(int dataLength)
 {
+    ScopedEventDispatchProtect protect(&m_eventDispatchRecursionLevel);
     if (m_error)
         return;
 
     ASSERT(m_downloadingToFile);
 
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
 
     if (!dataLength)
         return;
 
     // readystatechange event handler may do something to put this XHR in error
     // state. We need to check m_error again here.
     if (m_error)
         return;
 
     m_lengthDownloadedToFile += dataLength;
 
     trackProgress(dataLength);
 }
 
 void XMLHttpRequest::handleDidTimeout()
 {
     WTF_LOG(Network, "XMLHttpRequest %p handleDidTimeout()", this);
 
     // Response is cleared next, save needed progress event data.
     long long expectedLength = m_response.expectedContentLength();
     long long receivedLength = m_receivedLength;
 
-    // Prevent the XMLHttpRequest instance from being destoryed during
-    // |internalAbort()|.
-    RefPtrWillBeRawPtr<XMLHttpRequest> protect(this);
-
     if (!internalAbort())
         return;
 
     handleRequestError(TimeoutError, EventTypeNames::timeout, receivedLength, expectedLength);
 }
 
 void XMLHttpRequest::suspend()
 {
     m_progressEventThrottle.suspend();
 }
@@ skipping 13 matching lines @@
     // Neither this object nor the JavaScript wrapper should be deleted while
     // a request is in progress because we need to keep the listeners alive,
     // and they are referenced by the JavaScript wrapper.
     // |m_loader| is non-null while request is active and ThreadableLoaderClient
     // callbacks may be called, and |m_responseDocumentParser| is non-null while
     // DocumentParserClient callbacks may be called.
     if (m_loader || m_responseDocumentParser)
         return true;
     if (m_responseStream && m_responseStream->hasPendingActivity())
         return true;
-    return false;
+    return m_eventDispatchRecursionLevel > 0;
 }
 
 void XMLHttpRequest::contextDestroyed()
 {
     ASSERT(!m_loader);
     ActiveDOMObject::contextDestroyed();
 }
 
 const AtomicString& XMLHttpRequest::interfaceName() const
 {
@@ skipping 15 matching lines @@
     visitor->trace(m_responseDocumentParser);
     visitor->trace(m_progressEventThrottle);
     visitor->trace(m_upload);
     visitor->trace(m_blobLoader);
     XMLHttpRequestEventTarget::trace(visitor);
     DocumentParserClient::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink