Home Explore 引导页 在线工具 Blog
Register Sign In
Pchen0
/
electron
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: 9-x-y
Branches Tags
electron
/
patches
/
chromium
/
backport_1065122.patch

backport_1065122.patch 4.1 KB
Permalink History Raw

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091 
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
    2. 

  2. From: Cheng Zhao <[email protected]>
    3. 

  3. Date: Thu, 4 Oct 2018 14:57:02 -0700
    4. 

  4. Subject: fix: add some crash debugging checks
    5. 

  5. 

  6. [1065122] [High]: heap-use-after-free : ui::AXTreeSerializerblink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData::LeastCommonAncestor
    7. 

  7. Backport https://chromium.googlesource.com/chromium/src/+/e0a661af6c2c7346183c47b106afecb01adbfa2e
    8. 

  8. 

  9. diff --git a/ui/accessibility/ax_tree_serializer.h b/ui/accessibility/ax_tree_serializer.h
    10. 

  10. index 18fe3aa1b5f088632291f074ff9b29c5ce7694af..b9e6fc36fa68a45112dbacc97a912ca2d7ac2c71 100644
    11. 

  11. --- a/ui/accessibility/ax_tree_serializer.h
    12. 

  12. +++ b/ui/accessibility/ax_tree_serializer.h
    13. 

  13. @@ -180,6 +180,8 @@ class AXTreeSerializer {
    14. 

  14.    // like when Reset() is called.
    15. 

  15.    void InternalReset();
    16. 

  16.  
    17. 

  17. +  ClientTreeNode* GetClientTreeNodeParent(ClientTreeNode* obj);
    18. 

  18. +
    19. 

  19.    // The tree source.
    20. 

  20.    AXTreeSource<AXSourceNode, AXNodeData, AXTreeData>* tree_;
    21. 

  21.  
    22. 

  22. @@ -269,7 +271,7 @@ AXTreeSerializer<AXSourceNode, AXNodeData, AXTreeData>::LeastCommonAncestor(
    23. 

  23.    std::vector<ClientTreeNode*> client_ancestors;
    24. 

  24.    while (client_node) {
    25. 

  25.      client_ancestors.push_back(client_node);
    26. 

  26. -    client_node = client_node->parent;
    27. 

  27. +    client_node = GetClientTreeNodeParent(client_node);
    28. 

  28.    }
    29. 

  29.  
    30. 

  30.    // Start at the root. Keep going until the source ancestor chain and
    31. 

  31. @@ -304,9 +306,12 @@ AXTreeSerializer<AXSourceNode, AXNodeData, AXTreeData>::LeastCommonAncestor(
    32. 

  32.    // that we're inside of an invalid subtree that all needs to be
    33. 

  33.    // re-serialized, so the LCA should be higher.
    34. 

  34.    ClientTreeNode* client_node = ClientTreeNodeById(tree_->GetId(node));
    35. 

  35. -  while (
    36. 

  36. -      tree_->IsValid(node) &&
    37. 

  37. -      (!client_node || (client_node->parent && client_node->parent->invalid))) {
    38. 

  38. +  while (tree_->IsValid(node)) {
    39. 

  39. +    if (client_node) {
    40. 

  40. +      ClientTreeNode* parent = GetClientTreeNodeParent(client_node);
    41. 

  41. +      if (!parent || !parent->invalid)
    42. 

  42. +        break;
    43. 

  43. +    }
    44. 

  44.      node = tree_->GetParent(node);
    45. 

  45.      if (tree_->IsValid(node))
    46. 

  46.        client_node = ClientTreeNodeById(tree_->GetId(node));
    47. 

  47. @@ -326,12 +331,13 @@ bool AXTreeSerializer<AXSourceNode, AXNodeData, AXTreeData>::
    48. 

  48.      int child_id = tree_->GetId(child);
    49. 

  49.      ClientTreeNode* client_child = ClientTreeNodeById(child_id);
    50. 

  50.      if (client_child) {
    51. 

  51. -      if (!client_child->parent) {
    52. 

  52. +      ClientTreeNode* parent = client_child->parent;
    53. 

  53. +      if (!parent) {
    54. 

  54.          // If the client child has no parent, it must have been the
    55. 

  55.          // previous root node, so there is no LCA and we can exit early.
    56. 

  56.          *out_lca = tree_->GetNull();
    57. 

  57.          return true;
    58. 

  58. -      } else if (client_child->parent->id != id) {
    59. 

  59. +      } else if (parent->id != id) {
    60. 

  60.          // If the client child's parent is not this node, update the LCA
    61. 

  61.          // and return true (reparenting was found).
    62. 

  62.          *out_lca = LeastCommonAncestor(*out_lca, client_child);
    63. 

  63. @@ -366,6 +372,19 @@ AXTreeSerializer<AXSourceNode, AXNodeData, AXTreeData>::ClientTreeNodeById(
    64. 

  64.    return nullptr;
    65. 

  65.  }
    66. 

  66.  
    67. 

  67. +template <typename AXSourceNode, typename AXNodeData, typename AXTreeData>
    68. 

  68. +ClientTreeNode*
    69. 

  69. +AXTreeSerializer<AXSourceNode, AXNodeData, AXTreeData>::GetClientTreeNodeParent(
    70. 

  70. +    ClientTreeNode* obj) {
    71. 

  71. +  ClientTreeNode* parent = obj->parent;
    72. 

  72. +#if DCHECK_IS_ON()
    73. 

  73. +  if (!parent)
    74. 

  74. +    return nullptr;
    75. 

  75. +  DCHECK(ClientTreeNodeById(parent->id)) << "Parent not in id map.";
    76. 

  76. +#endif  // DCHECK_IS_ON()
    77. 

  77. +  return parent;
    78. 

  78. +}
    79. 

  79. +
    80. 

  80.  template <typename AXSourceNode, typename AXNodeData, typename AXTreeData>
    81. 

  81.  bool AXTreeSerializer<AXSourceNode, AXNodeData, AXTreeData>::SerializeChanges(
    82. 

  82.      AXSourceNode node,
    83. 

  83. @@ -549,7 +568,7 @@ bool AXTreeSerializer<AXSourceNode, AXNodeData, AXTreeData>::
    84. 

  84.      // above. If this happens, reset and return an error.
    85. 

  85.  
    86. 

  86.      ClientTreeNode* client_child = ClientTreeNodeById(new_child_id);
    87. 

  87. -    if (client_child && client_child->parent != client_node) {
    88. 

  88. +    if (client_child && GetClientTreeNodeParent(client_child) != client_node) {
    89. 

  89.        DVLOG(1) << "Illegal reparenting detected";
    90. 

  90.  #if defined(ADDRESS_SANITIZER)
    91. 

  91.        // Wrapping this in ADDRESS_SANITIZER will cause it to run on
    92.