summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYufeng Shen <miletus@chromium.org>2015-10-05 17:14:25 -0400
committerYufeng Shen <miletus@chromium.org>2015-10-05 21:16:21 +0000
commita95922813f1007c6f0d9719649785c191f89e97c (patch)
treec6b8c657d538d6332769c81014e516140f786b22
parentf29861a9e03c5a1d916255404db649465bffd2f5 (diff)
downloadchromium_src-a95922813f1007c6f0d9719649785c191f89e97c.zip
chromium_src-a95922813f1007c6f0d9719649785c191f89e97c.tar.gz
chromium_src-a95922813f1007c6f0d9719649785c191f89e97c.tar.bz2
Don't early out in OnSwapCompositorFrame() if LatencyInfo::Verify() fails
LatencyInfo::Verify(vector<LatencyInfo>&) checks on the size of the vector to rule out potential compromised renderer sending large malicious payload through LatencyInfo IPC. We run into this problem that extremely slow renderer can also accumulate large number of LatencyInfo that exceeds our threshold. In this case, lets only clear that vector<LatencyInfo> but do not early out in browser side compositor frame processing which might stall the whole rendering pipeline. Also issue a global scope instant trace event to mark that something is really going wrong here. BUG=529820 Review URL: https://codereview.chromium.org/1328403002 Cr-Commit-Position: refs/heads/master@{#348029} (cherry picked from commit f7e380105d04a24f518885b75e2e13f753c9cbdf) TBR=jdduke Review URL: https://codereview.chromium.org/1387943002 . Cr-Commit-Position: refs/branch-heads/2490@{#489} Cr-Branched-From: 7790a3535f2a81a03685eca31a32cf69ae0c114f-refs/heads/master@{#344925}
-rw-r--r--content/browser/renderer_host/render_widget_host_impl.cc5
-rw-r--r--ui/events/latency_info.cc3
2 files changed, 6 insertions, 2 deletions
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index 8ea74c7..837d944 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -1435,8 +1435,9 @@ bool RenderWidgetHostImpl::OnSwapCompositorFrame(
messages_to_deliver_with_frame.swap(base::get<2>(param));
if (!ui::LatencyInfo::Verify(frame->metadata.latency_info,
- "RenderWidgetHostImpl::OnSwapCompositorFrame"))
- return false;
+ "RenderWidgetHostImpl::OnSwapCompositorFrame")) {
+ std::vector<ui::LatencyInfo>().swap(frame->metadata.latency_info);
+ }
latency_tracker_.OnSwapCompositorFrame(&frame->metadata.latency_info);
diff --git a/ui/events/latency_info.cc b/ui/events/latency_info.cc
index 3225001..fb55bc4 100644
--- a/ui/events/latency_info.cc
+++ b/ui/events/latency_info.cc
@@ -154,6 +154,9 @@ bool LatencyInfo::Verify(const std::vector<LatencyInfo>& latency_info,
if (latency_info.size() > kMaxLatencyInfoNumber) {
LOG(ERROR) << referring_msg << ", LatencyInfo vector size "
<< latency_info.size() << " is too big.";
+ TRACE_EVENT_INSTANT1("input,benchmark", "LatencyInfo::Verify Fails",
+ TRACE_EVENT_SCOPE_GLOBAL,
+ "size", latency_info.size());
return false;
}
return true;