Deal with frame removal by content scripts

Blink and the RenderFrame implementations are currently not prepared to deal
with frame detachments in their callbacks. Consequently, extension code
(content scripts, chrome.app.window.create) that run arbitrary code in the
"document element created" and "document loaded" notifications may result in
unexpected invalidation of memory, resulting in a UAF.

This patch fixes the bug by moving all code that runs untrusted code from
observers to dedicated callbacks, which are only run at a safe point.
All document parsers in Blink have been modified to make sure that they still
work even when the document creation is interrupted by frame removal.

An extensive set of tests for all different kinds of documents, frame removal
methods (e.g. synchronously / in mutation events / ...) and injection points
(document start/end) have been added to avoid regressions.

BUG=582008

Review URL: https://codereview.chromium.org/1642283002

Cr-Commit-Position: refs/heads/master@{#382162}

1 files changed, 27 insertions, 0 deletions

diff --git a/extensions/renderer/extension_frame_helper.h b/extensions/renderer/extension_frame_helper.h
index a710d4f..57ac3b6 100644
--- a/extensions/renderer/extension_frame_helper.h
+++ b/extensions/renderer/extension_frame_helper.h
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "base/macros.h"
+#include "base/memory/weak_ptr.h"
 #include "content/public/common/console_message_level.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "content/public/renderer/render_frame_observer_tracker.h"
@@ -61,6 +62,24 @@ class ExtensionFrameHelper
     return did_create_current_document_element_;
   }
 
+  // Called when the document element has been inserted in this frame. This
+  // method may invoke untrusted JavaScript code that invalidate the frame and
+  // this ExtensionFrameHelper.
+  void RunScriptsAtDocumentStart();
+
+  // Called after the DOMContentLoaded event has fired.
+  void RunScriptsAtDocumentEnd();
+
+  // Schedule a callback, to be run at the next RunScriptsAtDocumentStart
+  // notification. Only call this when you are certain that there will be such a
+  // notification, e.g. from RenderFrameObserver::DidCreateDocumentElement.
+  // Otherwise the callback is never invoked, or invoked for a document that you
+  // were not expecting.
+  void ScheduleAtDocumentStart(const base::Closure& callback);
+
+  // Schedule a callback, to be run at the next RunScriptsAtDocumentEnd call.
+  void ScheduleAtDocumentEnd(const base::Closure& callback);
+
  private:
   // RenderFrameObserver implementation.
   void DidCreateDocumentElement() override;
@@ -113,6 +132,14 @@ class ExtensionFrameHelper
   // Whether or not the current document element has been created.
   bool did_create_current_document_element_;
 
+  // Callbacks to be run at the next RunScriptsAtDocumentStart notification.
+  std::vector<base::Closure> document_element_created_callbacks_;
+
+  // Callbacks to be run at the next RunScriptsAtDocumentEnd notification.
+  std::vector<base::Closure> document_load_finished_callbacks_;
+
+  base::WeakPtrFactory<ExtensionFrameHelper> weak_ptr_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(ExtensionFrameHelper);
 };