• Darwin Huang's avatar
    Clipboard: Fix UaP in ClipboardWriter/FileReaderLoader. · 0f6df4fa
    Darwin Huang authored
    Make ClipboardWriter keep FileReaderLoader alive until it's done reading
    a Blob, by using SelfKeepAlive<T>.
    
    Previously, ClipboardWriter could be garbage collected unexpectedly
    (ex. when the frame detaches). This could cause a use after poison
    in the FileReaderLoader, where:
    (1) A ClipboardWriter's FileReaderLoader starts reading the input blob
        as an async task.
    (2) The ClipboardWriter is destroyed (garbage collected).
    (3) The FileReaderLoader completes its async task of reading the input
        blob, and calls ClipboardWriter::StartWrite on the destroyed, owning
        ClipboardWriter.
    
    Additionally, add a "context destroyed" error message when a context
    detaches.
    
    Bug: 1142331
    Change-Id: I427cd6dc02e773b2d235d45bd9ad8935b575ff71
    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2509033
    Commit-Queue: Darwin Huang <huangdarwin@chromium.org>
    Reviewed-by: default avatarMarijn Kruisselbrink <mek@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#827371}
    0f6df4fa
clipboard_promise.h 4.57 KB