Commit message: None
CVE: CVE-2018-18339
CWE: CWE-119
Vulnerability description: Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Project: Chrome

RendererSchedulerImpl::AnyThread::AnyThread(
    RendererSchedulerImpl* renderer_scheduler_impl)
    : awaiting_touch_start_response(
          false,
          "RendererScheduler.AwaitingTouchstartResponse",
          renderer_scheduler_impl,
          &renderer_scheduler_impl->tracing_controller_,
          YesNoStateToString),
      in_idle_period(
          false,
          "RendererScheduler.InIdlePeriod",
          renderer_scheduler_impl,
          &renderer_scheduler_impl->tracing_controller_,
          YesNoStateToString),
      begin_main_frame_on_critical_path(
          false,
          "RendererScheduler.BeginMainFrameOnCriticalPath",
          renderer_scheduler_impl,
          &renderer_scheduler_impl->tracing_controller_,
          YesNoStateToString),
      last_gesture_was_compositor_driven(
          false,
          "RendererScheduler.LastGestureWasCompositorDriven",
          renderer_scheduler_impl,
          &renderer_scheduler_impl->tracing_controller_,
          YesNoStateToString),
      default_gesture_prevented(
          true,
          "RendererScheduler.DefaultGesturePrevented",
          renderer_scheduler_impl,
          &renderer_scheduler_impl->tracing_controller_,
          YesNoStateToString),
      have_seen_a_potentially_blocking_gesture(
          false,
          "RendererScheduler.HaveSeenPotentiallyBlockingGesture",
          renderer_scheduler_impl,
          &renderer_scheduler_impl->tracing_controller_,
          YesNoStateToString),
      waiting_for_meaningful_paint(
          false,
          "RendererScheduler.WaitingForMeaningfulPaint",
          renderer_scheduler_impl,
          &renderer_scheduler_impl->tracing_controller_,
          YesNoStateToString),
      have_seen_input_since_navigation(
          false,
          "RendererScheduler.HaveSeenInputSinceNavigation",
          renderer_scheduler_impl,
          &renderer_scheduler_impl->tracing_controller_,
          YesNoStateToString) {}

Project: Chrome

void RendererSchedulerImpl::EndIdlePeriod() {
  if (main_thread_only().in_idle_period_for_testing)
    return;
  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("renderer.scheduler"),
               "RendererSchedulerImpl::EndIdlePeriod");
  helper_.CheckOnValidThread();
  idle_helper_.EndIdlePeriod();
}

Project: Chrome

void RendererSchedulerImpl::MaybeAdvanceVirtualTime(
    base::TimeTicks new_virtual_time) {
  if (virtual_time_domain_)
    virtual_time_domain_->MaybeAdvanceVirtualTime(new_virtual_time);
}

Project: Chrome

void RendererSchedulerImpl::MaybeUpdatePolicy() {
  helper_.CheckOnValidThread();
  if (policy_may_need_update_.IsSet()) {
    UpdatePolicy();
  }
}

Project: Chrome

void RendererSchedulerImpl::OnReportFineGrainedExpectedQueueingTime(
    const char* split_description,
    base::TimeDelta queueing_time) {
  base::UmaHistogramCustomCounts(
      split_description, queueing_time.InMicroseconds(),
      kMinExpectedQueueingTimeBucket, kMaxExpectedQueueingTimeBucket,
      kNumberExpectedQueueingTimeBuckets);
}

Project: Chrome

void RendererSchedulerImpl::RemovePendingNavigation(NavigatingFrameType type) {
  helper_.CheckOnValidThread();
  DCHECK_GT(main_thread_only().navigation_task_expected_count, 0);
  if (type == NavigatingFrameType::kMainFrame &&
      main_thread_only().navigation_task_expected_count > 0) {
    main_thread_only().navigation_task_expected_count--;
    UpdatePolicy();
  }
}

Project: Chrome

void RendererSchedulerImpl::ResumeRendererImpl() {
  helper_.CheckOnValidThread();
  if (helper_.IsShutdown())
    return;
  --main_thread_only().renderer_pause_count;
  DCHECK_GE(main_thread_only().renderer_pause_count.value(), 0);
  UpdatePolicy();
}

Project: Chrome

void RendererSchedulerImpl::SetHasVisibleRenderWidgetWithTouchHandler(
    bool has_visible_render_widget_with_touch_handler) {
  helper_.CheckOnValidThread();
  if (has_visible_render_widget_with_touch_handler ==
      main_thread_only().has_visible_render_widget_with_touch_handler)
    return;

  main_thread_only().has_visible_render_widget_with_touch_handler =
      has_visible_render_widget_with_touch_handler;

  base::AutoLock lock(any_thread_lock_);
  UpdatePolicyLocked(UpdateType::kForceUpdate);
}

Project: Chrome

bool RendererSchedulerImpl::ShouldDisableThrottlingBecauseOfAudio(
    base::TimeTicks now) {
  if (!main_thread_only().last_audio_state_change)
    return false;

  if (main_thread_only().is_audio_playing)
    return true;

  return main_thread_only().last_audio_state_change.value() +
             kThrottlingDelayAfterAudioIsPlayed >
         now;
}

Project: Chrome

const char* TaskTypeToString(TaskType task_type) {
  switch (task_type) {
    case TaskType::kDOMManipulation:
      return "DOMManipultion";
    case TaskType::kUserInteraction:
      return "UserInteraction";
    case TaskType::kNetworking:
      return "Networking";
    case TaskType::kNetworkingControl:
      return "NetworkingControl";
    case TaskType::kHistoryTraversal:
      return "HistoryTraversal";
    case TaskType::kEmbed:
      return "Embed";
    case TaskType::kMediaElementEvent:
      return "MediaElementEvent";
    case TaskType::kCanvasBlobSerialization:
      return "CanvasBlobSerialization";
    case TaskType::kMicrotask:
      return "Microtask";
    case TaskType::kJavascriptTimer:
      return "JavascriptTimer";
    case TaskType::kRemoteEvent:
      return "RemoteEvent";
    case TaskType::kWebSocket:
      return "WebSocket";
    case TaskType::kPostedMessage:
      return "PostedMessage";
    case TaskType::kUnshippedPortMessage:
      return "UnshipedPortMessage";
    case TaskType::kFileReading:
      return "FileReading";
    case TaskType::kDatabaseAccess:
      return "DatabaseAccess";
    case TaskType::kPresentation:
      return "Presentation";
    case TaskType::kSensor:
      return "Sensor";
    case TaskType::kPerformanceTimeline:
      return "PerformanceTimeline";
    case TaskType::kWebGL:
      return "WebGL";
    case TaskType::kIdleTask:
      return "IdleTask";
    case TaskType::kMiscPlatformAPI:
      return "MiscPlatformAPI";
    case TaskType::kUnspecedTimer:
      return "UnspecedTimer";
    case TaskType::kUnspecedLoading:
      return "UnspecedLoading";
    case TaskType::kUnthrottled:
      return "Unthrottled";
    case TaskType::kInternalTest:
      return "InternalTest";
    case TaskType::kInternalWebCrypto:
      return "InternalWebCrypto";
    case TaskType::kInternalIndexedDB:
      return "InternalIndexedDB";
    case TaskType::kInternalMedia:
      return "InternalMedia";
    case TaskType::kCount:
      return "Count";
  }
  NOTREACHED();
  return "";
}

Project: Chrome

scoped_refptr<MainThreadTaskQueue> RendererSchedulerImpl::TimerTaskQueue() {
  helper_.CheckOnValidThread();
  return default_timer_task_queue_;
}

Project: Chrome

void UpdatePolicyDuration(base::TimeTicks now,
                          base::TimeTicks policy_expiration,
                          base::TimeDelta* policy_duration) {
  if (policy_expiration <= now)
    return;

  if (policy_duration->is_zero()) {
    *policy_duration = policy_expiration - now;
    return;
  }

  *policy_duration = std::min(*policy_duration, policy_expiration - now);
}

Project: Chrome

void RendererSchedulerImpl::VirtualTimeResumed() {
  for (const auto& pair : task_runners_) {
    if (pair.first->queue_class() == MainThreadTaskQueue::QueueClass::kTimer) {
      DCHECK(!task_queue_throttler_->IsThrottled(pair.first.get()));
      DCHECK(pair.first->HasActiveFence());
      pair.first->RemoveFence();
    }
  }
}