Commit message: None
CVE: CVE-2018-17462
CWE: CWE-20
Vulnerability description: Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page.

Project: Chrome

void AppCacheGroup::AddCache(AppCache* complete_cache) {
  DCHECK(complete_cache->is_complete());
  complete_cache->set_owning_group(this);

  if (!newest_complete_cache_) {
    newest_complete_cache_ = complete_cache;
    return;
  }

  if (complete_cache->IsNewerThan(newest_complete_cache_)) {
    old_caches_.push_back(newest_complete_cache_);
    newest_complete_cache_ = complete_cache;

    for (Caches::iterator it = old_caches_.begin(); it != old_caches_.end();
         ++it) {
      AppCache* cache = *it;
      for (AppCacheHost* host : cache->associated_hosts())
        host->SetSwappableCache(this);
    }
  } else {
    old_caches_.push_back(complete_cache);
  }
}

Project: Chrome

void AppCacheGroup::AddNewlyDeletableResponseIds(
    std::vector<int64_t>* response_ids) {
  if (is_being_deleted() || (!is_obsolete() && old_caches_.empty())) {
    storage_->DeleteResponses(manifest_url_, *response_ids);
    response_ids->clear();
    return;
  }

  if (newly_deletable_response_ids_.empty()) {
    newly_deletable_response_ids_.swap(*response_ids);
    return;
  }
  newly_deletable_response_ids_.insert(
      newly_deletable_response_ids_.end(),
      response_ids->begin(), response_ids->end());
  response_ids->clear();
}

Project: Chrome

void AppCacheGroup::AddUpdateObserver(UpdateObserver* observer) {
  if (queued_updates_.find(observer) != queued_updates_.end())
    queued_observers_.AddObserver(observer);
  else
    observers_.AddObserver(observer);
}

Project: Chrome

AppCacheGroup::AppCacheGroup(AppCacheStorage* storage,
                             const GURL& manifest_url,
                             int64_t group_id)
    : group_id_(group_id),
      manifest_url_(manifest_url),
      update_status_(IDLE),
      is_obsolete_(false),
      is_being_deleted_(false),
      newest_complete_cache_(nullptr),
      update_job_(nullptr),
      storage_(storage),
      is_in_dtor_(false) {
  storage_->working_set()->AddGroup(this);
  host_observer_.reset(new HostObserver(this));
}

Project: Chrome

bool AppCacheGroup::FindObserver(
    const UpdateObserver* find_me,
    const base::ObserverList<UpdateObserver>::Unchecked& observer_list) {
  return observer_list.HasObserver(find_me);
}

Project: Chrome

void AppCacheGroup::HostDestructionImminent(AppCacheHost* host) {
  queued_updates_.erase(host);
  if (queued_updates_.empty() && !restart_update_task_.IsCancelled())
    restart_update_task_.Cancel();
}

Project: Chrome

  explicit HostObserver(AppCacheGroup* group) : group_(group) {}

Project: Chrome

void AppCacheGroup::QueueUpdate(AppCacheHost* host,
                                const GURL& new_master_resource) {
  DCHECK(update_job_ && host && !new_master_resource.is_empty());
  queued_updates_.insert(QueuedUpdates::value_type(
      host, std::make_pair(host, new_master_resource)));

  host->AddObserver(host_observer_.get());

  if (FindObserver(host, observers_)) {
    observers_.RemoveObserver(host);
    queued_observers_.AddObserver(host);
  }
}

Project: Chrome

void AppCacheGroup::RemoveUpdateObserver(UpdateObserver* observer) {
  observers_.RemoveObserver(observer);
  queued_observers_.RemoveObserver(observer);
}

Project: Chrome

void AppCacheGroup::RunQueuedUpdates() {
  if (!restart_update_task_.IsCancelled())
    restart_update_task_.Cancel();

  if (queued_updates_.empty())
    return;

  QueuedUpdates updates_to_run;
  queued_updates_.swap(updates_to_run);
  DCHECK(queued_updates_.empty());

  for (auto& pair : updates_to_run) {
    AppCacheHost* host = pair.second.first;
    host->RemoveObserver(host_observer_.get());
    if (FindObserver(host, queued_observers_)) {
      queued_observers_.RemoveObserver(host);
      observers_.AddObserver(host);
    }

    if (!is_obsolete() && !is_being_deleted())
      StartUpdateWithNewMasterEntry(host, pair.second.second);
  }
}

Project: Chrome

void AppCacheGroup::SetUpdateAppCacheStatus(UpdateAppCacheStatus status) {
  if (status == update_status_)
    return;

  update_status_ = status;

  if (status != IDLE) {
    DCHECK(update_job_);
  } else {
    update_job_ = nullptr;

    scoped_refptr<AppCacheGroup> protect(is_in_dtor_ ? nullptr : this);
    for (auto& observer : observers_)
      observer.OnUpdateComplete(this);
    if (!queued_updates_.empty())
      ScheduleUpdateRestart(kUpdateRestartDelayMs);
  }
}

Project: Chrome

void AppCacheGroup::StartUpdateWithNewMasterEntry(
    AppCacheHost* host, const GURL& new_master_resource) {
  DCHECK(!is_obsolete() && !is_being_deleted());
  if (is_in_dtor_)
    return;

  if (!update_job_)
    update_job_ = new AppCacheUpdateJob(storage_->service(), this);

  update_job_->StartUpdate(host, new_master_resource);

  if (!restart_update_task_.IsCancelled()) {
    restart_update_task_.Cancel();
    RunQueuedUpdates();
  }
}

Project: Chrome

AppCacheGroup::~AppCacheGroup() {
  DCHECK(old_caches_.empty());
  DCHECK(!newest_complete_cache_);
  DCHECK(restart_update_task_.IsCancelled());
  DCHECK(queued_updates_.empty());

  is_in_dtor_ = true;

  if (update_job_)
    delete update_job_;
  DCHECK_EQ(IDLE, update_status_);

  storage_->working_set()->RemoveGroup(this);
  storage_->DeleteResponses(manifest_url_, newly_deletable_response_ids_);
}