Commit message: None
CVE: CVE-2017-5094
CWE: CWE-704
Vulnerability description: Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page.

Project: Chrome

std::unique_ptr<SkiaOutputSurface> SkiaOutputSurfaceImpl::Create(
    std::unique_ptr<SkiaOutputSurfaceDependency> deps,
    const RendererSettings& renderer_settings) {
  auto output_surface = std::make_unique<SkiaOutputSurfaceImpl>(
      util::PassKey<SkiaOutputSurfaceImpl>(), std::move(deps),
      renderer_settings);
  if (!output_surface->Initialize())
    output_surface = nullptr;
  return output_surface;
}

Project: Chrome

gfx::OverlayTransform SkiaOutputSurfaceImpl::GetDisplayTransform() {
  return pre_transform_;
}

Project: Chrome

GrBackendFormat SkiaOutputSurfaceImpl::GetGrBackendFormatForTexture(
    ResourceFormat resource_format,
    uint32_t gl_texture_target,
    const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) {
  if (!is_using_vulkan_) {
    DCHECK(!ycbcr_info);
    unsigned int texture_storage_format = gpu::GetGrGLBackendTextureFormat(
        impl_on_gpu_->GetFeatureInfo(), resource_format);

    return GrBackendFormat::MakeGL(texture_storage_format, gl_texture_target);
  } else {
#if BUILDFLAG(ENABLE_VULKAN)
    if (!ycbcr_info) {
      DCHECK(resource_format != YVU_420 && resource_format != YUV_420_BIPLANAR);
      return GrBackendFormat::MakeVk(ToVkFormat(resource_format));
    }

    GrVkYcbcrConversionInfo gr_ycbcr_info =
        CreateGrVkYcbcrConversionInfo(dependency_->GetVulkanContextProvider()
                                          ->GetDeviceQueue()
                                          ->GetVulkanPhysicalDevice(),
                                      VK_IMAGE_TILING_OPTIMAL, ycbcr_info);
    return GrBackendFormat::MakeVk(gr_ycbcr_info);
#else
    NOTREACHED();
    return GrBackendFormat();
#endif
  }
}

Project: Chrome

bool SkiaOutputSurfaceImpl::HasExternalStencilTest() const {
  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);

  return false;
}

Project: Chrome

void SkiaOutputSurfaceImpl::InitializeOnGpuThread(base::WaitableEvent* event,
                                                  bool* result) {
  base::Optional<base::ScopedClosureRunner> scoped_runner;
  if (event) {
    scoped_runner.emplace(
        base::BindOnce(&base::WaitableEvent::Signal, base::Unretained(event)));
  }

  auto did_swap_buffer_complete_callback = CreateSafeCallback(
      dependency_.get(),
      base::BindRepeating(&SkiaOutputSurfaceImpl::DidSwapBuffersComplete,
                          weak_ptr_));
  auto buffer_presented_callback = CreateSafeCallback(
      dependency_.get(),
      base::BindRepeating(&SkiaOutputSurfaceImpl::BufferPresented, weak_ptr_));
  auto context_lost_callback = CreateSafeCallback(
      dependency_.get(),
      base::BindRepeating(&SkiaOutputSurfaceImpl::ContextLost, weak_ptr_));
  auto gpu_vsync_callback = CreateSafeCallback(
      dependency_.get(),
      base::BindRepeating(&SkiaOutputSurfaceImpl::OnGpuVSync, weak_ptr_));

  impl_on_gpu_ = SkiaOutputSurfaceImplOnGpu::Create(
      dependency_.get(), renderer_settings_, task_sequence_->GetSequenceId(),
      std::move(did_swap_buffer_complete_callback),
      std::move(buffer_presented_callback), std::move(context_lost_callback),
      std::move(gpu_vsync_callback));
  if (!impl_on_gpu_) {
    *result = false;
  } else {
    capabilities_ = impl_on_gpu_->capabilities();
    capabilities_.android_surface_control_feature_enabled =
        dependency_->GetGpuFeatureInfo()
            .status_values[gpu::GPU_FEATURE_TYPE_ANDROID_SURFACE_CONTROL] ==
        gpu::kGpuFeatureStatusEnabled;

    is_displayed_as_overlay_ = impl_on_gpu_->IsDisplayedAsOverlay();
    *result = true;
  }
}

Project: Chrome

void SkiaOutputSurfaceImpl::ReleaseImageContexts(
    std::vector<std::unique_ptr<ImageContext>> image_contexts) {
  if (image_contexts.empty())
    return;

  auto callback = base::BindOnce(
      &SkiaOutputSurfaceImplOnGpu::ReleaseImageContexts,
      base::Unretained(impl_on_gpu_.get()), std::move(image_contexts));
  task_sequence_->ScheduleOrRetainTask(std::move(callback),
                                       std::vector<gpu::SyncToken>());
}

Project: Chrome

void SkiaOutputSurfaceImpl::SetGpuVSyncCallback(GpuVSyncCallback callback) {
  gpu_vsync_callback_ = std::move(callback);
}

Project: Chrome

void SkiaOutputSurfaceImpl::SwapBuffers(OutputSurfaceFrame frame) {
  NOTREACHED();
}

Project: Chrome

void SkiaOutputSurfaceImplTest::TearDown() {
  output_surface_.reset();
  scoped_feature_list_.reset();
}