Skip to content

Commit

Permalink
Ensure unique entries in frame_timing_details_
Browse files Browse the repository at this point in the history
CompositorFrameSinkSupport::DidPresentCompositorFrame() keeps
|frame_timing_details_| map keyed on CompositorFrame frame_tokens. These
are supposed to be unique but a malicious renderer could violate that
assumption. Convert some DCHECKs into CHECKs to guard against problems
related to this.

(cherry picked from commit 9b62ab5)

Bug: 1458819
Change-Id: Ib0b9551d18ea421957e0dce49a2593043f4abb12
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4673638
Reviewed-by: Jonathan Ross <jonross@chromium.org>
Commit-Queue: Kyle Charbonneau <kylechar@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1169287}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4682626
Cr-Commit-Position: refs/branch-heads/5845@{#469}
Cr-Branched-From: 5a5dff6-refs/heads/main@{#1160321}
  • Loading branch information
kylechar authored and Chromium LUCI CQ committed Jul 13, 2023
1 parent 20b7bb0 commit 74e0965
Showing 1 changed file with 2 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -797,7 +797,7 @@ void CompositorFrameSinkSupport::DidPresentCompositorFrame(
DCHECK_LE(pending_received_frame_times_.size(), 25u);
auto received_frame_timestamp =
pending_received_frame_times_.find(frame_token);
DCHECK(received_frame_timestamp != pending_received_frame_times_.end());
CHECK(received_frame_timestamp != pending_received_frame_times_.end());

FrameTimingDetails details;
details.received_compositor_frame_timestamp =
Expand All @@ -818,8 +818,7 @@ void CompositorFrameSinkSupport::DidPresentCompositorFrame(
pending_received_frame_times_.erase(received_frame_timestamp);

// We should only ever get one PresentationFeedback per frame_token.
DCHECK(frame_timing_details_.find(frame_token) ==
frame_timing_details_.end());
CHECK(!frame_timing_details_.contains(frame_token));
frame_timing_details_.emplace(frame_token, details);

if (!feedback.failed() && frame_sink_manager_->frame_counter()) {
Expand Down

0 comments on commit 74e0965

Please sign in to comment.