Bug 1413242 - Don't let disposed window be read from parcels; r?snorp draft
authorJim Chen <nchen@mozilla.com>
Tue, 09 Jan 2018 16:11:11 -0500
changeset 717968 ae386a6bae06dedce191a12f6ee79cd48961bfd9
parent 715271 ac93fdadf1022211eec62258ad22b42cb37a6d14
child 745395 7af7e65a59ae0d68f5e8c45dc4136c8e87d1618d
push id94828
push userbmo:nchen@mozilla.com
push dateTue, 09 Jan 2018 21:11:30 +0000
reviewerssnorp
bugs1413242
milestone59.0a1
Bug 1413242 - Don't let disposed window be read from parcels; r?snorp It's possible for parcels derived from the session to outlast the session lifecycle. This patch makes us return null when trying to retrieve window objects using stale parcels. MozReview-Commit-ID: Gmri1CX4nbF
mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoSession.java
widget/android/GeneratedJNIWrappers.h
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoSession.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoSession.java
@@ -291,32 +291,40 @@ public class GeckoSession extends LayerS
         private NativeQueue mNativeQueue;
         private Binder mBinder;
 
         public Window(final NativeQueue nativeQueue) {
             mNativeQueue = nativeQueue;
         }
 
         @Override // IInterface
-        public IBinder asBinder() {
+        public Binder asBinder() {
             if (mBinder == null) {
                 mBinder = new Binder();
                 mBinder.attachInterface(this, Window.class.getName());
             }
             return mBinder;
         }
 
         @WrapForJNI(dispatchTo = "proxy")
         public static native void open(Window instance, Compositor compositor,
                                        EventDispatcher dispatcher,
                                        GeckoBundle settings, String chromeUri,
                                        int screenId, boolean privateMode);
 
-        @WrapForJNI(dispatchTo = "proxy")
-        @Override protected native void disposeNative();
+        @Override // JNIObject
+        protected void disposeNative() {
+            // Detach ourselves from the binder as well, to prevent this window from being
+            // read from any parcels.
+            asBinder().attachInterface(null, Window.class.getName());
+            nativeDisposeNative();
+        }
+
+        @WrapForJNI(dispatchTo = "proxy", stubName = "DisposeNative")
+        private native void nativeDisposeNative();
 
         @WrapForJNI(dispatchTo = "proxy")
         public native void close();
 
         @WrapForJNI(dispatchTo = "proxy")
         public native void transfer(Compositor compositor, EventDispatcher dispatcher,
                                     GeckoBundle settings);
 
--- a/widget/android/GeneratedJNIWrappers.h
+++ b/widget/android/GeneratedJNIWrappers.h
@@ -2287,17 +2287,17 @@ public:
                 mozilla::jni::DispatchTarget::PROXY;
     };
 
     struct DisposeNative_t {
         typedef Window Owner;
         typedef void ReturnType;
         typedef void SetterType;
         typedef mozilla::jni::Args<> Args;
-        static constexpr char name[] = "disposeNative";
+        static constexpr char name[] = "nativeDisposeNative";
         static constexpr char signature[] =
                 "()V";
         static const bool isStatic = false;
         static const mozilla::jni::ExceptionMode exceptionMode =
                 mozilla::jni::ExceptionMode::ABORT;
         static const mozilla::jni::CallingThread callingThread =
                 mozilla::jni::CallingThread::ANY;
         static const mozilla::jni::DispatchTarget dispatchTarget =