Bug 590054: Fix cross-architecture IPC pointer size issues with Cocoa NPAPI events. r=benwa r=cjones a=blocking-b6

dom/plugins/NPEventOSX.h

@@ -63,46 +63,49 @@ struct ParamTraits<mozilla::plugins::NPRemoteEvent>
 
     static void Write(Message* aMsg, const paramType& aParam)
     {
-        // Make a non-const copy of aParam so that we can muck with
-        // its insides for transport
-        paramType paramCopy;
-
-        paramCopy.event = aParam.event;
-
-        switch (paramCopy.event.type) {
+        aMsg->WriteInt(aParam.event.type);
+        aMsg->WriteUInt32(aParam.event.version);
+        switch (aParam.event.type) {
             case NPCocoaEventMouseDown:
             case NPCocoaEventMouseUp:
             case NPCocoaEventMouseMoved:
             case NPCocoaEventMouseEntered:
             case NPCocoaEventMouseExited:
             case NPCocoaEventMouseDragged:
-            case NPCocoaEventFocusChanged:
-            case NPCocoaEventWindowFocusChanged:
             case NPCocoaEventScrollWheel:
-                aMsg->WriteBytes(&paramCopy, sizeof(paramType));
-                return;
-            case NPCocoaEventDrawRect:
-                paramCopy.event.data.draw.context = NULL;
-                aMsg->WriteBytes(&paramCopy, sizeof(paramType));
-                return;
-            case NPCocoaEventFlagsChanged:
-                paramCopy.event.data.key.characters = NULL;
-                paramCopy.event.data.key.charactersIgnoringModifiers = NULL;
-                aMsg->WriteBytes(&paramCopy, sizeof(paramType));
-                return;
+                aMsg->WriteUInt32(aParam.event.data.mouse.modifierFlags);
+                aMsg->WriteDouble(aParam.event.data.mouse.pluginX);
+                aMsg->WriteDouble(aParam.event.data.mouse.pluginY);
+                aMsg->WriteInt32(aParam.event.data.mouse.buttonNumber);
+                aMsg->WriteInt32(aParam.event.data.mouse.clickCount);
+                aMsg->WriteDouble(aParam.event.data.mouse.deltaX);
+                aMsg->WriteDouble(aParam.event.data.mouse.deltaY);
+                aMsg->WriteDouble(aParam.event.data.mouse.deltaZ);
+                break;
             case NPCocoaEventKeyDown:
             case NPCocoaEventKeyUp:
-                paramCopy.event.data.key.characters = NULL;
-                paramCopy.event.data.key.charactersIgnoringModifiers = NULL;
-                aMsg->WriteBytes(&paramCopy, sizeof(paramType));
+            case NPCocoaEventFlagsChanged:
+                aMsg->WriteUInt32(aParam.event.data.key.modifierFlags);
                 WriteParam(aMsg, aParam.event.data.key.characters);
                 WriteParam(aMsg, aParam.event.data.key.charactersIgnoringModifiers);
-                return;
+                aMsg->WriteUnsignedChar(aParam.event.data.key.isARepeat);
+                aMsg->WriteUInt16(aParam.event.data.key.keyCode);
+                break;
+            case NPCocoaEventFocusChanged:
+            case NPCocoaEventWindowFocusChanged:
+                aMsg->WriteUnsignedChar(aParam.event.data.focus.hasFocus);
+                break;
+            case NPCocoaEventDrawRect:
+                // We don't write out the context pointer, it would always be NULL
+                // and is just filled in as such on the read.
+                aMsg->WriteDouble(aParam.event.data.draw.x);
+                aMsg->WriteDouble(aParam.event.data.draw.y);
+                aMsg->WriteDouble(aParam.event.data.draw.width);
+                aMsg->WriteDouble(aParam.event.data.draw.height);
+                break;
             case NPCocoaEventTextInput:
-                paramCopy.event.data.text.text = NULL;
-                aMsg->WriteBytes(&paramCopy, sizeof(paramType));
                 WriteParam(aMsg, aParam.event.data.text.text);
-                return;
+                break;
             default:
                 NS_NOTREACHED("Attempted to serialize unknown event type.");
                 return;
@@ -111,12 +114,15 @@ struct ParamTraits<mozilla::plugins::NPRemoteEvent>
 
     static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
     {
-        const char* bytes = 0;
-
-        if (!aMsg->ReadBytes(aIter, &bytes, sizeof(paramType))) {
+        int type = 0;
+        if (!aMsg->ReadInt(aIter, &type)) {
+            return false;
+        }
+        aResult->event.type = static_cast<NPCocoaEventType>(type);
+
+        if (!aMsg->ReadUInt32(aIter, &aResult->event.version)) {
             return false;
         }
-        memcpy(aResult, bytes, sizeof(paramType));
 
         switch (aResult->event.type) {
             case NPCocoaEventMouseDown:
@@ -125,17 +131,70 @@ struct ParamTraits<mozilla::plugins::NPRemoteEvent>
             case NPCocoaEventMouseEntered:
             case NPCocoaEventMouseExited:
             case NPCocoaEventMouseDragged:
-            case NPCocoaEventFocusChanged:
-            case NPCocoaEventWindowFocusChanged:
             case NPCocoaEventScrollWheel:
-            case NPCocoaEventDrawRect:
-            case NPCocoaEventFlagsChanged:
+                if (!aMsg->ReadUInt32(aIter, &aResult->event.data.mouse.modifierFlags)) {
+                    return false;
+                }
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.mouse.pluginX)) {
+                    return false;
+                }
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.mouse.pluginY)) {
+                    return false;
+                }
+                if (!aMsg->ReadInt32(aIter, &aResult->event.data.mouse.buttonNumber)) {
+                    return false;
+                }
+                if (!aMsg->ReadInt32(aIter, &aResult->event.data.mouse.clickCount)) {
+                    return false;
+                }
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.mouse.deltaX)) {
+                    return false;
+                }
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.mouse.deltaY)) {
+                    return false;
+                }
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.mouse.deltaZ)) {
+                    return false;
+                }
                 break;
             case NPCocoaEventKeyDown:
             case NPCocoaEventKeyUp:
-                if (!ReadParam(aMsg, aIter, &aResult->event.data.key.characters) ||
-                    !ReadParam(aMsg, aIter, &aResult->event.data.key.charactersIgnoringModifiers)) {
-                  return false;
+            case NPCocoaEventFlagsChanged:
+                if (!aMsg->ReadUInt32(aIter, &aResult->event.data.key.modifierFlags)) {
+                    return false;
+                }
+                if (!ReadParam(aMsg, aIter, &aResult->event.data.key.characters)) {
+                    return false;
+                }
+                if (!ReadParam(aMsg, aIter, &aResult->event.data.key.charactersIgnoringModifiers)) {
+                    return false;
+                }
+                if (!aMsg->ReadUnsignedChar(aIter, &aResult->event.data.key.isARepeat)) {
+                    return false;
+                }
+                if (!aMsg->ReadUInt16(aIter, &aResult->event.data.key.keyCode)) {
+                    return false;
+                }
+                break;
+            case NPCocoaEventFocusChanged:
+            case NPCocoaEventWindowFocusChanged:
+                if (!aMsg->ReadUnsignedChar(aIter, &aResult->event.data.focus.hasFocus)) {
+                    return false;
+                }
+                break;
+            case NPCocoaEventDrawRect:
+                aResult->event.data.draw.context = NULL;
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.draw.x)) {
+                    return false;
+                }
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.draw.y)) {
+                    return false;
+                }
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.draw.width)) {
+                    return false;
+                }
+                if (!aMsg->ReadDouble(aIter, &aResult->event.data.draw.height)) {
+                    return false;
                 }
                 break;
             case NPCocoaEventTextInput:
@@ -144,7 +203,7 @@ struct ParamTraits<mozilla::plugins::NPRemoteEvent>
                 }
                 break;
             default:
-                // ignore any events we don't expect
+                NS_NOTREACHED("Attempted to de-serialize unknown event type.");
                 return false;
         }
 

dom/plugins/PluginMessageUtils.h

@@ -472,6 +472,13 @@ struct ParamTraits<NPNSString*>
   static void Write(Message* aMsg, const paramType& aParam)
   {
     CFStringRef cfString = (CFStringRef)aParam;
+
+    // Write true if we have a string, false represents NULL.
+    aMsg->WriteBool(!!cfString);
+    if (!cfString) {
+      return;
+    }
+
     long length = ::CFStringGetLength(cfString);
     WriteParam(aMsg, length);
     if (length == 0) {
@@ -491,6 +498,15 @@ struct ParamTraits<NPNSString*>
 
   static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
   {
+    bool haveString = false;
+    if (!aMsg->ReadBool(aIter, &haveString)) {
+      return false;
+    }
+    if (!haveString) {
+      *aResult = NULL;
+      return true;
+    }
+
     long length;
     if (!ReadParam(aMsg, aIter, &length)) {
       return false;

ipc/chromium/src/base/pickle.cc

@@ -188,6 +188,20 @@ bool Pickle::ReadSize(void** iter, size_t* result) const {
   return true;
 }
 
+bool Pickle::ReadInt32(void** iter, int32* result) const {
+  DCHECK(iter);
+  if (!*iter)
+    *iter = const_cast<char*>(payload());
+
+  if (!IteratorHasRoomFor(*iter, sizeof(*result)))
+    return false;
+
+  memcpy(result, *iter, sizeof(*result));
+
+  UpdateIter(iter, sizeof(*result));
+  return true;
+}
+
 bool Pickle::ReadUInt32(void** iter, uint32* result) const {
   DCHECK(iter);
   if (!*iter)
@@ -216,6 +230,20 @@ bool Pickle::ReadInt64(void** iter, int64* result) const {
   return true;
 }
 
+bool Pickle::ReadDouble(void** iter, double* result) const {
+  DCHECK(iter);
+  if (!*iter)
+    *iter = const_cast<char*>(payload());
+
+  if (!IteratorHasRoomFor(*iter, sizeof(*result)))
+    return false;
+
+  memcpy(result, *iter, sizeof(*result));
+
+  UpdateIter(iter, sizeof(*result));
+  return true;
+}
+
 bool Pickle::ReadIntPtr(void** iter, intptr_t* result) const {
   DCHECK(iter);
   if (!*iter)
@@ -230,6 +258,20 @@ bool Pickle::ReadIntPtr(void** iter, intptr_t* result) const {
   return true;
 }
 
+bool Pickle::ReadUnsignedChar(void** iter, unsigned char* result) const {
+  DCHECK(iter);
+  if (!*iter)
+    *iter = const_cast<char*>(payload());
+
+  if (!IteratorHasRoomFor(*iter, sizeof(*result)))
+    return false;
+
+  memcpy(result, *iter, sizeof(*result));
+
+  UpdateIter(iter, sizeof(*result));
+  return true;
+}
+
 bool Pickle::ReadString(void** iter, std::string* result) const {
   DCHECK(iter);
   if (!*iter)

ipc/chromium/src/base/pickle.h

@@ -72,9 +72,12 @@ class Pickle {
   bool ReadLong(void** iter, long* result) const;
   bool ReadULong(void** iter, unsigned long* result) const;
   bool ReadSize(void** iter, size_t* result) const;
+  bool ReadInt32(void** iter, int32* result) const;
   bool ReadUInt32(void** iter, uint32* result) const;
   bool ReadInt64(void** iter, int64* result) const;
+  bool ReadDouble(void** iter, double* result) const;
   bool ReadIntPtr(void** iter, intptr_t* result) const;
+  bool ReadUnsignedChar(void** iter, unsigned char* result) const;
   bool ReadString(void** iter, std::string* result) const;
   bool ReadWString(void** iter, std::wstring* result) const;
   bool ReadString16(void** iter, string16* result) const;
@@ -110,15 +113,24 @@ class Pickle {
   bool WriteSize(size_t value) {
     return WriteBytes(&value, sizeof(value));
   }
+  bool WriteInt32(int32 value) {
+    return WriteBytes(&value, sizeof(value));
+  }
   bool WriteUInt32(uint32 value) {
     return WriteBytes(&value, sizeof(value));
   }
   bool WriteInt64(int64 value) {
     return WriteBytes(&value, sizeof(value));
   }
+  bool WriteDouble(double value) {
+    return WriteBytes(&value, sizeof(value));
+  }
   bool WriteIntPtr(intptr_t value) {
     return WriteBytes(&value, sizeof(value));
   }
+  bool WriteUnsignedChar(unsigned char value) {
+    return WriteBytes(&value, sizeof(value));
+  }
   bool WriteString(const std::string& value);
   bool WriteWString(const std::wstring& value);
   bool WriteString16(const string16& value);