[Backport] Fix for security issue 925035

Hand merged from:

CacheStorage: Ignore code cache for origins that do not match the renderer.

This CL is inspired by the previously attempted crrev.com/c/1434754.  That
was reverted due to excessive renderer crashes.  As an interim step this CL
instead ignores code cache when the origin seems wrong.  We also add a
UMA to see how often its triggering in practice so we can start trying to
isolate the unexpected circumstances.

Bug: 925035
Change-Id: Iec4d0206ba5ed74950537d74a4ad180ee6b98905
Commit-Queue: Ben Kelly <wanderview@chromium.org>
Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Reviewed-by: Robert Kaplow <rkaplow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#709036}
Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>

1 files changed, 6 insertions, 6 deletions

diff --git a/chromium/content/browser/renderer_host/code_cache_host_impl.h b/chromium/content/browser/renderer_host/code_cache_host_impl.h
index 1f4a7f5401e..30b05af8512 100644
--- a/chromium/content/browser/renderer_host/code_cache_host_impl.h
+++ b/chromium/content/browser/renderer_host/code_cache_host_impl.h
@@ -44,14 +44,12 @@ class CONTENT_EXPORT CodeCacheHostImpl : public blink::mojom::CodeCacheHost {
   CodeCacheHostImpl(
       int render_process_id,
       scoped_refptr<CacheStorageContextImpl> cache_storage_context,
-      scoped_refptr<GeneratedCodeCacheContext> generated_code_cache_context);
-  ~CodeCacheHostImpl() override;
-
-  static void Create(
-      int render_process_id,
-      scoped_refptr<CacheStorageContextImpl> cache_storage_context,
       scoped_refptr<GeneratedCodeCacheContext> generated_code_cache_context,
       blink::mojom::CodeCacheHostRequest request);
+  ~CodeCacheHostImpl() override;
+
+  void SetCacheStorageContextForTesting(
+      scoped_refptr<CacheStorageContextImpl> context);
 
  private:
   // blink::mojom::CodeCacheHost implementation.
@@ -91,6 +89,8 @@ class CONTENT_EXPORT CodeCacheHostImpl : public blink::mojom::CodeCacheHost {
 
   scoped_refptr<GeneratedCodeCacheContext> generated_code_cache_context_;
 
+  mojo::Binding<blink::mojom::CodeCacheHost> binding_;
+
   base::WeakPtrFactory<CodeCacheHostImpl> weak_ptr_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(CodeCacheHostImpl);