content/renderer/render_font_warmup_win.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/public/renderer/render_font_warmup_win.h"
   6
   7 #include <dwrite.h>
   8
   9 #include "base/debug/alias.h"
  10 #include "base/logging.h"
  11 #include "base/win/iat_patch_function.h"
  12 #include "base/win/windows_version.h"
  13 #include "content/public/common/dwrite_font_platform_win.h"
  14 #include "third_party/WebKit/public/web/win/WebFontRendering.h"
  15 #include "third_party/skia/include/core/SkPaint.h"
  16 #include "third_party/skia/include/ports/SkFontMgr.h"
  17 #include "third_party/skia/include/ports/SkTypeface_win.h"
  18
  19 namespace content {
  20
  21 namespace {
  22
  23 SkFontMgr* g_warmup_fontmgr = NULL;
  24
  25 base::win::IATPatchFunction g_iat_patch_open_sc_manager;
  26 base::win::IATPatchFunction g_iat_patch_close_service_handle;
  27 base::win::IATPatchFunction g_iat_patch_open_service;
  28 base::win::IATPatchFunction g_iat_patch_start_service;
  29 base::win::IATPatchFunction g_iat_patch_nt_connect_port;
  30
  31 // These are from ntddk.h
  32 #if !defined(STATUS_ACCESS_DENIED)
  33 #define STATUS_ACCESS_DENIED   ((NTSTATUS)0xC0000022L)
  34 #endif
  35
  36 typedef LONG NTSTATUS;
  37
  38 SC_HANDLE WINAPI OpenSCManagerWPatch(const wchar_t* machine_name,
  39                                      const wchar_t* database_name,
  40                                      DWORD access_mask) {
  41   ::SetLastError(0);
  42   return reinterpret_cast<SC_HANDLE>(0xdeadbeef);
  43 }
  44
  45 SC_HANDLE WINAPI OpenServiceWPatch(SC_HANDLE sc_manager,
  46                                    const wchar_t* service_name,
  47                                    DWORD access_mask) {
  48   ::SetLastError(0);
  49   return reinterpret_cast<SC_HANDLE>(0xdeadbabe);
  50 }
  51
  52 BOOL WINAPI CloseServiceHandlePatch(SC_HANDLE service_handle) {
  53   if (service_handle != reinterpret_cast<SC_HANDLE>(0xdeadbabe) &&
  54       service_handle != reinterpret_cast<SC_HANDLE>(0xdeadbeef))
  55     CHECK(false);
  56   ::SetLastError(0);
  57   return TRUE;
  58 }
  59
  60 BOOL WINAPI StartServiceWPatch(SC_HANDLE service,
  61                                DWORD args,
  62                                const wchar_t** arg_vectors) {
  63   if (service != reinterpret_cast<SC_HANDLE>(0xdeadbabe))
  64     CHECK(false);
  65   ::SetLastError(ERROR_ACCESS_DENIED);
  66   return FALSE;
  67 }
  68
  69 NTSTATUS WINAPI NtALpcConnectPortPatch(HANDLE* port_handle,
  70                                        void* port_name,
  71                                        void* object_attribs,
  72                                        void* port_attribs,
  73                                        DWORD flags,
  74                                        void* server_sid,
  75                                        void* message,
  76                                        DWORD* buffer_length,
  77                                        void* out_message_attributes,
  78                                        void* in_message_attributes,
  79                                        void* time_out) {
  80   return STATUS_ACCESS_DENIED;
  81 }
  82
  83 // Directwrite connects to the font cache service to retrieve information about
  84 // fonts installed on the system etc. This works well outside the sandbox and
  85 // within the sandbox as long as the lpc connection maintained by the current
  86 // process with the font cache service remains valid. It appears that there
  87 // are cases when this connection is dropped after which directwrite is unable
  88 // to connect to the font cache service which causes problems with characters
  89 // disappearing.
  90 // Directwrite has fallback code to enumerate fonts if it is unable to connect
  91 // to the font cache service. We need to intercept the following APIs to
  92 // ensure that it does not connect to the font cache service.
  93 // NtALpcConnectPort
  94 // OpenSCManagerW
  95 // OpenServiceW
  96 // StartServiceW
  97 // CloseServiceHandle.
  98 // These are all IAT patched.
  99 void PatchServiceManagerCalls() {
 100   static bool is_patched = false;
 101   if (is_patched)
 102     return;
 103   const char* service_provider_dll =
 104       (base::win::GetVersion() >= base::win::VERSION_WIN8 ?
 105           "api-ms-win-service-management-l1-1-0.dll" : "advapi32.dll");
 106
 107   is_patched = true;
 108
 109   DWORD patched = g_iat_patch_open_sc_manager.Patch(L"dwrite.dll",
 110       service_provider_dll, "OpenSCManagerW", OpenSCManagerWPatch);
 111   DCHECK(patched == 0);
 112
 113   patched = g_iat_patch_close_service_handle.Patch(L"dwrite.dll",
 114       service_provider_dll, "CloseServiceHandle", CloseServiceHandlePatch);
 115   DCHECK(patched == 0);
 116
 117   patched = g_iat_patch_open_service.Patch(L"dwrite.dll",
 118       service_provider_dll, "OpenServiceW", OpenServiceWPatch);
 119   DCHECK(patched == 0);
 120
 121   patched = g_iat_patch_start_service.Patch(L"dwrite.dll",
 122       service_provider_dll, "StartServiceW", StartServiceWPatch);
 123   DCHECK(patched == 0);
 124
 125   patched = g_iat_patch_nt_connect_port.Patch(L"dwrite.dll",
 126       "ntdll.dll", "NtAlpcConnectPort", NtALpcConnectPortPatch);
 127   DCHECK(patched == 0);
 128 }
 129
 130 // Windows-only DirectWrite support. These warm up the DirectWrite paths
 131 // before sandbox lock down to allow Skia access to the Font Manager service.
 132 void CreateDirectWriteFactory(IDWriteFactory** factory) {
 133   typedef decltype(DWriteCreateFactory)* DWriteCreateFactoryProc;
 134   HMODULE dwrite_dll = LoadLibraryW(L"dwrite.dll");
 135   // TODO(scottmg): Temporary code to track crash in http://crbug.com/387867.
 136   if (!dwrite_dll) {
 137     DWORD load_library_get_last_error = GetLastError();
 138     base::debug::Alias(&dwrite_dll);
 139     base::debug::Alias(&load_library_get_last_error);
 140     CHECK(false);
 141   }
 142
 143   PatchServiceManagerCalls();
 144
 145   DWriteCreateFactoryProc dwrite_create_factory_proc =
 146       reinterpret_cast<DWriteCreateFactoryProc>(
 147           GetProcAddress(dwrite_dll, "DWriteCreateFactory"));
 148   // TODO(scottmg): Temporary code to track crash in http://crbug.com/387867.
 149   if (!dwrite_create_factory_proc) {
 150     DWORD get_proc_address_get_last_error = GetLastError();
 151     base::debug::Alias(&dwrite_create_factory_proc);
 152     base::debug::Alias(&get_proc_address_get_last_error);
 153     CHECK(false);
 154   }
 155   CHECK(SUCCEEDED(
 156       dwrite_create_factory_proc(DWRITE_FACTORY_TYPE_ISOLATED,
 157                                  __uuidof(IDWriteFactory),
 158                                  reinterpret_cast<IUnknown**>(factory))));
 159 }
 160
 161 HRESULT STDMETHODCALLTYPE StubFontCollection(IDWriteFactory* factory,
 162                                              IDWriteFontCollection** col,
 163                                              BOOL checkUpdates) {
 164   // We always return pre-created font collection from here.
 165   IDWriteFontCollection* custom_collection = GetCustomFontCollection(factory);
 166   DCHECK(custom_collection != NULL);
 167   *col = custom_collection;
 168   return S_OK;
 169 }
 170
 171 void PatchDWriteFactory(IDWriteFactory* factory) {
 172   const unsigned int kGetSystemFontCollectionVTableIndex = 3;
 173
 174   PROC* vtable = *reinterpret_cast<PROC**>(factory);
 175   PROC* function_ptr = &vtable[kGetSystemFontCollectionVTableIndex];
 176   void* stub_function = &StubFontCollection;
 177   base::win::ModifyCode(function_ptr, &stub_function, sizeof(PROC));
 178 }
 179
 180 }  // namespace
 181
 182 void DoPreSandboxWarmupForTypeface(SkTypeface* typeface) {
 183   SkPaint paint_warmup;
 184   paint_warmup.setTypeface(typeface);
 185   wchar_t glyph = L'S';
 186   paint_warmup.measureText(&glyph, 2);
 187 }
 188
 189 SkFontMgr* GetPreSandboxWarmupFontMgr() {
 190   if (!g_warmup_fontmgr) {
 191     IDWriteFactory* factory;
 192     CreateDirectWriteFactory(&factory);
 193
 194     GetCustomFontCollection(factory);
 195
 196     PatchDWriteFactory(factory);
 197
 198     blink::WebFontRendering::setDirectWriteFactory(factory);
 199     g_warmup_fontmgr = SkFontMgr_New_DirectWrite(factory);
 200   }
 201   return g_warmup_fontmgr;
 202 }
 203
 204 }  // namespace content