OLD | NEW |
1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/browser_thread.h" | 5 #include "chrome/browser/browser_thread.h" |
6 #include "chrome/browser/browser_url_handler.h" | 6 #include "chrome/browser/browser_url_handler.h" |
7 #include "chrome/browser/renderer_host/site_instance.h" | 7 #include "chrome/browser/renderer_host/site_instance.h" |
8 #include "chrome/browser/renderer_host/test/test_render_view_host.h" | 8 #include "chrome/browser/renderer_host/test/test_render_view_host.h" |
9 #include "chrome/browser/tab_contents/navigation_controller.h" | 9 #include "chrome/browser/tab_contents/navigation_controller.h" |
10 #include "chrome/browser/tab_contents/navigation_entry.h" | 10 #include "chrome/browser/tab_contents/navigation_entry.h" |
(...skipping 295 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
306 GURL url2("http://www.evil-site.com/"); | 306 GURL url2("http://www.evil-site.com/"); |
307 | 307 |
308 // Navigate to a safe site, then an evil site. | 308 // Navigate to a safe site, then an evil site. |
309 // This will switch RenderViewHosts. We cannot assert that the first and | 309 // This will switch RenderViewHosts. We cannot assert that the first and |
310 // second RVHs are different, though, because the first one may be promptly | 310 // second RVHs are different, though, because the first one may be promptly |
311 // deleted. | 311 // deleted. |
312 contents()->NavigateAndCommit(url1); | 312 contents()->NavigateAndCommit(url1); |
313 contents()->NavigateAndCommit(url2); | 313 contents()->NavigateAndCommit(url2); |
314 RenderViewHost* evil_rvh = contents()->render_view_host(); | 314 RenderViewHost* evil_rvh = contents()->render_view_host(); |
315 | 315 |
316 // Casts the TabContents to a RenderViewHostDelegate::BrowserIntegration so we | |
317 // can call GoToEntryAtOffset which is private. | |
318 RenderViewHostDelegate::BrowserIntegration* rvh_delegate = | |
319 static_cast<RenderViewHostDelegate::BrowserIntegration*>(contents()); | |
320 | |
321 // Now let's simulate the evil page calling history.back(). | 316 // Now let's simulate the evil page calling history.back(). |
322 rvh_delegate->GoToEntryAtOffset(-1); | 317 contents()->OnGoToEntryAtOffset(-1); |
323 // We should have a new pending RVH. | 318 // We should have a new pending RVH. |
324 // Note that in this case, the navigation has not committed, so evil_rvh will | 319 // Note that in this case, the navigation has not committed, so evil_rvh will |
325 // not be deleted yet. | 320 // not be deleted yet. |
326 EXPECT_NE(evil_rvh, contents()->render_manager()->pending_render_view_host()); | 321 EXPECT_NE(evil_rvh, contents()->render_manager()->pending_render_view_host()); |
327 | 322 |
328 // Before that RVH has committed, the evil page reloads itself. | 323 // Before that RVH has committed, the evil page reloads itself. |
329 ViewHostMsg_FrameNavigate_Params params; | 324 ViewHostMsg_FrameNavigate_Params params; |
330 params.page_id = 1; | 325 params.page_id = 1; |
331 params.url = url2; | 326 params.url = url2; |
332 params.transition = PageTransition::CLIENT_REDIRECT; | 327 params.transition = PageTransition::CLIENT_REDIRECT; |
333 params.should_update_history = false; | 328 params.should_update_history = false; |
334 params.gesture = NavigationGestureAuto; | 329 params.gesture = NavigationGestureAuto; |
335 params.was_within_same_page = false; | 330 params.was_within_same_page = false; |
336 params.is_post = false; | 331 params.is_post = false; |
337 contents()->TestDidNavigate(evil_rvh, params); | 332 contents()->TestDidNavigate(evil_rvh, params); |
338 | 333 |
339 // That should have cancelled the pending RVH, and the evil RVH should be the | 334 // That should have cancelled the pending RVH, and the evil RVH should be the |
340 // current one. | 335 // current one. |
341 EXPECT_TRUE(contents()->render_manager()->pending_render_view_host() == NULL); | 336 EXPECT_TRUE(contents()->render_manager()->pending_render_view_host() == NULL); |
342 EXPECT_EQ(evil_rvh, contents()->render_manager()->current_host()); | 337 EXPECT_EQ(evil_rvh, contents()->render_manager()->current_host()); |
343 | 338 |
344 // Also we should not have a pending navigation entry. | 339 // Also we should not have a pending navigation entry. |
345 NavigationEntry* entry = contents()->controller().GetActiveEntry(); | 340 NavigationEntry* entry = contents()->controller().GetActiveEntry(); |
346 ASSERT_TRUE(entry != NULL); | 341 ASSERT_TRUE(entry != NULL); |
347 EXPECT_EQ(url2, entry->url()); | 342 EXPECT_EQ(url2, entry->url()); |
348 } | 343 } |
OLD | NEW |