content/renderer/render_view_browsertest.cc - Issue 112203003: Fix renderer crashes when frame gets detached while injectng user scripts.

Side by Side Diff: content/renderer/render_view_browsertest.cc

Issue 112203003: Fix renderer crashes when frame gets detached while injectng user scripts. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Defer frame destruction until event loop. Created 6 years, 10 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.	1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.

2 // Use of this source code is governed by a BSD-style license that can be	2 // Use of this source code is governed by a BSD-style license that can be

3 // found in the LICENSE file.	3 // found in the LICENSE file.

4	4

5 #include "base/basictypes.h"	5 #include "base/basictypes.h"

6 #include "base/bind.h"	6 #include "base/bind.h"

7 #include "base/callback.h"	7 #include "base/callback.h"

8 #include "base/memory/shared_memory.h"	8 #include "base/memory/shared_memory.h"

9 #include "base/strings/string_util.h"	9 #include "base/strings/string_util.h"

10 #include "base/strings/utf_string_conversions.h"	10 #include "base/strings/utf_string_conversions.h"

(...skipping 22 matching lines...) Expand all Loading...
33 #include "net/cert/cert_status_flags.h"	33 #include "net/cert/cert_status_flags.h"

34 #include "testing/gtest/include/gtest/gtest.h"	34 #include "testing/gtest/include/gtest/gtest.h"

35 #include "third_party/WebKit/public/platform/WebData.h"	35 #include "third_party/WebKit/public/platform/WebData.h"

36 #include "third_party/WebKit/public/platform/WebHTTPBody.h"	36 #include "third_party/WebKit/public/platform/WebHTTPBody.h"

37 #include "third_party/WebKit/public/platform/WebString.h"	37 #include "third_party/WebKit/public/platform/WebString.h"

38 #include "third_party/WebKit/public/platform/WebURLResponse.h"	38 #include "third_party/WebKit/public/platform/WebURLResponse.h"

39 #include "third_party/WebKit/public/web/WebDataSource.h"	39 #include "third_party/WebKit/public/web/WebDataSource.h"

40 #include "third_party/WebKit/public/web/WebFrame.h"	40 #include "third_party/WebKit/public/web/WebFrame.h"

41 #include "third_party/WebKit/public/web/WebHistoryItem.h"	41 #include "third_party/WebKit/public/web/WebHistoryItem.h"

42 #include "third_party/WebKit/public/web/WebRuntimeFeatures.h"	42 #include "third_party/WebKit/public/web/WebRuntimeFeatures.h"

	43 #include "third_party/WebKit/public/web/WebScriptSource.h"

43 #include "third_party/WebKit/public/web/WebView.h"	44 #include "third_party/WebKit/public/web/WebView.h"

44 #include "third_party/WebKit/public/web/WebWindowFeatures.h"	45 #include "third_party/WebKit/public/web/WebWindowFeatures.h"

45 #include "ui/events/keycodes/keyboard_codes.h"	46 #include "ui/events/keycodes/keyboard_codes.h"

46 #include "ui/gfx/codec/jpeg_codec.h"	47 #include "ui/gfx/codec/jpeg_codec.h"

47 #include "ui/gfx/range/range.h"	48 #include "ui/gfx/range/range.h"

48	49

49 #if defined(OS_LINUX) && !defined(USE_AURA)	50 #if defined(OS_LINUX) && !defined(USE_AURA)

50 #include "ui/base/gtk/event_synthesis_gtk.h"	51 #include "ui/base/gtk/event_synthesis_gtk.h"

51 #endif	52 #endif

52	53

(...skipping 2190 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
2243	2244

2244 view()->webview()->clearFocusedNode();	2245 view()->webview()->clearFocusedNode();

2245 const IPC::Message* msg3 = render_thread_->sink().GetFirstMessageMatching(	2246 const IPC::Message* msg3 = render_thread_->sink().GetFirstMessageMatching(

2246 ViewHostMsg_FocusedNodeChanged::ID);	2247 ViewHostMsg_FocusedNodeChanged::ID);

2247 EXPECT_TRUE(msg3);	2248 EXPECT_TRUE(msg3);

2248 ViewHostMsg_FocusedNodeChanged::Read(msg3, &params);	2249 ViewHostMsg_FocusedNodeChanged::Read(msg3, &params);

2249 EXPECT_FALSE(params.a);	2250 EXPECT_FALSE(params.a);

2250 render_thread_->sink().ClearMessages();	2251 render_thread_->sink().ClearMessages();

2251 }	2252 }

2252	2253

	2254 class SynchronousFrameRemovalOnLoadTest : public RenderViewImplTest {

	2255 protected:

	2256 // Helper render view observer class that tries to remove

	2257 // element with id 'frame' from top frame/document DOM

	2258 // when non-top frame finishes loading.

	2259 class OnLoadFrameRemover : public RenderViewObserver {

	2260 public:

	2261 explicit OnLoadFrameRemover(RenderView* render_view) :

	2262 RenderViewObserver(render_view) {}

	2263 virtual ~OnLoadFrameRemover() {}

	2264

	2265 virtual void DidFinishDocumentLoad(blink::WebFrame* frame) OVERRIDE {

	2266 if (frame->top() != frame) {

	2267 frame->top()->executeScript(blink::WebScriptSource(

	2268 WebString::fromUTF8(

	2269 "document.getElementById('frame').remove();")));

	2270 }

	2271 }

	2272 };

	2273 };

	2274

	2275 // Tests if synchronously removing a frame on its load does not cause crashes.

	2276 TEST_F(SynchronousFrameRemovalOnLoadTest, DynamicallyInsertedFrame) {

	2277 OnLoadFrameRemover remover(view());

	2278 LoadHTML("<!DOCTYPE html>"

	2279 "<html>"

	2280 "<head>"

	2281 "<title></title>"

	2282 "<script type='text/javascript' language='javascript'>"

	2283 "window.onload = function () {"

	2284 " frame = document.createElement('iframe');"

	2285 " frame.id = 'frame';"

	2286 " document.body.appendChild(frame);"

	2287 "}"

	2288 "</script>"

	2289 "</head>"

	2290 "<body></body>"

	2291 "</html>");

	2292 }

	2293

	2294 TEST_F(SynchronousFrameRemovalOnLoadTest, StaticFrame) {

	2295 OnLoadFrameRemover remover(view());

	2296 LoadHTML("<!DOCTYPE html>"

	2297 "<html>"

	2298 "<head>"

	2299 "<title></title>"

	2300 "</head>"

	2301 "<body>"

	2302 "<iframe id='frame' src='about:blank'></iframe>"

	2303 "</body>"

	2304 "</html>");

	2305 }

	2306

2253 } // namespace content	2307 } // namespace content

OLD	NEW

« content/renderer/render_frame_impl.cc ('K') | « content/renderer/render_frame_impl.cc ('k') | content/renderer/render_view_impl.h » ('j') | content/renderer/render_view_impl.h » ('J')