OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/command_line.h" | 5 #include "base/command_line.h" |
6 #include "base/containers/hash_tables.h" | 6 #include "base/containers/hash_tables.h" |
7 #include "base/strings/utf_string_conversions.h" | 7 #include "base/strings/utf_string_conversions.h" |
8 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" | 8 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" |
9 #include "content/browser/dom_storage/session_storage_namespace_impl.h" | 9 #include "content/browser/dom_storage/session_storage_namespace_impl.h" |
10 #include "content/browser/frame_host/navigator.h" | 10 #include "content/browser/frame_host/navigator.h" |
(...skipping 218 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
229 AttemptDuplicateRenderWidgetHost) { | 229 AttemptDuplicateRenderWidgetHost) { |
230 int duplicate_routing_id = MSG_ROUTING_NONE; | 230 int duplicate_routing_id = MSG_ROUTING_NONE; |
231 RenderViewHostImpl* pending_rvh = | 231 RenderViewHostImpl* pending_rvh = |
232 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); | 232 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); |
233 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); | 233 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); |
234 | 234 |
235 // Since this test executes on the UI thread and hopping threads might cause | 235 // Since this test executes on the UI thread and hopping threads might cause |
236 // different timing in the test, let's simulate a CreateNewWidget call coming | 236 // different timing in the test, let's simulate a CreateNewWidget call coming |
237 // from the IO thread. Use the existing window routing id to cause a | 237 // from the IO thread. Use the existing window routing id to cause a |
238 // deliberate collision. | 238 // deliberate collision. |
239 pending_rvh->CreateNewWidget(duplicate_routing_id, 0 /* surface_id */, | 239 pending_rvh->CreateNewWidget(duplicate_routing_id, blink::WebPopupTypePage); |
240 blink::WebPopupTypePage); | |
241 | 240 |
242 // If the above operation doesn't crash, the test has succeeded! | 241 // If the above operation doesn't crash, the test has succeeded! |
243 } | 242 } |
244 | 243 |
245 // This is a test for crbug.com/444198. It tries to send a | 244 // This is a test for crbug.com/444198. It tries to send a |
246 // ViewHostMsg_RunFileChooser containing an invalid path. The browser should | 245 // ViewHostMsg_RunFileChooser containing an invalid path. The browser should |
247 // correctly terminate the renderer in these cases. | 246 // correctly terminate the renderer in these cases. |
248 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, AttemptRunFileChoosers) { | 247 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, AttemptRunFileChoosers) { |
249 TestFileChooserWithPath(base::FilePath(FILE_PATH_LITERAL("../../*.txt"))); | 248 TestFileChooserWithPath(base::FilePath(FILE_PATH_LITERAL("../../*.txt"))); |
250 TestFileChooserWithPath(base::FilePath(FILE_PATH_LITERAL("/etc/*.conf"))); | 249 TestFileChooserWithPath(base::FilePath(FILE_PATH_LITERAL("/etc/*.conf"))); |
(...skipping 177 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
428 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 427 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
429 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 428 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
430 web_rfh->GetProcess()->GetChannel(), | 429 web_rfh->GetProcess()->GetChannel(), |
431 ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(), 1, | 430 ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(), 1, |
432 invalid_scheme_origin_msg)); | 431 invalid_scheme_origin_msg)); |
433 web_process_killed.Wait(); | 432 web_process_killed.Wait(); |
434 } | 433 } |
435 } | 434 } |
436 | 435 |
437 } // namespace content | 436 } // namespace content |
OLD | NEW |