Ignore InputMsg IPCs if RenderView is in swapped out state.

content/browser/frame_host/render_frame_host_manager_browsertest.cc

Index: content/browser/frame_host/render_frame_host_manager_browsertest.cc
diff --git a/content/browser/frame_host/render_frame_host_manager_browsertest.cc b/content/browser/frame_host/render_frame_host_manager_browsertest.cc
index 0cea2ed130aa2bfdeee417b27e28568519b477f1..1fb9c6d7732276aa34caa82caacbb41df64ce372 100644
--- a/content/browser/frame_host/render_frame_host_manager_browsertest.cc
+++ b/content/browser/frame_host/render_frame_host_manager_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webui/web_ui_impl.h"
 #include "content/common/content_constants_internal.h"
+#include "content/common/input_messages.h"
 #include "content/common/site_isolation_policy.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
@@ -2115,4 +2116,48 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   ResourceDispatcherHost::Get()->SetDelegate(nullptr);
 }
 
+// Tests that InputMsg type IPCs are ignored by swapped out RenderViews. It
+// uses the SetFocus IPC, as RenderView has a CHECK to ensure that condition
+// never happens.
+IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
+                       InputMsgToSwappedOutRVHIsIgnored) {
+  StartEmbeddedServer();
+  NavigateToURL(shell(),
+                embedded_test_server()->GetURL("a.com", "/title1.html"));

[nasko, 2015/10/15 23:18:26]

I missed to add EXPECT_TRUE on all calls to NavigateToURL, so added them in the
new patch.

[alexmos, 2015/10/16 00:49:15]

Thanks!  Note to self: I should get back to http://crbug.com/425335 some day and
get this to have WARN_UNUSED_RESULT.

+
+  // Open a popup to navigate cross-process.
+  Shell* new_shell =
+      OpenPopup(shell()->web_contents(), GURL(url::kAboutBlankURL), "foo");
+  EXPECT_EQ(shell()->web_contents()->GetSiteInstance(),
+            new_shell->web_contents()->GetSiteInstance());
+
+  // Keep a pointer to the RenderViewHost, which will be in swapped out
+  // state after navigating cross-process. This is how this test is causing
+  // a swapped out RenderView to receive InputMsg IPC message.
+  WebContentsImpl* new_web_contents =
+      static_cast<WebContentsImpl*>(new_shell->web_contents());

[alexmos, 2015/10/15 22:52:38]

nit: Is the cast to *Impl necessary?  Seems the rvh only exercises public APIs.

[nasko, 2015/10/15 23:18:26]

I either have to cast here or cast the call to GetRenderViewHost(), otherwise I
will get back a RenderViewHost. The Send method is not public on RVH.

[alexmos, 2015/10/16 00:49:15]

I thought Send() was public since RenderViewHost implements IPC::Sender, where
it is public.  But it doesn't matter now that you have the
GetSwappedOutRenderViewHost check.

+  RenderViewHostImpl* rvh = new_web_contents->GetRenderViewHost();
+
+  // Navigate the popup to a different site, so the |rvh| is swapped out.
+  NavigateToURL(new_shell,
+                embedded_test_server()->GetURL("b.com", "/title2.html"));
+  EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
+            new_shell->web_contents()->GetSiteInstance());

[alexmos, 2015/10/15 22:52:38]

nit: is it also worth checking that rvh now corresponds to what
GetSwappedOutRenderViewHost(A) returns?

[nasko, 2015/10/15 23:18:26]

Why not! Now I really need to cast the WebContents to the impl :).

+
+  // Setup a process observer to ensure there is no crash and send the IPC
+  // message.
+  RenderProcessHostWatcher watcher(
+      rvh->GetProcess(), RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  rvh->Send(new InputMsg_SetFocus(rvh->GetRoutingID(), true));
+
+  // The test must wait for a process to exit, but if the IPC message is
+  // properly ignored, there will be no crash. Therefore, navigate the
+  // original window to the same site as the popup, which will just exit the
+  // process cleanly.
+  NavigateToURL(shell(),
+                embedded_test_server()->GetURL("b.com", "/title3.html"));
+  watcher.Wait();
+  EXPECT_TRUE(watcher.did_exit_normally());
+}
+
 }  // namespace content