Add test for filtering of IPC messages when RenderFrameHost is swapped out.

content/browser/frame_host/render_frame_host_manager_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/files/file_path.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/frame_host/cross_site_transferring_request.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_manager.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
@@ skipping 226 matching lines @@
   dest_rvh2->OnSwappedOut(false);
   static_cast<TestRenderViewHost*>(contents2->GetRenderManagerForTesting()->
      pending_render_view_host())->SendNavigate(102, kChromeUrl);
 
   EXPECT_NE(active_rvh()->GetSiteInstance(),
             contents2->GetRenderViewHost()->GetSiteInstance());
   EXPECT_EQ(active_rvh()->GetSiteInstance()->GetProcess(),
             contents2->GetRenderViewHost()->GetSiteInstance()->GetProcess());
 }
 
+// This observer is used to check whether IPC messages are being filtered for
+// swapped out RenderFrameHost objects. It observes the plugin crash events,
+// which the test which follows it simulates being sent. The test is succsesful

[Charlie Reis, 2014/03/19 20:40:57]

nit: which the FilterMessagesWhileSwappedOut test simulates
nit: successful

[nasko, 2014/03/21 20:32:56]

Done.

+// if the event is not observed. See http://crbug.com/351815
+class PluginCrashObserver : public WebContentsObserver {
+ public:
+  PluginCrashObserver(WebContents* web_contents)
+      : WebContentsObserver(web_contents),
+        event_triggered_(false) {}
+
+  virtual void PluginCrashed(const base::FilePath& plugin_path,
+                             base::ProcessId plugin_pid) OVERRIDE {
+    event_triggered_ = true;
+  }
+
+  bool event_triggered() {
+    return event_triggered_;
+  }
+
+ private:
+  bool event_triggered_;
+
+  DISALLOW_COPY_AND_ASSIGN(PluginCrashObserver);
+};
+
 // Ensure that the browser ignores most IPC messages that arrive from a
 // RenderViewHost that has been swapped out.  We do not want to take
 // action on requests from a non-active renderer.  The main exception is
 // for synchronous messages, which cannot be ignored without leaving the
 // renderer in a stuck state.  See http://crbug.com/93427.
 TEST_F(RenderFrameHostManagerTest, FilterMessagesWhileSwappedOut) {
   const GURL kChromeURL("chrome://foo");
   const GURL kDestUrl("http://www.google.com/");
 
   // Navigate our first tab to a chrome url and then to the destination.
@@ skipping 36 matching lines @@
                               direction)));
   EXPECT_EQ(dest_title, contents()->GetTitle());
 
   // The old renderer, being slow, now updates the title. It should be filtered
   // out and not take effect.
   EXPECT_EQ(RenderViewHostImpl::STATE_PENDING_SWAP_OUT, ntp_rvh->rvh_state());
   EXPECT_TRUE(ntp_rvh->OnMessageReceived(
       ViewHostMsg_UpdateTitle(rvh()->GetRoutingID(), 0, ntp_title, direction)));
   EXPECT_EQ(dest_title, contents()->GetTitle());
 
+  // The same logic should apply to RenderFrameHosts as well and routing through
+  // swapped out RFH shouldn't be allowed. Use a PluginCrashObserver to check
+  // if the IPC message is allowed through or not.
+  PluginCrashObserver crash_observer(contents());
+  // TODO(nasko): The following line shouldn't be needed when we are properly
+  // swapping out RFH objects or move to proxy objects.
+  ntp_rvh->main_render_frame_host()->set_swapped_out(true);

[Charlie Reis, 2014/03/19 20:40:57]

Is this line actually needed?  You're checking for whether the RVH is swapped
out in OnMessageReceived.

[nasko, 2014/03/21 20:32:56]

Quite a bit has changed, so this is no longer applicable.

+  EXPECT_TRUE(ntp_rvh->main_render_frame_host()->is_swapped_out());
+  EXPECT_TRUE(ntp_rvh->main_render_frame_host()->OnMessageReceived(
+      FrameHostMsg_PluginCrashed(
+          main_rfh()->GetRoutingID(), base::FilePath(), 0)));
+  EXPECT_FALSE(crash_observer.event_triggered());
+
   // We cannot filter out synchronous IPC messages, because the renderer would
   // be left waiting for a reply.  We pick RunBeforeUnloadConfirm as an example
   // that can run easily within a unit test, and that needs to receive a reply
   // without showing an actual dialog.
   MockRenderProcessHost* ntp_process_host =
       static_cast<MockRenderProcessHost*>(ntp_rvh->GetProcess());
   ntp_process_host->sink().ClearMessages();
   const base::string16 msg = base::ASCIIToUTF16("Message");
   bool result = false;
   base::string16 unused;
@@ skipping 1256 matching lines @@
 
   // Simulate the swap out ack.
   rvh1->OnSwappedOut(false);
 
   // rvh1 should be swapped out.
   EXPECT_FALSE(destruction_observer.rvh_deleted());
   EXPECT_TRUE(rvh1->IsSwappedOut());
 }
 
 }  // namespace content