Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(422)

Side by Side Diff: content/renderer/render_frame_impl.cc

Issue 212763004: Use SYZYASAN instead of ADDRESS_SANITIZER. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/renderer/render_frame_impl.h" 5 #include "content/renderer/render_frame_impl.h"
6 6
7 #include <map> 7 #include <map>
8 #include <string> 8 #include <string>
9 9
10 #include "base/auto_reset.h" 10 #include "base/auto_reset.h"
(...skipping 152 matching lines...) Expand 10 before | Expand all | Expand 10 after
163 } 163 }
164 } 164 }
165 165
166 NOINLINE static void CrashIntentionally() { 166 NOINLINE static void CrashIntentionally() {
167 // NOTE(shess): Crash directly rather than using NOTREACHED() so 167 // NOTE(shess): Crash directly rather than using NOTREACHED() so
168 // that the signature is easier to triage in crash reports. 168 // that the signature is easier to triage in crash reports.
169 volatile int* zero = NULL; 169 volatile int* zero = NULL;
170 *zero = 0; 170 *zero = 0;
171 } 171 }
172 172
173 #if defined(ADDRESS_SANITIZER) 173 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
174 NOINLINE static void MaybeTriggerAsanError(const GURL& url) { 174 NOINLINE static void MaybeTriggerAsanError(const GURL& url) {
175 // NOTE(rogerm): We intentionally perform an invalid heap access here in 175 // NOTE(rogerm): We intentionally perform an invalid heap access here in
176 // order to trigger an Address Sanitizer (ASAN) error report. 176 // order to trigger an Address Sanitizer (ASAN) error report.
177 static const char kCrashDomain[] = "crash"; 177 static const char kCrashDomain[] = "crash";
178 static const char kHeapOverflow[] = "/heap-overflow"; 178 static const char kHeapOverflow[] = "/heap-overflow";
179 static const char kHeapUnderflow[] = "/heap-underflow"; 179 static const char kHeapUnderflow[] = "/heap-underflow";
180 static const char kUseAfterFree[] = "/use-after-free"; 180 static const char kUseAfterFree[] = "/use-after-free";
181 static const int kArraySize = 5; 181 static const int kArraySize = 5;
182 182
183 if (!url.DomainIs(kCrashDomain, sizeof(kCrashDomain) - 1)) 183 if (!url.DomainIs(kCrashDomain, sizeof(kCrashDomain) - 1))
(...skipping 11 matching lines...) Expand all
195 dummy = array[-1]; 195 dummy = array[-1];
196 } else if (crash_type == kUseAfterFree) { 196 } else if (crash_type == kUseAfterFree) {
197 int* dangling = array.get(); 197 int* dangling = array.get();
198 array.reset(); 198 array.reset();
199 dummy = dangling[kArraySize / 2]; 199 dummy = dangling[kArraySize / 2];
200 } 200 }
201 201
202 // Make sure the assignments to the dummy value aren't optimized away. 202 // Make sure the assignments to the dummy value aren't optimized away.
203 base::debug::Alias(&dummy); 203 base::debug::Alias(&dummy);
204 } 204 }
205 #endif // ADDRESS_SANITIZER 205 #endif // ADDRESS_SANITIZER || SYZYASAN
206 206
207 static void MaybeHandleDebugURL(const GURL& url) { 207 static void MaybeHandleDebugURL(const GURL& url) {
208 if (!url.SchemeIs(kChromeUIScheme)) 208 if (!url.SchemeIs(kChromeUIScheme))
209 return; 209 return;
210 if (url == GURL(kChromeUICrashURL)) { 210 if (url == GURL(kChromeUICrashURL)) {
211 CrashIntentionally(); 211 CrashIntentionally();
212 } else if (url == GURL(kChromeUIKillURL)) { 212 } else if (url == GURL(kChromeUIKillURL)) {
213 base::KillProcess(base::GetCurrentProcessHandle(), 1, false); 213 base::KillProcess(base::GetCurrentProcessHandle(), 1, false);
214 } else if (url == GURL(kChromeUIHangURL)) { 214 } else if (url == GURL(kChromeUIHangURL)) {
215 for (;;) { 215 for (;;) {
216 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); 216 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1));
217 } 217 }
218 } else if (url == GURL(kChromeUIShorthangURL)) { 218 } else if (url == GURL(kChromeUIShorthangURL)) {
219 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(20)); 219 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(20));
220 } 220 }
221 221
222 #if defined(ADDRESS_SANITIZER) 222 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
223 MaybeTriggerAsanError(url); 223 MaybeTriggerAsanError(url);
224 #endif // ADDRESS_SANITIZER 224 #endif // ADDRESS_SANITIZER || SYZYASAN
225 } 225 }
226 226
227 // Returns false unless this is a top-level navigation. 227 // Returns false unless this is a top-level navigation.
228 static bool IsTopLevelNavigation(WebFrame* frame) { 228 static bool IsTopLevelNavigation(WebFrame* frame) {
229 return frame->parent() == NULL; 229 return frame->parent() == NULL;
230 } 230 }
231 231
232 // Returns false unless this is a top-level navigation that crosses origins. 232 // Returns false unless this is a top-level navigation that crosses origins.
233 static bool IsNonLocalTopLevelNavigation(const GURL& url, 233 static bool IsNonLocalTopLevelNavigation(const GURL& url,
234 WebFrame* frame, 234 WebFrame* frame,
(...skipping 2520 matching lines...) Expand 10 before | Expand all | Expand 10 after
2755 } 2755 }
2756 2756
2757 Send(new FrameHostMsg_OpenURL(routing_id_, params)); 2757 Send(new FrameHostMsg_OpenURL(routing_id_, params));
2758 } 2758 }
2759 2759
2760 void RenderFrameImpl::didChangeLoadProgress(double load_progress) { 2760 void RenderFrameImpl::didChangeLoadProgress(double load_progress) {
2761 render_view_->didChangeLoadProgress(frame_, load_progress); 2761 render_view_->didChangeLoadProgress(frame_, load_progress);
2762 } 2762 }
2763 2763
2764 } // namespace content 2764 } // namespace content
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698