OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/renderer/render_frame_impl.h" | 5 #include "content/renderer/render_frame_impl.h" |
6 | 6 |
7 #include <map> | 7 #include <map> |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/auto_reset.h" | 10 #include "base/auto_reset.h" |
(...skipping 152 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
163 } | 163 } |
164 } | 164 } |
165 | 165 |
166 NOINLINE static void CrashIntentionally() { | 166 NOINLINE static void CrashIntentionally() { |
167 // NOTE(shess): Crash directly rather than using NOTREACHED() so | 167 // NOTE(shess): Crash directly rather than using NOTREACHED() so |
168 // that the signature is easier to triage in crash reports. | 168 // that the signature is easier to triage in crash reports. |
169 volatile int* zero = NULL; | 169 volatile int* zero = NULL; |
170 *zero = 0; | 170 *zero = 0; |
171 } | 171 } |
172 | 172 |
173 #if defined(ADDRESS_SANITIZER) | 173 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN) |
174 NOINLINE static void MaybeTriggerAsanError(const GURL& url) { | 174 NOINLINE static void MaybeTriggerAsanError(const GURL& url) { |
175 // NOTE(rogerm): We intentionally perform an invalid heap access here in | 175 // NOTE(rogerm): We intentionally perform an invalid heap access here in |
176 // order to trigger an Address Sanitizer (ASAN) error report. | 176 // order to trigger an Address Sanitizer (ASAN) error report. |
177 static const char kCrashDomain[] = "crash"; | 177 static const char kCrashDomain[] = "crash"; |
178 static const char kHeapOverflow[] = "/heap-overflow"; | 178 static const char kHeapOverflow[] = "/heap-overflow"; |
179 static const char kHeapUnderflow[] = "/heap-underflow"; | 179 static const char kHeapUnderflow[] = "/heap-underflow"; |
180 static const char kUseAfterFree[] = "/use-after-free"; | 180 static const char kUseAfterFree[] = "/use-after-free"; |
181 static const int kArraySize = 5; | 181 static const int kArraySize = 5; |
182 | 182 |
183 if (!url.DomainIs(kCrashDomain, sizeof(kCrashDomain) - 1)) | 183 if (!url.DomainIs(kCrashDomain, sizeof(kCrashDomain) - 1)) |
(...skipping 11 matching lines...) Expand all Loading... |
195 dummy = array[-1]; | 195 dummy = array[-1]; |
196 } else if (crash_type == kUseAfterFree) { | 196 } else if (crash_type == kUseAfterFree) { |
197 int* dangling = array.get(); | 197 int* dangling = array.get(); |
198 array.reset(); | 198 array.reset(); |
199 dummy = dangling[kArraySize / 2]; | 199 dummy = dangling[kArraySize / 2]; |
200 } | 200 } |
201 | 201 |
202 // Make sure the assignments to the dummy value aren't optimized away. | 202 // Make sure the assignments to the dummy value aren't optimized away. |
203 base::debug::Alias(&dummy); | 203 base::debug::Alias(&dummy); |
204 } | 204 } |
205 #endif // ADDRESS_SANITIZER | 205 #endif // ADDRESS_SANITIZER || SYZYASAN |
206 | 206 |
207 static void MaybeHandleDebugURL(const GURL& url) { | 207 static void MaybeHandleDebugURL(const GURL& url) { |
208 if (!url.SchemeIs(kChromeUIScheme)) | 208 if (!url.SchemeIs(kChromeUIScheme)) |
209 return; | 209 return; |
210 if (url == GURL(kChromeUICrashURL)) { | 210 if (url == GURL(kChromeUICrashURL)) { |
211 CrashIntentionally(); | 211 CrashIntentionally(); |
212 } else if (url == GURL(kChromeUIKillURL)) { | 212 } else if (url == GURL(kChromeUIKillURL)) { |
213 base::KillProcess(base::GetCurrentProcessHandle(), 1, false); | 213 base::KillProcess(base::GetCurrentProcessHandle(), 1, false); |
214 } else if (url == GURL(kChromeUIHangURL)) { | 214 } else if (url == GURL(kChromeUIHangURL)) { |
215 for (;;) { | 215 for (;;) { |
216 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); | 216 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1)); |
217 } | 217 } |
218 } else if (url == GURL(kChromeUIShorthangURL)) { | 218 } else if (url == GURL(kChromeUIShorthangURL)) { |
219 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(20)); | 219 base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(20)); |
220 } | 220 } |
221 | 221 |
222 #if defined(ADDRESS_SANITIZER) | 222 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN) |
223 MaybeTriggerAsanError(url); | 223 MaybeTriggerAsanError(url); |
224 #endif // ADDRESS_SANITIZER | 224 #endif // ADDRESS_SANITIZER || SYZYASAN |
225 } | 225 } |
226 | 226 |
227 // Returns false unless this is a top-level navigation. | 227 // Returns false unless this is a top-level navigation. |
228 static bool IsTopLevelNavigation(WebFrame* frame) { | 228 static bool IsTopLevelNavigation(WebFrame* frame) { |
229 return frame->parent() == NULL; | 229 return frame->parent() == NULL; |
230 } | 230 } |
231 | 231 |
232 // Returns false unless this is a top-level navigation that crosses origins. | 232 // Returns false unless this is a top-level navigation that crosses origins. |
233 static bool IsNonLocalTopLevelNavigation(const GURL& url, | 233 static bool IsNonLocalTopLevelNavigation(const GURL& url, |
234 WebFrame* frame, | 234 WebFrame* frame, |
(...skipping 2520 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2755 } | 2755 } |
2756 | 2756 |
2757 Send(new FrameHostMsg_OpenURL(routing_id_, params)); | 2757 Send(new FrameHostMsg_OpenURL(routing_id_, params)); |
2758 } | 2758 } |
2759 | 2759 |
2760 void RenderFrameImpl::didChangeLoadProgress(double load_progress) { | 2760 void RenderFrameImpl::didChangeLoadProgress(double load_progress) { |
2761 render_view_->didChangeLoadProgress(frame_, load_progress); | 2761 render_view_->didChangeLoadProgress(frame_, load_progress); |
2762 } | 2762 } |
2763 | 2763 |
2764 } // namespace content | 2764 } // namespace content |
OLD | NEW |