OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/files/file_path.h" | 5 #include "base/files/file_path.h" |
6 #include "base/strings/utf_string_conversions.h" | 6 #include "base/strings/utf_string_conversions.h" |
7 #include "content/browser/frame_host/cross_site_transferring_request.h" | 7 #include "content/browser/frame_host/cross_site_transferring_request.h" |
8 #include "content/browser/frame_host/navigation_controller_impl.h" | 8 #include "content/browser/frame_host/navigation_controller_impl.h" |
9 #include "content/browser/frame_host/navigation_entry_impl.h" | 9 #include "content/browser/frame_host/navigation_entry_impl.h" |
10 #include "content/browser/frame_host/navigator.h" | 10 #include "content/browser/frame_host/navigator.h" |
(...skipping 107 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
118 | 118 |
119 private: | 119 private: |
120 int process_id_; | 120 int process_id_; |
121 int routing_id_; | 121 int routing_id_; |
122 bool deleted_; | 122 bool deleted_; |
123 | 123 |
124 DISALLOW_COPY_AND_ASSIGN(RenderViewHostDeletedObserver); | 124 DISALLOW_COPY_AND_ASSIGN(RenderViewHostDeletedObserver); |
125 }; | 125 }; |
126 | 126 |
127 | 127 |
128 // This observer keeps track of the last deleted RenderViewHost to avoid | |
129 // accessing it and causing use-after-free condition. | |
130 class RenderFrameHostDeletedObserver : public WebContentsObserver { | |
131 public: | |
132 RenderFrameHostDeletedObserver(RenderFrameHost* rfh) | |
133 : WebContentsObserver(WebContents::FromRenderFrameHost(rfh)), | |
134 process_id_(rfh->GetProcess()->GetID()), | |
135 routing_id_(rfh->GetRoutingID()), | |
136 deleted_(false) { | |
137 } | |
138 | |
139 virtual void RenderFrameDeleted(RenderFrameHost* render_frame_host) OVERRIDE { | |
140 if (render_frame_host->GetProcess()->GetID() == process_id_ && | |
141 render_frame_host->GetRoutingID() == routing_id_) { | |
142 deleted_ = true; | |
143 } | |
144 } | |
145 | |
146 bool deleted() { | |
147 return deleted_; | |
148 } | |
149 | |
150 private: | |
151 int process_id_; | |
152 int routing_id_; | |
153 bool deleted_; | |
154 | |
155 DISALLOW_COPY_AND_ASSIGN(RenderFrameHostDeletedObserver); | |
156 }; | |
157 | |
158 | |
159 // This observer is used to check whether IPC messages are being filtered for | 128 // This observer is used to check whether IPC messages are being filtered for |
160 // swapped out RenderFrameHost objects. It observes the plugin crash and favicon | 129 // swapped out RenderFrameHost objects. It observes the plugin crash and favicon |
161 // update events, which the FilterMessagesWhileSwappedOut test simulates being | 130 // update events, which the FilterMessagesWhileSwappedOut test simulates being |
162 // sent. The test is successful if the event is not observed. | 131 // sent. The test is successful if the event is not observed. |
163 // See http://crbug.com/351815 | 132 // See http://crbug.com/351815 |
164 class PluginFaviconMessageObserver : public WebContentsObserver { | 133 class PluginFaviconMessageObserver : public WebContentsObserver { |
165 public: | 134 public: |
166 PluginFaviconMessageObserver(WebContents* web_contents) | 135 PluginFaviconMessageObserver(WebContents* web_contents) |
167 : WebContentsObserver(web_contents), | 136 : WebContentsObserver(web_contents), |
168 plugin_crashed_(false), | 137 plugin_crashed_(false), |
(...skipping 1620 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1789 EXPECT_EQ(RenderViewHostImpl::STATE_PENDING_SWAP_OUT, rvh1->rvh_state()); | 1758 EXPECT_EQ(RenderViewHostImpl::STATE_PENDING_SWAP_OUT, rvh1->rvh_state()); |
1790 | 1759 |
1791 // Simulate the swap out ack. | 1760 // Simulate the swap out ack. |
1792 rvh1->OnSwappedOut(false); | 1761 rvh1->OnSwappedOut(false); |
1793 | 1762 |
1794 // rvh1 should be swapped out. | 1763 // rvh1 should be swapped out. |
1795 EXPECT_FALSE(rvh_deleted_observer.deleted()); | 1764 EXPECT_FALSE(rvh_deleted_observer.deleted()); |
1796 EXPECT_TRUE(rvh1->IsSwappedOut()); | 1765 EXPECT_TRUE(rvh1->IsSwappedOut()); |
1797 } | 1766 } |
1798 | 1767 |
1799 // Test that a RenderFrameHost is properly deleted or swapped out when a | |
1800 // cross-site navigation is cancelled. | |
1801 TEST_F(RenderFrameHostManagerTest, | |
1802 CancelPendingProperlyDeletesOrSwaps) { | |
1803 const GURL kUrl1("http://www.google.com/"); | |
1804 const GURL kUrl2("http://www.chromium.org/"); | |
1805 RenderFrameHostImpl* pending_rfh = NULL; | |
1806 base::TimeTicks now = base::TimeTicks::Now(); | |
1807 | |
1808 // Navigate to the first page. | |
1809 contents()->NavigateAndCommit(kUrl1); | |
1810 TestRenderViewHost* rvh1 = test_rvh(); | |
1811 EXPECT_EQ(RenderViewHostImpl::STATE_DEFAULT, rvh1->rvh_state()); | |
1812 | |
1813 // Navigate to a new site, starting a cross-site navigation. | |
1814 controller().LoadURL(kUrl2, Referrer(), PAGE_TRANSITION_LINK, std::string()); | |
1815 { | |
1816 pending_rfh = contents()->GetFrameTree()->root()->render_manager() | |
1817 ->pending_frame_host(); | |
1818 RenderFrameHostDeletedObserver rvh_deleted_observer(pending_rfh); | |
1819 | |
1820 // Cancel the navigation by simulating a declined beforeunload dialog. | |
1821 main_test_rfh()->OnMessageReceived( | |
1822 FrameHostMsg_BeforeUnload_ACK(0, false, now, now)); | |
1823 EXPECT_FALSE(contents()->cross_navigation_pending()); | |
1824 | |
1825 // Since the pending RFH is the only one for the new SiteInstance, it should | |
1826 // be deleted. | |
1827 EXPECT_TRUE(rvh_deleted_observer.deleted()); | |
1828 } | |
1829 | |
1830 // Start another cross-site navigation. | |
1831 controller().LoadURL(kUrl2, Referrer(), PAGE_TRANSITION_LINK, std::string()); | |
1832 { | |
1833 pending_rfh = contents()->GetFrameTree()->root()->render_manager() | |
1834 ->pending_frame_host(); | |
1835 RenderFrameHostDeletedObserver rvh_deleted_observer(pending_rfh); | |
1836 | |
1837 // Increment the number of active views in the new SiteInstance, which will | |
1838 // cause the pending RFH to be swapped out instead of deleted. | |
1839 static_cast<SiteInstanceImpl*>( | |
1840 pending_rfh->GetSiteInstance())->increment_active_view_count(); | |
1841 | |
1842 main_test_rfh()->OnMessageReceived( | |
1843 FrameHostMsg_BeforeUnload_ACK(0, false, now, now)); | |
1844 EXPECT_FALSE(contents()->cross_navigation_pending()); | |
1845 EXPECT_FALSE(rvh_deleted_observer.deleted()); | |
1846 } | |
1847 } | |
1848 | |
1849 } // namespace content | 1768 } // namespace content |
OLD | NEW |