Test sending corrupt mojo messages back from javascript.

content/browser/webui/web_ui_mojo_browsertest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <limits>
 
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
 #include "base/path_service.h"
@@ skipping 13 matching lines @@
 #include "content/test/data/web_ui_test_mojo_bindings.mojom.h"
 #include "grit/content_resources.h"
 #include "mojo/public/cpp/bindings/allocation_scope.h"
 #include "mojo/public/cpp/bindings/remote_ptr.h"
 #include "mojo/public/js/bindings/constants.h"
 
 namespace content {
 namespace {
 
 bool got_message = false;
-int message_count = 0;
+int echo_message_count = 0;
+int flip_bits_message_count = 0;
 
-const int kExpectedMessageCount = 100;
+const int kExpectedEchoMessageCount = 100;
+const int kExpectedFlipBitsMessageCount = 2000;
 
 // Negative numbers with different values in each byte, the last of
 // which can survive promotion to double and back.
 const int8  kExpectedInt8Value = -65;
 const int16 kExpectedInt16Value = -16961;
 const int32 kExpectedInt32Value = -1145258561;
 const int64 kExpectedInt64Value = -77263311946305LL;
 
 // Positive numbers with different values in each byte, the last of
 // which can survive promotion to double and back.
@@ skipping 19 matching lines @@
 #if defined(OS_WIN)
   std::string tmp;
   base::ReplaceChars(binding_path, "//", "\\", &tmp);
   binding_path.swap(tmp);
 #endif
   base::FilePath file_path;
   PathService::Get(CHILD_PROCESS_EXE, &file_path);
   return file_path.DirName().AppendASCII(binding_path);
 }
 
+bool IsRunningOnIsolatedBot() {
+  // Currently there is no way to have a generated file included in the isolate
+  // files. If the bindings file doesn't exist assume we're on such a bot and
+  // pass the current test.
+  // TODO(sky): remove this conditional when isolates support copying from gen.
+  const base::FilePath test_file_path(
+      GetFilePathForJSResource(
+          "content/test/data/web_ui_test_mojo_bindings.mojom"));
+  if (!base::PathExists(test_file_path)) {
+    LOG(WARNING) << " mojom binding file doesn't exist, assuming on isolate";
+    return true;
+  }
+  return false;
+}
+
 // The bindings for the page are generated from a .mojom file. This code looks
 // up the generated file from disk and returns it.
 bool GetResource(const std::string& id,
                  const WebUIDataSource::GotDataCallback& callback) {
   // These are handled by the WebUIDataSource that AddMojoDataSource() creates.
   if (id == mojo::kCodecModuleName ||
       id == mojo::kConnectionModuleName ||
       id == mojo::kConnectorModuleName ||
       id == mojo::kRouterModuleName)
     return false;
@@ skipping 20 matching lines @@
   // mojo::BrowserTarget overrides:
   virtual void PingResponse() OVERRIDE {
     NOTREACHED();
   }
 
   virtual void EchoResponse(const mojo::EchoArgs& arg1,
                             const mojo::EchoArgs& arg2) OVERRIDE {
     NOTREACHED();
   }
 
+  virtual void FlipBitsResponse(const mojo::EchoArgs& arg1) OVERRIDE {
+    NOTREACHED();
+  }
+
  protected:
   mojo::RemotePtr<mojo::RendererTarget> client_;
   base::RunLoop* run_loop_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(BrowserTargetImpl);
 };
 
 class PingBrowserTargetImpl : public BrowserTargetImpl {
  public:
@@ skipping 31 matching lines @@
     builder.set_ui32(kExpectedUInt32Value);
     builder.set_ui16(kExpectedUInt16Value);
     builder.set_ui8(kExpectedUInt8Value);
     builder.set_float_val(kExpectedFloatVal);
     builder.set_float_inf(kExpectedFloatInf);
     builder.set_float_nan(kExpectedFloatNan);
     builder.set_double_val(kExpectedDoubleVal);
     builder.set_double_inf(kExpectedDoubleInf);
     builder.set_double_nan(kExpectedDoubleNan);
     builder.set_name("coming");
-    client_->Echo(builder.Finish());
+    client_->Echo(kExpectedEchoMessageCount, builder.Finish());
   }
 
   virtual ~EchoBrowserTargetImpl() {}
 
   // mojo::BrowserTarget overrides:
   // Check the response, and quit the RunLoop after N calls.
   virtual void EchoResponse(const mojo::EchoArgs& arg1,
                             const mojo::EchoArgs& arg2) OVERRIDE {
     EXPECT_EQ(kExpectedInt64Value, arg1.si64());
     EXPECT_EQ(kExpectedInt32Value, arg1.si32());
@@ skipping 10 matching lines @@
     EXPECT_EQ(kExpectedDoubleInf, arg1.double_inf());
     EXPECT_NAN(arg1.double_nan());
     EXPECT_EQ(std::string("coming"), arg1.name().To<std::string>());
 
     EXPECT_EQ(-1, arg2.si64());
     EXPECT_EQ(-1, arg2.si32());
     EXPECT_EQ(-1, arg2.si16());
     EXPECT_EQ(-1, arg2.si8());
     EXPECT_EQ(std::string("going"), arg2.name().To<std::string>());
 
-    message_count += 1;
-    if (message_count == kExpectedMessageCount)
+    echo_message_count += 1;
+    if (echo_message_count == kExpectedEchoMessageCount)
       run_loop_->Quit();
   }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(EchoBrowserTargetImpl);
 };
 
+class FlipBitsBrowserTargetImpl : public BrowserTargetImpl {
+ public:
+  FlipBitsBrowserTargetImpl(mojo::ScopedRendererTargetHandle handle,
+                           base::RunLoop* run_loop)
+      : BrowserTargetImpl(handle, run_loop) {
+    mojo::AllocationScope scope;
+    mojo::EchoArgs::Builder builder;
+    builder.set_si64(kExpectedInt64Value);
+    builder.set_si32(kExpectedInt32Value);
+    builder.set_si16(kExpectedInt16Value);
+    builder.set_si8(kExpectedInt8Value);
+    builder.set_ui64(kExpectedUInt64Value);
+    builder.set_ui32(kExpectedUInt32Value);
+    builder.set_ui16(kExpectedUInt16Value);
+    builder.set_ui8(kExpectedUInt8Value);
+    builder.set_float_val(kExpectedFloatVal);
+    builder.set_float_inf(kExpectedFloatInf);
+    builder.set_float_nan(kExpectedFloatNan);
+    builder.set_double_val(kExpectedDoubleVal);
+    builder.set_double_inf(kExpectedDoubleInf);
+    builder.set_double_nan(kExpectedDoubleNan);
+    builder.set_name("flipping");
+    client_->FlipBits(kExpectedFlipBitsMessageCount, builder.Finish());
+  }
+
+  virtual ~FlipBitsBrowserTargetImpl() {}
+
+  // mojo::BrowserTarget overrides:
+  // Everything is fine so long as the corrupt message dosen't trigger
+  // ASAN errors, so just quit the RunLoop after N calls.
+  virtual void FlipBitsResponse(const mojo::EchoArgs& arg1) OVERRIDE {
+    flip_bits_message_count += 1;
+    if (flip_bits_message_count == kExpectedFlipBitsMessageCount)
+      run_loop_->Quit();
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FlipBitsBrowserTargetImpl);
+};
+
 // WebUIController that sets up mojo bindings.
 class TestWebUIController : public WebUIController {
  public:
    TestWebUIController(WebUI* web_ui, base::RunLoop* run_loop)
       : WebUIController(web_ui),
         run_loop_(run_loop) {
     content::WebUIDataSource* data_source =
         WebUIDataSource::AddMojoDataSource(
             web_ui->GetWebContents()->GetBrowserContext());
     data_source->SetRequestFilter(base::Bind(&GetResource));
@@ skipping 42 matching lines @@
     browser_target_.reset(new EchoBrowserTargetImpl(
         pipe.handle_to_peer.Pass(), run_loop_));
     render_view_host->SetWebUIHandle(
         mojo::ScopedMessagePipeHandle(pipe.handle_to_self.release()));
   }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(EchoTestWebUIController);
 };
 
+// TestWebUIController that additionally creates the flip bits test
+// BrowserTarget implementation at the right time.
+class FlipBitsTestWebUIController : public TestWebUIController {
+ public:
+   FlipBitsTestWebUIController(WebUI* web_ui, base::RunLoop* run_loop)
+      : TestWebUIController(web_ui, run_loop) {
+  }
+
+  // WebUIController overrides:
+  virtual void RenderViewCreated(RenderViewHost* render_view_host) OVERRIDE {
+    mojo::InterfacePipe<mojo::BrowserTarget, mojo::RendererTarget> pipe;
+    browser_target_.reset(new FlipBitsBrowserTargetImpl(
+        pipe.handle_to_peer.Pass(), run_loop_));
+    render_view_host->SetWebUIHandle(
+        mojo::ScopedMessagePipeHandle(pipe.handle_to_self.release()));
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FlipBitsTestWebUIController);
+};
+
 // WebUIControllerFactory that creates TestWebUIController.
 class TestWebUIControllerFactory : public WebUIControllerFactory {
  public:
   TestWebUIControllerFactory() : run_loop_(NULL) {}
 
   void set_run_loop(base::RunLoop* run_loop) { run_loop_ = run_loop; }
 
   virtual WebUIController* CreateWebUIControllerForURL(
       WebUI* web_ui, const GURL& url) const OVERRIDE {
     if (url.query() == "ping")
       return new PingTestWebUIController(web_ui, run_loop_);
     if (url.query() == "echo")
       return new EchoTestWebUIController(web_ui, run_loop_);
+    if (url.query() == "flipbits")
+      return new FlipBitsTestWebUIController(web_ui, run_loop_);
     return NULL;
   }
   virtual WebUI::TypeID GetWebUIType(BrowserContext* browser_context,
       const GURL& url) const OVERRIDE {
     return reinterpret_cast<WebUI::TypeID>(1);
   }
   virtual bool UseWebUIForURL(BrowserContext* browser_context,
                               const GURL& url) const OVERRIDE {
     return true;
   }
@@ skipping 32 matching lines @@
 #define MAYBE_EndToEndPing DISABLED_EndToEndPing
 #define MAYBE_EndToEndEcho DISABLED_EndToEndEcho
 #else
 #define MAYBE_EndToEndPing EndToEndPing
 #define MAYBE_EndToEndEcho EndToEndEcho
 #endif
 
 // Loads a webui page that contains mojo bindings and verifies a message makes
 // it from the browser to the page and back.
 IN_PROC_BROWSER_TEST_F(WebUIMojoTest, MAYBE_EndToEndPing) {
-  // Currently there is no way to have a generated file included in the isolate
-  // files. If the bindings file doesn't exist assume we're on such a bot and
-  // pass.
-  // TODO(sky): remove this conditional when isolates support copying from gen.
-  const base::FilePath test_file_path(
-      GetFilePathForJSResource(
-          "content/test/data/web_ui_test_mojo_bindings.mojom"));
-  if (!base::PathExists(test_file_path)) {
-    LOG(WARNING) << " mojom binding file doesn't exist, assuming on isolate";
+  if (IsRunningOnIsolatedBot())
     return;
-  }
 
   got_message = false;
   ASSERT_TRUE(test_server()->Start());
   base::RunLoop run_loop;
   factory()->set_run_loop(&run_loop);
   GURL test_url(test_server()->GetURL("files/web_ui_mojo.html?ping"));
   NavigateToURL(shell(), test_url);
   // RunLoop is quit when message received from page.
   run_loop.Run();
   EXPECT_TRUE(got_message);
 }
 
 // Loads a webui page that contains mojo bindings and verifies that
 // parameters are passed back correctly from JavaScript.
 IN_PROC_BROWSER_TEST_F(WebUIMojoTest, MAYBE_EndToEndEcho) {
-  // Currently there is no way to have a generated file included in the isolate
-  // files. If the bindings file doesn't exist assume we're on such a bot and
-  // pass.
-  // TODO(sky): remove this conditional when isolates support copying from gen.
-  const base::FilePath test_file_path(
-      GetFilePathForJSResource(
-          "content/test/data/web_ui_test_mojo_bindings.mojom"));
-  if (!base::PathExists(test_file_path)) {
-    LOG(WARNING) << " mojom binding file doesn't exist, assuming on isolate";
+  if (IsRunningOnIsolatedBot())
     return;
-  }
 
-  message_count = 0;
+  echo_message_count = 0;
   ASSERT_TRUE(test_server()->Start());
   base::RunLoop run_loop;
   factory()->set_run_loop(&run_loop);
   GURL test_url(test_server()->GetURL("files/web_ui_mojo.html?echo"));
   NavigateToURL(shell(), test_url);
   // RunLoop is quit when response received from page.
   run_loop.Run();
-  EXPECT_EQ(kExpectedMessageCount, message_count);
+  EXPECT_EQ(kExpectedEchoMessageCount, echo_message_count);
+}
+
+// Loads a webui page that contains mojo bindings and verifies that
+// corrupted parameters passed back from JavaScript don't trigger
+// ASAN errors.
+// TODO(tsepez): disabled due to http://crbug.com/366797.
+IN_PROC_BROWSER_TEST_F(WebUIMojoTest, DISABLED_EndToEndFlipBits) {
+  if (IsRunningOnIsolatedBot())
+    return;
+
+  flip_bits_message_count = 0;
+  ASSERT_TRUE(test_server()->Start());
+  base::RunLoop run_loop;
+  factory()->set_run_loop(&run_loop);
+  GURL test_url(test_server()->GetURL("files/web_ui_mojo.html?flipbits"));
+  NavigateToURL(shell(), test_url);
+  // RunLoop is quit when response received from page.
+  run_loop.Run();
+  EXPECT_EQ(kExpectedFlipBitsMessageCount, flip_bits_message_count);
 }
 
 }  // namespace
 }  // namespace content