Test sending corrupt mojo messages back from javascript.

content/browser/webui/web_ui_mojo_browsertest.cc

Index: content/browser/webui/web_ui_mojo_browsertest.cc
diff --git a/content/browser/webui/web_ui_mojo_browsertest.cc b/content/browser/webui/web_ui_mojo_browsertest.cc
index 9bacd6685cd72d1688a324c88dd487cc1249db24..167c27635ad2dc866a412b735e1057fb2a0eb432 100644
--- a/content/browser/webui/web_ui_mojo_browsertest.cc
+++ b/content/browser/webui/web_ui_mojo_browsertest.cc
@@ -31,9 +31,11 @@ namespace content {
 namespace {
 
 bool got_message = false;
-int message_count = 0;
+int echo_message_count = 0;
+int flip_bits_message_count = 0;
 
-const int kExpectedMessageCount = 100;
+const int kExpectedEchoMessageCount = 100;
+const int kExpectedFlipBitsMessageCount = 2000;
 
 // Negative numbers with different values in each byte, the last of
 // which can survive promotion to double and back.
@@ -73,6 +75,21 @@ base::FilePath GetFilePathForJSResource(const std::string& path) {
   return file_path.DirName().AppendASCII(binding_path);
 }
 
+bool IsRunningOnIsolatedBot() {
+  // Currently there is no way to have a generated file included in the isolate
+  // files. If the bindings file doesn't exist assume we're on such a bot and
+  // pass the current test.
+  // TODO(sky): remove this conditional when isolates support copying from gen.
+  const base::FilePath test_file_path(
+      GetFilePathForJSResource(
+          "content/test/data/web_ui_test_mojo_bindings.mojom"));
+  if (!base::PathExists(test_file_path)) {
+    LOG(WARNING) << " mojom binding file doesn't exist, assuming on isolate";
+    return true;
+  }
+  return false;
+}
+
 // The bindings for the page are generated from a .mojom file. This code looks
 // up the generated file from disk and returns it.
 bool GetResource(const std::string& id,
@@ -113,6 +130,10 @@ class BrowserTargetImpl : public mojo::BrowserTarget {
     NOTREACHED();
   }
 
+  virtual void FlipBitsResponse(const mojo::EchoArgs& arg1) OVERRIDE {
+    NOTREACHED();
+  }
+
  protected:
   mojo::RemotePtr<mojo::RendererTarget> client_;
   base::RunLoop* run_loop_;
@@ -164,7 +185,7 @@ class EchoBrowserTargetImpl : public BrowserTargetImpl {
     builder.set_double_inf(kExpectedDoubleInf);
     builder.set_double_nan(kExpectedDoubleNan);
     builder.set_name("coming");
-    client_->Echo(builder.Finish());
+    client_->Echo(kExpectedEchoMessageCount, builder.Finish());
   }
 
   virtual ~EchoBrowserTargetImpl() {}
@@ -195,8 +216,8 @@ class EchoBrowserTargetImpl : public BrowserTargetImpl {
     EXPECT_EQ(-1, arg2.si8());
     EXPECT_EQ(std::string("going"), arg2.name().To<std::string>());
 
-    message_count += 1;
-    if (message_count == kExpectedMessageCount)
+    echo_message_count += 1;
+    if (echo_message_count == kExpectedEchoMessageCount)
       run_loop_->Quit();
   }
 
@@ -204,6 +225,46 @@ class EchoBrowserTargetImpl : public BrowserTargetImpl {
   DISALLOW_COPY_AND_ASSIGN(EchoBrowserTargetImpl);
 };
 
+class FlipBitsBrowserTargetImpl : public BrowserTargetImpl {
+ public:
+  FlipBitsBrowserTargetImpl(mojo::ScopedRendererTargetHandle handle,
+                           base::RunLoop* run_loop)
+      : BrowserTargetImpl(handle, run_loop) {
+    mojo::AllocationScope scope;
+    mojo::EchoArgs::Builder builder;
+    builder.set_si64(kExpectedInt64Value);
+    builder.set_si32(kExpectedInt32Value);
+    builder.set_si16(kExpectedInt16Value);
+    builder.set_si8(kExpectedInt8Value);
+    builder.set_ui64(kExpectedUInt64Value);
+    builder.set_ui32(kExpectedUInt32Value);
+    builder.set_ui16(kExpectedUInt16Value);
+    builder.set_ui8(kExpectedUInt8Value);
+    builder.set_float_val(kExpectedFloatVal);
+    builder.set_float_inf(kExpectedFloatInf);
+    builder.set_float_nan(kExpectedFloatNan);
+    builder.set_double_val(kExpectedDoubleVal);
+    builder.set_double_inf(kExpectedDoubleInf);
+    builder.set_double_nan(kExpectedDoubleNan);
+    builder.set_name("flipping");
+    client_->FlipBits(kExpectedFlipBitsMessageCount, builder.Finish());
+  }
+
+  virtual ~FlipBitsBrowserTargetImpl() {}
+
+  // mojo::BrowserTarget overrides:
+  // Everything is fine so long as the corrupt message dosen't trigger
+  // ASAN errors, so just quit the RunLoop after N calls.
+  virtual void FlipBitsResponse(const mojo::EchoArgs& arg1) OVERRIDE {
+    flip_bits_message_count += 1;
+    if (flip_bits_message_count == kExpectedFlipBitsMessageCount)
+      run_loop_->Quit();
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FlipBitsBrowserTargetImpl);
+};
+
 // WebUIController that sets up mojo bindings.
 class TestWebUIController : public WebUIController {
  public:
@@ -266,6 +327,27 @@ class EchoTestWebUIController : public TestWebUIController {
   DISALLOW_COPY_AND_ASSIGN(EchoTestWebUIController);
 };
 
+// TestWebUIController that additionally creates the flip bits test
+// BrowserTarget implementation at the right time.
+class FlipBitsTestWebUIController : public TestWebUIController {
+ public:
+   FlipBitsTestWebUIController(WebUI* web_ui, base::RunLoop* run_loop)
+      : TestWebUIController(web_ui, run_loop) {
+  }
+
+  // WebUIController overrides:
+  virtual void RenderViewCreated(RenderViewHost* render_view_host) OVERRIDE {
+    mojo::InterfacePipe<mojo::BrowserTarget, mojo::RendererTarget> pipe;
+    browser_target_.reset(new FlipBitsBrowserTargetImpl(
+        pipe.handle_to_peer.Pass(), run_loop_));
+    render_view_host->SetWebUIHandle(
+        mojo::ScopedMessagePipeHandle(pipe.handle_to_self.release()));
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FlipBitsTestWebUIController);
+};
+
 // WebUIControllerFactory that creates TestWebUIController.
 class TestWebUIControllerFactory : public WebUIControllerFactory {
  public:
@@ -279,6 +361,8 @@ class TestWebUIControllerFactory : public WebUIControllerFactory {
       return new PingTestWebUIController(web_ui, run_loop_);
     if (url.query() == "echo")
       return new EchoTestWebUIController(web_ui, run_loop_);
+    if (url.query() == "flipbits")
+      return new FlipBitsTestWebUIController(web_ui, run_loop_);
     return NULL;
   }
   virtual WebUI::TypeID GetWebUIType(BrowserContext* browser_context,
@@ -331,17 +415,8 @@ class WebUIMojoTest : public ContentBrowserTest {
 // Loads a webui page that contains mojo bindings and verifies a message makes
 // it from the browser to the page and back.
 IN_PROC_BROWSER_TEST_F(WebUIMojoTest, MAYBE_EndToEndPing) {
-  // Currently there is no way to have a generated file included in the isolate
-  // files. If the bindings file doesn't exist assume we're on such a bot and
-  // pass.
-  // TODO(sky): remove this conditional when isolates support copying from gen.
-  const base::FilePath test_file_path(
-      GetFilePathForJSResource(
-          "content/test/data/web_ui_test_mojo_bindings.mojom"));
-  if (!base::PathExists(test_file_path)) {
-    LOG(WARNING) << " mojom binding file doesn't exist, assuming on isolate";
+  if (IsRunningOnIsolatedBot())
     return;
-  }
 
   got_message = false;
   ASSERT_TRUE(test_server()->Start());
@@ -357,19 +432,10 @@ IN_PROC_BROWSER_TEST_F(WebUIMojoTest, MAYBE_EndToEndPing) {
 // Loads a webui page that contains mojo bindings and verifies that
 // parameters are passed back correctly from JavaScript.
 IN_PROC_BROWSER_TEST_F(WebUIMojoTest, MAYBE_EndToEndEcho) {
-  // Currently there is no way to have a generated file included in the isolate
-  // files. If the bindings file doesn't exist assume we're on such a bot and
-  // pass.
-  // TODO(sky): remove this conditional when isolates support copying from gen.
-  const base::FilePath test_file_path(
-      GetFilePathForJSResource(
-          "content/test/data/web_ui_test_mojo_bindings.mojom"));
-  if (!base::PathExists(test_file_path)) {
-    LOG(WARNING) << " mojom binding file doesn't exist, assuming on isolate";
+  if (IsRunningOnIsolatedBot())
     return;
-  }
 
-  message_count = 0;
+  echo_message_count = 0;
   ASSERT_TRUE(test_server()->Start());
   base::RunLoop run_loop;
   factory()->set_run_loop(&run_loop);
@@ -377,7 +443,26 @@ IN_PROC_BROWSER_TEST_F(WebUIMojoTest, MAYBE_EndToEndEcho) {
   NavigateToURL(shell(), test_url);
   // RunLoop is quit when response received from page.
   run_loop.Run();
-  EXPECT_EQ(kExpectedMessageCount, message_count);
+  EXPECT_EQ(kExpectedEchoMessageCount, echo_message_count);
+}
+
+// Loads a webui page that contains mojo bindings and verifies that
+// corrupted parameters passed back from JavaScript don't trigger
+// ASAN errors.
+// TODO(tsepez): disabled due to http://crbug.com/366797.
+IN_PROC_BROWSER_TEST_F(WebUIMojoTest, DISABLED_EndToEndFlipBits) {
+  if (IsRunningOnIsolatedBot())
+    return;
+
+  flip_bits_message_count = 0;
+  ASSERT_TRUE(test_server()->Start());
+  base::RunLoop run_loop;
+  factory()->set_run_loop(&run_loop);
+  GURL test_url(test_server()->GetURL("files/web_ui_mojo.html?flipbits"));
+  NavigateToURL(shell(), test_url);
+  // RunLoop is quit when response received from page.
+  run_loop.Run();
+  EXPECT_EQ(kExpectedFlipBitsMessageCount, flip_bits_message_count);
 }
 
 }  // namespace