| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/frame_host/debug_urls.h" | 5 #include "content/browser/frame_host/debug_urls.h" |
| 6 | 6 |
| 7 #if defined(SYZYASAN) | 7 #if defined(SYZYASAN) |
| 8 #include <windows.h> | 8 #include <windows.h> |
| 9 #endif | 9 #endif |
| 10 | 10 |
| 11 #include <vector> | 11 #include <vector> |
| 12 | 12 |
| 13 #include "base/command_line.h" | 13 #include "base/command_line.h" |
| 14 #include "base/debug/asan_invalid_access.h" | 14 #include "base/debug/asan_invalid_access.h" |
| 15 #include "base/debug/profiler.h" | 15 #include "base/debug/profiler.h" |
| 16 #include "base/strings/utf_string_conversions.h" | 16 #include "base/strings/utf_string_conversions.h" |
| 17 #include "base/synchronization/waitable_event.h" | 17 #include "base/synchronization/waitable_event.h" |
| 18 #include "base/threading/thread_restrictions.h" | 18 #include "base/threading/thread_restrictions.h" |
| 19 #include "cc/base/switches.h" | 19 #include "cc/base/switches.h" |
| 20 #include "content/browser/gpu/gpu_process_host_ui_shim.h" | 20 #include "content/browser/gpu/gpu_process_host_ui_shim.h" |
| 21 #include "content/public/browser/browser_thread.h" | 21 #include "content/public/browser/browser_thread.h" |
| 22 #include "content/public/common/content_constants.h" | 22 #include "content/public/common/content_constants.h" |
| 23 #include "content/public/common/url_constants.h" | 23 #include "content/public/common/url_constants.h" |
| 24 #include "ppapi/features/features.h" | 24 #include "ppapi/features/features.h" |
| 25 #include "third_party/kasko/kasko_features.h" | |
| 26 #include "url/gurl.h" | 25 #include "url/gurl.h" |
| 27 | 26 |
| 28 #if BUILDFLAG(ENABLE_PLUGINS) | 27 #if BUILDFLAG(ENABLE_PLUGINS) |
| 29 #include "content/browser/ppapi_plugin_process_host.h" // nogncheck | 28 #include "content/browser/ppapi_plugin_process_host.h" // nogncheck |
| 30 #include "ppapi/proxy/ppapi_messages.h" // nogncheck | 29 #include "ppapi/proxy/ppapi_messages.h" // nogncheck |
| 31 #endif | 30 #endif |
| 32 | 31 |
| 33 namespace content { | 32 namespace content { |
| 34 | 33 |
| 35 class ScopedAllowWaitForDebugURL { | 34 class ScopedAllowWaitForDebugURL { |
| 36 private: | 35 private: |
| 37 base::ThreadRestrictions::ScopedAllowWait wait; | 36 base::ThreadRestrictions::ScopedAllowWait wait; |
| 38 }; | 37 }; |
| 39 | 38 |
| 40 namespace { | 39 namespace { |
| 41 | 40 |
| 42 // Define the Asan debug URLs. | 41 // Define the Asan debug URLs. |
| 43 const char kAsanCrashDomain[] = "crash"; | 42 const char kAsanCrashDomain[] = "crash"; |
| 44 const char kAsanHeapOverflow[] = "/browser-heap-overflow"; | 43 const char kAsanHeapOverflow[] = "/browser-heap-overflow"; |
| 45 const char kAsanHeapUnderflow[] = "/browser-heap-underflow"; | 44 const char kAsanHeapUnderflow[] = "/browser-heap-underflow"; |
| 46 const char kAsanUseAfterFree[] = "/browser-use-after-free"; | 45 const char kAsanUseAfterFree[] = "/browser-use-after-free"; |
| 47 #if defined(SYZYASAN) | 46 #if defined(SYZYASAN) |
| 48 const char kAsanCorruptHeapBlock[] = "/browser-corrupt-heap-block"; | 47 const char kAsanCorruptHeapBlock[] = "/browser-corrupt-heap-block"; |
| 49 const char kAsanCorruptHeap[] = "/browser-corrupt-heap"; | 48 const char kAsanCorruptHeap[] = "/browser-corrupt-heap"; |
| 50 #endif | 49 #endif |
| 51 | 50 |
| 52 #if BUILDFLAG(ENABLE_KASKO) | |
| 53 // Define the Kasko debug URLs. | |
| 54 const char kKaskoCrashDomain[] = "kasko"; | |
| 55 const char kKaskoSendReport[] = "/send-report"; | |
| 56 #endif | |
| 57 | |
| 58 void HandlePpapiFlashDebugURL(const GURL& url) { | 51 void HandlePpapiFlashDebugURL(const GURL& url) { |
| 59 #if BUILDFLAG(ENABLE_PLUGINS) | 52 #if BUILDFLAG(ENABLE_PLUGINS) |
| 60 bool crash = url == kChromeUIPpapiFlashCrashURL; | 53 bool crash = url == kChromeUIPpapiFlashCrashURL; |
| 61 | 54 |
| 62 std::vector<PpapiPluginProcessHost*> hosts; | 55 std::vector<PpapiPluginProcessHost*> hosts; |
| 63 PpapiPluginProcessHost::FindByName( | 56 PpapiPluginProcessHost::FindByName( |
| 64 base::UTF8ToUTF16(kFlashPluginName), &hosts); | 57 base::UTF8ToUTF16(kFlashPluginName), &hosts); |
| 65 for (std::vector<PpapiPluginProcessHost*>::iterator iter = hosts.begin(); | 58 for (std::vector<PpapiPluginProcessHost*>::iterator iter = hosts.begin(); |
| 66 iter != hosts.end(); ++iter) { | 59 iter != hosts.end(); ++iter) { |
| 67 if (crash) | 60 if (crash) |
| 68 (*iter)->Send(new PpapiMsg_Crash()); | 61 (*iter)->Send(new PpapiMsg_Crash()); |
| 69 else | 62 else |
| 70 (*iter)->Send(new PpapiMsg_Hang()); | 63 (*iter)->Send(new PpapiMsg_Hang()); |
| 71 } | 64 } |
| 72 #endif | 65 #endif |
| 73 } | 66 } |
| 74 | 67 |
| 75 bool IsKaskoDebugURL(const GURL& url) { | |
| 76 #if BUILDFLAG(ENABLE_KASKO) | |
| 77 return (url.is_valid() && url.SchemeIs(kChromeUIScheme) && | |
| 78 url.DomainIs(kKaskoCrashDomain) && | |
| 79 url.path_piece() == kKaskoSendReport); | |
| 80 #else | |
| 81 return false; | |
| 82 #endif | |
| 83 } | |
| 84 | |
| 85 void HandleKaskoDebugURL() { | |
| 86 #if BUILDFLAG(ENABLE_KASKO) | |
| 87 // Signature of the exported crash key setting function. | |
| 88 using SetCrashKeyValueImplPtr = void(__cdecl *)(const wchar_t*, | |
| 89 const wchar_t*); | |
| 90 // Signature of an enhanced crash reporting function. | |
| 91 using ReportCrashWithProtobufPtr = void(__cdecl *)(EXCEPTION_POINTERS*, | |
| 92 const char*); | |
| 93 | |
| 94 HMODULE exe_hmodule = ::GetModuleHandle(NULL); | |
| 95 | |
| 96 // First, set a crash key using the exported function reserved for Kasko | |
| 97 // clients (SyzyASAN for now). | |
| 98 SetCrashKeyValueImplPtr set_crash_key_value_impl = | |
| 99 reinterpret_cast<SetCrashKeyValueImplPtr>( | |
| 100 ::GetProcAddress(exe_hmodule, "SetCrashKeyValueImpl")); | |
| 101 if (set_crash_key_value_impl) | |
| 102 set_crash_key_value_impl(L"kasko-set-crash-key-value-impl", L"true"); | |
| 103 else | |
| 104 NOTREACHED(); | |
| 105 | |
| 106 // Next, invoke a crash report via Kasko. | |
| 107 ReportCrashWithProtobufPtr report_crash_with_protobuf = | |
| 108 reinterpret_cast<ReportCrashWithProtobufPtr>( | |
| 109 ::GetProcAddress(exe_hmodule, "ReportCrashWithProtobuf")); | |
| 110 if (report_crash_with_protobuf) | |
| 111 report_crash_with_protobuf(NULL, "Invoked from debug url."); | |
| 112 else | |
| 113 NOTREACHED(); | |
| 114 #else | |
| 115 NOTIMPLEMENTED(); | |
| 116 #endif | |
| 117 } | |
| 118 | |
| 119 bool IsAsanDebugURL(const GURL& url) { | 68 bool IsAsanDebugURL(const GURL& url) { |
| 120 #if defined(SYZYASAN) | 69 #if defined(SYZYASAN) |
| 121 if (!base::debug::IsBinaryInstrumented()) | 70 if (!base::debug::IsBinaryInstrumented()) |
| 122 return false; | 71 return false; |
| 123 #endif | 72 #endif |
| 124 | 73 |
| 125 if (!(url.is_valid() && url.SchemeIs(kChromeUIScheme) && | 74 if (!(url.is_valid() && url.SchemeIs(kChromeUIScheme) && |
| 126 url.DomainIs(kAsanCrashDomain) && | 75 url.DomainIs(kAsanCrashDomain) && |
| 127 url.has_path())) { | 76 url.has_path())) { |
| 128 return false; | 77 return false; |
| (...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 190 cc::switches::kEnableGpuBenchmarking) && | 139 cc::switches::kEnableGpuBenchmarking) && |
| 191 (PageTransitionCoreTypeIs(transition, ui::PAGE_TRANSITION_TYPED)); | 140 (PageTransitionCoreTypeIs(transition, ui::PAGE_TRANSITION_TYPED)); |
| 192 | 141 |
| 193 if (!(transition & ui::PAGE_TRANSITION_FROM_ADDRESS_BAR) && | 142 if (!(transition & ui::PAGE_TRANSITION_FROM_ADDRESS_BAR) && |
| 194 !is_telemetry_navigation) | 143 !is_telemetry_navigation) |
| 195 return false; | 144 return false; |
| 196 | 145 |
| 197 if (IsAsanDebugURL(url)) | 146 if (IsAsanDebugURL(url)) |
| 198 return HandleAsanDebugURL(url); | 147 return HandleAsanDebugURL(url); |
| 199 | 148 |
| 200 if (IsKaskoDebugURL(url)) { | |
| 201 HandleKaskoDebugURL(); | |
| 202 return true; | |
| 203 } | |
| 204 | |
| 205 if (url == kChromeUIBrowserCrashURL) { | 149 if (url == kChromeUIBrowserCrashURL) { |
| 206 // Induce an intentional crash in the browser process. | 150 // Induce an intentional crash in the browser process. |
| 207 CHECK(false); | 151 CHECK(false); |
| 208 return true; | 152 return true; |
| 209 } | 153 } |
| 210 | 154 |
| 211 if (url == kChromeUIBrowserUIHang) { | 155 if (url == kChromeUIBrowserUIHang) { |
| 212 HangCurrentThread(); | 156 HangCurrentThread(); |
| 213 return true; | 157 return true; |
| 214 } | 158 } |
| (...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 262 return url == kChromeUIBadCastCrashURL || | 206 return url == kChromeUIBadCastCrashURL || |
| 263 url == kChromeUICrashURL || | 207 url == kChromeUICrashURL || |
| 264 url == kChromeUIDumpURL || | 208 url == kChromeUIDumpURL || |
| 265 url == kChromeUIKillURL || | 209 url == kChromeUIKillURL || |
| 266 url == kChromeUIHangURL || | 210 url == kChromeUIHangURL || |
| 267 url == kChromeUIShorthangURL || | 211 url == kChromeUIShorthangURL || |
| 268 url == kChromeUIMemoryExhaustURL; | 212 url == kChromeUIMemoryExhaustURL; |
| 269 } | 213 } |
| 270 | 214 |
| 271 } // namespace content | 215 } // namespace content |
| OLD | NEW |