Fix race in SecurityExploitBrowserTest and SiteIsolationStatsGathererBrowserTest

content/child/site_isolation_stats_gatherer_browsertest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/macros.h"
 #include "base/strings/pattern.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/test/histogram_tester.h"
@@ skipping 11 matching lines @@
 // These tests simulate exploited renderer processes, which can fetch arbitrary
 // resources from other websites, not constrained by the Same Origin Policy.  We
 // are trying to verify that the renderer cannot fetch any cross-site document
 // responses even when the Same Origin Policy is turned off inside the renderer.
 class SiteIsolationStatsGathererBrowserTest : public ContentBrowserTest {
  public:
   SiteIsolationStatsGathererBrowserTest() {}
   ~SiteIsolationStatsGathererBrowserTest() override {}
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
-    ASSERT_TRUE(embedded_test_server()->Start());
+    // EmbeddedTestServer::InitializeAndListen() initializes its |base_url_|
+    // which is required below. This cannot invoke Start() however as that kicks
+    // off the "EmbeddedTestServer IO Thread" which then races with
+    // initialization in ContentBrowserTest::SetUp(), http://crbug.com/674545.
+    ASSERT_TRUE(embedded_test_server()->InitializeAndListen());
+
     // Add a host resolver rule to map all outgoing requests to the test server.
     // This allows us to use "real" hostnames in URLs, which we can use to
     // create arbitrary SiteInstances.
     command_line->AppendSwitchASCII(
         switches::kHostResolverRules,
         "MAP * " + embedded_test_server()->host_port_pair().ToString() +
             ",EXCLUDE localhost");
 
     // Since we assume exploited renderer process, it can bypass the same origin
     // policy at will. Simulate that by passing the disable-web-security flag.
     command_line->AppendSwitch(switches::kDisableWebSecurity);
   }
 
+  void SetUpOnMainThread() override {
+    // Complete the manual Start() after ContentBrowserTest's own
+    // initialization, ref. comment on InitializeAndListen() above.
+    embedded_test_server()->StartAcceptingConnections();
+  }
+
   void InspectHistograms(const base::HistogramTester& histograms,
                          bool should_be_blocked,
                          const std::string& resource_name) {
     std::string bucket;
     int mime_type = 0;  // Hardcoded because histogram enums mustn't change.
     if (base::MatchPattern(resource_name, "*.html")) {
       bucket = "HTML";
       mime_type = 0;
     } else if (base::MatchPattern(resource_name, "*.xml")) {
       bucket = "XML";
@@ skipping 135 matching lines @@
   // length is different from what's described in "content-length" for such
   // different targets.
 
   // TODO(nick): Split up these cases, and add positive assertions here about
   // what actually happens in these various resource-block cases.
   GURL foo("http://foo.com/cross_site_document_request_target.html");
   NavigateToURL(shell(), foo);
 }
 
 }  // namespace content