| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdint.h> | 5 #include <stdint.h> |
| 6 | 6 |
| 7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
| 8 #include "base/containers/hash_tables.h" | 8 #include "base/containers/hash_tables.h" |
| 9 #include "base/macros.h" | 9 #include "base/macros.h" |
| 10 #include "base/strings/utf_string_conversions.h" | 10 #include "base/strings/utf_string_conversions.h" |
| (...skipping 235 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 246 EXPECT_EQ(0, shell()->web_contents()->GetMainFrame()->GetEnabledBindings()); | 246 EXPECT_EQ(0, shell()->web_contents()->GetMainFrame()->GetEnabledBindings()); |
| 247 | 247 |
| 248 RenderProcessHostWatcher terminated( | 248 RenderProcessHostWatcher terminated( |
| 249 shell()->web_contents(), | 249 shell()->web_contents(), |
| 250 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 250 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
| 251 shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty( | 251 shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty( |
| 252 "toolkit", "views"); | 252 "toolkit", "views"); |
| 253 terminated.Wait(); | 253 terminated.Wait(); |
| 254 } | 254 } |
| 255 | 255 |
| 256 #if defined(OS_ANDROID) |
| 257 // Flaky on android: https://crbug.com/703657 |
| 258 #define MAYBE_AttemptDuplicateRenderViewHost \ |
| 259 DISABLED_AttemptDuplicateRenderViewHost |
| 260 #else |
| 261 #define MAYBE_AttemptDuplicateRenderViewHost AttemptDuplicateRenderViewHost |
| 262 #endif |
| 263 |
| 256 // This is a test for crbug.com/312016 attempting to create duplicate | 264 // This is a test for crbug.com/312016 attempting to create duplicate |
| 257 // RenderViewHosts. SetupForDuplicateHosts sets up this test case and leaves | 265 // RenderViewHosts. SetupForDuplicateHosts sets up this test case and leaves |
| 258 // it in a state with pending RenderViewHost. Before the commit of the new | 266 // it in a state with pending RenderViewHost. Before the commit of the new |
| 259 // pending RenderViewHost, this test case creates a new window through the new | 267 // pending RenderViewHost, this test case creates a new window through the new |
| 260 // process. | 268 // process. |
| 261 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, | 269 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, |
| 262 AttemptDuplicateRenderViewHost) { | 270 MAYBE_AttemptDuplicateRenderViewHost) { |
| 263 int32_t duplicate_routing_id = MSG_ROUTING_NONE; | 271 int32_t duplicate_routing_id = MSG_ROUTING_NONE; |
| 264 RenderViewHostImpl* pending_rvh = | 272 RenderViewHostImpl* pending_rvh = |
| 265 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); | 273 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); |
| 266 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); | 274 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); |
| 267 | 275 |
| 268 // Since this test executes on the UI thread and hopping threads might cause | 276 // Since this test executes on the UI thread and hopping threads might cause |
| 269 // different timing in the test, let's simulate a CreateNewWindow call coming | 277 // different timing in the test, let's simulate a CreateNewWindow call coming |
| 270 // from the IO thread. | 278 // from the IO thread. |
| 271 DOMStorageContextWrapper* dom_storage_context = | 279 DOMStorageContextWrapper* dom_storage_context = |
| 272 static_cast<DOMStorageContextWrapper*>( | 280 static_cast<DOMStorageContextWrapper*>( |
| 273 BrowserContext::GetStoragePartition( | 281 BrowserContext::GetStoragePartition( |
| 274 shell()->web_contents()->GetBrowserContext(), | 282 shell()->web_contents()->GetBrowserContext(), |
| 275 pending_rvh->GetSiteInstance())->GetDOMStorageContext()); | 283 pending_rvh->GetSiteInstance())->GetDOMStorageContext()); |
| 276 scoped_refptr<SessionStorageNamespaceImpl> session_storage( | 284 scoped_refptr<SessionStorageNamespaceImpl> session_storage( |
| 277 new SessionStorageNamespaceImpl(dom_storage_context)); | 285 new SessionStorageNamespaceImpl(dom_storage_context)); |
| 278 // Cause a deliberate collision in routing ids. | 286 // Cause a deliberate collision in routing ids. |
| 279 int32_t main_frame_routing_id = duplicate_routing_id + 1; | 287 int32_t main_frame_routing_id = duplicate_routing_id + 1; |
| 280 // TODO(avi): This should be made unique from the view routing ID once | 288 // TODO(avi): This should be made unique from the view routing ID once |
| 281 // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684 | 289 // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684 |
| 282 int32_t main_frame_widget_routing_id = duplicate_routing_id; | 290 int32_t main_frame_widget_routing_id = duplicate_routing_id; |
| 283 static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame()) | 291 static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame()) |
| 284 ->OnCreateNewWindow(duplicate_routing_id, main_frame_routing_id, | 292 ->OnCreateNewWindow(duplicate_routing_id, main_frame_routing_id, |
| 285 main_frame_widget_routing_id, | 293 main_frame_widget_routing_id, |
| 286 mojom::CreateNewWindowParams(), | 294 mojom::CreateNewWindowParams(), |
| 287 session_storage.get()); | 295 session_storage.get()); |
| 288 | 296 |
| 289 // If the above operation doesn't cause a crash, the test has succeeded! | 297 // If the above operation doesn't cause a crash, the test has succeeded! |
| 290 } | 298 } |
| 291 | 299 |
| 300 #if defined(OS_ANDROID) |
| 301 // Flaky on android: https://crbug.com/703657 |
| 302 #define MAYBE_AttemptDuplicateRenderWidgetHost \ |
| 303 DISABLED_AttemptDuplicateRenderWidgetHost |
| 304 #else |
| 305 #define MAYBE_AttemptDuplicateRenderWidgetHost AttemptDuplicateRenderWidgetHost |
| 306 #endif |
| 307 |
| 292 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts | 308 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts |
| 293 // with the same process and routing ids, which causes a collision. It is almost | 309 // with the same process and routing ids, which causes a collision. It is almost |
| 294 // identical to the AttemptDuplicateRenderViewHost test case. | 310 // identical to the AttemptDuplicateRenderViewHost test case. |
| 295 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, | 311 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, |
| 296 AttemptDuplicateRenderWidgetHost) { | 312 MAYBE_AttemptDuplicateRenderWidgetHost) { |
| 297 #if defined(OS_WIN) | 313 #if defined(OS_WIN) |
| 298 // PlzNavigate | 314 // PlzNavigate |
| 299 // This test is failing in a flaky manner on Android as it appears to be | 315 // This test is failing in a flaky manner on Android as it appears to be |
| 300 // leaking URLRequests. See crbug.com/702584. | 316 // leaking URLRequests. See crbug.com/702584. |
| 301 if (IsBrowserSideNavigationEnabled()) | 317 if (IsBrowserSideNavigationEnabled()) |
| 302 return; | 318 return; |
| 303 #endif | 319 #endif |
| 304 int duplicate_routing_id = MSG_ROUTING_NONE; | 320 int duplicate_routing_id = MSG_ROUTING_NONE; |
| 305 RenderViewHostImpl* pending_rvh = | 321 RenderViewHostImpl* pending_rvh = |
| 306 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); | 322 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); |
| (...skipping 260 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 567 // separate task of the message loop, so ensure that the process is still | 583 // separate task of the message loop, so ensure that the process is still |
| 568 // considered alive. | 584 // considered alive. |
| 569 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); | 585 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); |
| 570 | 586 |
| 571 exit_observer.Wait(); | 587 exit_observer.Wait(); |
| 572 EXPECT_FALSE(exit_observer.did_exit_normally()); | 588 EXPECT_FALSE(exit_observer.did_exit_normally()); |
| 573 ResourceDispatcherHost::Get()->SetDelegate(nullptr); | 589 ResourceDispatcherHost::Get()->SetDelegate(nullptr); |
| 574 } | 590 } |
| 575 | 591 |
| 576 } // namespace content | 592 } // namespace content |
| OLD | NEW |