| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdint.h> | 5 #include <stdint.h> |
| 6 | 6 |
| 7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
| 8 #include "base/containers/hash_tables.h" | 8 #include "base/containers/hash_tables.h" |
| 9 #include "base/macros.h" | 9 #include "base/macros.h" |
| 10 #include "base/strings/utf_string_conversions.h" | 10 #include "base/strings/utf_string_conversions.h" |
| (...skipping 235 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 246 EXPECT_EQ(0, shell()->web_contents()->GetMainFrame()->GetEnabledBindings()); | 246 EXPECT_EQ(0, shell()->web_contents()->GetMainFrame()->GetEnabledBindings()); |
| 247 | 247 |
| 248 RenderProcessHostWatcher terminated( | 248 RenderProcessHostWatcher terminated( |
| 249 shell()->web_contents(), | 249 shell()->web_contents(), |
| 250 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 250 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
| 251 shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty( | 251 shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty( |
| 252 "toolkit", "views"); | 252 "toolkit", "views"); |
| 253 terminated.Wait(); | 253 terminated.Wait(); |
| 254 } | 254 } |
| 255 | 255 |
| 256 #if defined(OS_ANDROID) | |
| 257 // Flaky on android: https://crbug.com/703657 | |
| 258 #define MAYBE_AttemptDuplicateRenderViewHost \ | |
| 259 DISABLED_AttemptDuplicateRenderViewHost | |
| 260 #else | |
| 261 #define MAYBE_AttemptDuplicateRenderViewHost AttemptDuplicateRenderViewHost | |
| 262 #endif | |
| 263 | |
| 264 // This is a test for crbug.com/312016 attempting to create duplicate | 256 // This is a test for crbug.com/312016 attempting to create duplicate |
| 265 // RenderViewHosts. SetupForDuplicateHosts sets up this test case and leaves | 257 // RenderViewHosts. SetupForDuplicateHosts sets up this test case and leaves |
| 266 // it in a state with pending RenderViewHost. Before the commit of the new | 258 // it in a state with pending RenderViewHost. Before the commit of the new |
| 267 // pending RenderViewHost, this test case creates a new window through the new | 259 // pending RenderViewHost, this test case creates a new window through the new |
| 268 // process. | 260 // process. |
| 269 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, | 261 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, |
| 270 MAYBE_AttemptDuplicateRenderViewHost) { | 262 AttemptDuplicateRenderViewHost) { |
| 271 int32_t duplicate_routing_id = MSG_ROUTING_NONE; | 263 int32_t duplicate_routing_id = MSG_ROUTING_NONE; |
| 272 RenderViewHostImpl* pending_rvh = | 264 RenderViewHostImpl* pending_rvh = |
| 273 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); | 265 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); |
| 274 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); | 266 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); |
| 275 | 267 |
| 276 // Since this test executes on the UI thread and hopping threads might cause | 268 // Since this test executes on the UI thread and hopping threads might cause |
| 277 // different timing in the test, let's simulate a CreateNewWindow call coming | 269 // different timing in the test, let's simulate a CreateNewWindow call coming |
| 278 // from the IO thread. | 270 // from the IO thread. |
| 279 DOMStorageContextWrapper* dom_storage_context = | 271 DOMStorageContextWrapper* dom_storage_context = |
| 280 static_cast<DOMStorageContextWrapper*>( | 272 static_cast<DOMStorageContextWrapper*>( |
| 281 BrowserContext::GetStoragePartition( | 273 BrowserContext::GetStoragePartition( |
| 282 shell()->web_contents()->GetBrowserContext(), | 274 shell()->web_contents()->GetBrowserContext(), |
| 283 pending_rvh->GetSiteInstance())->GetDOMStorageContext()); | 275 pending_rvh->GetSiteInstance())->GetDOMStorageContext()); |
| 284 scoped_refptr<SessionStorageNamespaceImpl> session_storage( | 276 scoped_refptr<SessionStorageNamespaceImpl> session_storage( |
| 285 new SessionStorageNamespaceImpl(dom_storage_context)); | 277 new SessionStorageNamespaceImpl(dom_storage_context)); |
| 286 // Cause a deliberate collision in routing ids. | 278 // Cause a deliberate collision in routing ids. |
| 287 int32_t main_frame_routing_id = duplicate_routing_id + 1; | 279 int32_t main_frame_routing_id = duplicate_routing_id + 1; |
| 288 // TODO(avi): This should be made unique from the view routing ID once | 280 // TODO(avi): This should be made unique from the view routing ID once |
| 289 // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684 | 281 // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684 |
| 290 int32_t main_frame_widget_routing_id = duplicate_routing_id; | 282 int32_t main_frame_widget_routing_id = duplicate_routing_id; |
| 291 static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame()) | 283 static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame()) |
| 292 ->OnCreateNewWindow(duplicate_routing_id, main_frame_routing_id, | 284 ->OnCreateNewWindow(duplicate_routing_id, main_frame_routing_id, |
| 293 main_frame_widget_routing_id, | 285 main_frame_widget_routing_id, |
| 294 mojom::CreateNewWindowParams(), | 286 mojom::CreateNewWindowParams(), |
| 295 session_storage.get()); | 287 session_storage.get()); |
| 296 | 288 |
| 297 // If the above operation doesn't cause a crash, the test has succeeded! | 289 // If the above operation doesn't cause a crash, the test has succeeded! |
| 298 } | 290 } |
| 299 | 291 |
| 300 #if defined(OS_ANDROID) | |
| 301 // Flaky on android: https://crbug.com/703657 | |
| 302 #define MAYBE_AttemptDuplicateRenderWidgetHost \ | |
| 303 DISABLED_AttemptDuplicateRenderWidgetHost | |
| 304 #else | |
| 305 #define MAYBE_AttemptDuplicateRenderWidgetHost AttemptDuplicateRenderWidgetHost | |
| 306 #endif | |
| 307 | |
| 308 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts | 292 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts |
| 309 // with the same process and routing ids, which causes a collision. It is almost | 293 // with the same process and routing ids, which causes a collision. It is almost |
| 310 // identical to the AttemptDuplicateRenderViewHost test case. | 294 // identical to the AttemptDuplicateRenderViewHost test case. |
| 311 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, | 295 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, |
| 312 MAYBE_AttemptDuplicateRenderWidgetHost) { | 296 AttemptDuplicateRenderWidgetHost) { |
| 313 #if defined(OS_WIN) | 297 #if defined(OS_WIN) |
| 314 // PlzNavigate | 298 // PlzNavigate |
| 315 // This test is failing in a flaky manner on Android as it appears to be | 299 // This test is failing in a flaky manner on Android as it appears to be |
| 316 // leaking URLRequests. See crbug.com/702584. | 300 // leaking URLRequests. See crbug.com/702584. |
| 317 if (IsBrowserSideNavigationEnabled()) | 301 if (IsBrowserSideNavigationEnabled()) |
| 318 return; | 302 return; |
| 319 #endif | 303 #endif |
| 320 int duplicate_routing_id = MSG_ROUTING_NONE; | 304 int duplicate_routing_id = MSG_ROUTING_NONE; |
| 321 RenderViewHostImpl* pending_rvh = | 305 RenderViewHostImpl* pending_rvh = |
| 322 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); | 306 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); |
| (...skipping 260 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 583 // separate task of the message loop, so ensure that the process is still | 567 // separate task of the message loop, so ensure that the process is still |
| 584 // considered alive. | 568 // considered alive. |
| 585 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); | 569 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); |
| 586 | 570 |
| 587 exit_observer.Wait(); | 571 exit_observer.Wait(); |
| 588 EXPECT_FALSE(exit_observer.did_exit_normally()); | 572 EXPECT_FALSE(exit_observer.did_exit_normally()); |
| 589 ResourceDispatcherHost::Get()->SetDelegate(nullptr); | 573 ResourceDispatcherHost::Get()->SetDelegate(nullptr); |
| 590 } | 574 } |
| 591 | 575 |
| 592 } // namespace content | 576 } // namespace content |
| OLD | NEW |