Service CreateNewWindow on the UI thread with a new mojo interface

content/browser/security_exploit_browsertest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 247 matching lines @@
 // it in a state with pending RenderViewHost. Before the commit of the new
 // pending RenderViewHost, this test case creates a new window through the new
 // process.
 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
                        AttemptDuplicateRenderViewHost) {
   int32_t duplicate_routing_id = MSG_ROUTING_NONE;
   RenderViewHostImpl* pending_rvh =
       PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
   EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
 
-  // Since this test executes on the UI thread and hopping threads might cause
-  // different timing in the test, let's simulate a CreateNewWindow call coming
-  // from the IO thread.
-  DOMStorageContextWrapper* dom_storage_context =
-      static_cast<DOMStorageContextWrapper*>(
-          BrowserContext::GetStoragePartition(
-              shell()->web_contents()->GetBrowserContext(),
-              pending_rvh->GetSiteInstance())->GetDOMStorageContext());
-  scoped_refptr<SessionStorageNamespaceImpl> session_storage(
-      new SessionStorageNamespaceImpl(dom_storage_context));
-  // Cause a deliberate collision in routing ids.
-  int32_t main_frame_routing_id = duplicate_routing_id + 1;
-  // TODO(avi): This should be made unique from the view routing ID once
-  // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684
-  int32_t main_frame_widget_routing_id = duplicate_routing_id;
-  static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame())
-      ->OnCreateNewWindow(duplicate_routing_id, main_frame_routing_id,
-                          main_frame_widget_routing_id,
-                          mojom::CreateNewWindowParams(),
-                          session_storage.get());
-
-  // If the above operation doesn't cause a crash, the test has succeeded!
+  RenderFrameHostImpl* opener =
+      static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame());
+  // TODO(nick,csharrison): This test doesn't test much, because new windows
+  // cannot be opened from RFH that are not current. It would be nice to
+  // refactor this test to actually call into the delegate to open a new window
+  // if possible.
+  EXPECT_NE(opener->frame_tree_node()->current_frame_host(), opener);

[ncarter (slow), 2017/04/20 21:30:36]

I remember spending some time thinking about this test with the previous
refactor. I agree it's basically lame now -- the original bug had to do with the
fact that we were mixing a routing id from the pending RVH, with the process id
of the current RVH (I think via WebContents::GetRenderProcessHost() or
something).

So, lately, this test's purpose was to make sure that we rejected the
OnCreateNewWindow from a non-current host. I think it can still basically do
that, if we add a FRIEND_TEST to be able to call the mojo fn directly?

I'm also okay deleting the test. I'm pretty sure we don't have the underlying
bug anymore.

[Charlie Harrison, 2017/04/21 15:30:07]

FRIENDED and tested the mojo method directly.

 }
 
 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts
 // with the same process and routing ids, which causes a collision. It is almost
 // identical to the AttemptDuplicateRenderViewHost test case.
 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
                        AttemptDuplicateRenderWidgetHost) {
 #if defined(OS_WIN)
   // PlzNavigate
   // This test is failing in a flaky manner on Android as it appears to be
@@ skipping 267 matching lines @@
   // separate task of the message loop, so ensure that the process is still
   // considered alive.
   EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection());
 
   exit_observer.Wait();
   EXPECT_FALSE(exit_observer.did_exit_normally());
   ResourceDispatcherHost::Get()->SetDelegate(nullptr);
 }
 
 }  // namespace content