Service CreateNewWindow on the UI thread with a new mojo interface

content/browser/security_exploit_browsertest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/common/frame.mojom.h"
 #include "content/common/frame_messages.h"
 #include "content/common/render_message_filter.mojom.h"
 #include "content/common/resource_messages.h"
 #include "content/common/resource_request.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/interstitial_page_delegate.h"
 #include "content/public/browser/resource_context.h"
@@ skipping 228 matching lines @@
 // it in a state with pending RenderViewHost. Before the commit of the new
 // pending RenderViewHost, this test case creates a new window through the new
 // process.
 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
                        AttemptDuplicateRenderViewHost) {
   int32_t duplicate_routing_id = MSG_ROUTING_NONE;
   RenderViewHostImpl* pending_rvh =
       PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
   EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
 
-  // Since this test executes on the UI thread and hopping threads might cause
-  // different timing in the test, let's simulate a CreateNewWindow call coming
-  // from the IO thread.
-  DOMStorageContextWrapper* dom_storage_context =
-      static_cast<DOMStorageContextWrapper*>(
-          BrowserContext::GetStoragePartition(
-              shell()->web_contents()->GetBrowserContext(),
-              pending_rvh->GetSiteInstance())->GetDOMStorageContext());
-  scoped_refptr<SessionStorageNamespaceImpl> session_storage(
-      new SessionStorageNamespaceImpl(dom_storage_context));
-  // Cause a deliberate collision in routing ids.
-  int32_t main_frame_routing_id = duplicate_routing_id + 1;
-  // TODO(avi): This should be made unique from the view routing ID once
-  // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684
-  int32_t main_frame_widget_routing_id = duplicate_routing_id;
-  static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame())
-      ->OnCreateNewWindow(duplicate_routing_id, main_frame_routing_id,
-                          main_frame_widget_routing_id,
-                          mojom::CreateNewWindowParams(),
-                          session_storage.get());
-
+  RenderFrameHostImpl* opener =
+      static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame());
+  mojom::CreateNewWindowParamsPtr params;
+  opener->CreateNewWindow(std::move(params),
+                          base::Bind([](mojom::CreateNewWindowReplyPtr) {}));
   // If the above operation doesn't cause a crash, the test has succeeded!
 }
 
 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts
 // with the same process and routing ids, which causes a collision. It is almost
 // identical to the AttemptDuplicateRenderViewHost test case.
 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
                        AttemptDuplicateRenderWidgetHost) {
 #if defined(OS_WIN)
   // PlzNavigate
@@ skipping 268 matching lines @@
   // separate task of the message loop, so ensure that the process is still
   // considered alive.
   EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection());
 
   exit_observer.Wait();
   EXPECT_FALSE(exit_observer.did_exit_normally());
   ResourceDispatcherHost::Get()->SetDelegate(nullptr);
 }
 
 }  // namespace content