EventSender: Added checks for missing arguments

content/shell/renderer/test_runner/event_sender.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/shell/renderer/test_runner/event_sender.h"
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
 #include "content/public/common/page_zoom.h"
@@ skipping 1904 matching lines @@
     if (touch_point->state == WebTouchPoint::StateReleased) {
       touch_points_.erase(touch_points_.begin() + i);
       --i;
     } else
       touch_point->state = WebTouchPoint::StateStationary;
   }
 }
 
 void EventSender::GestureEvent(WebInputEvent::Type type,
                                gin::Arguments* args) {
-  double x;
-  double y;
-  args->GetNext(&x);
-  args->GetNext(&y);
-  WebPoint point(x, y);
+  double x = 0;
+  double y = 0;
+  DCHECK(args->GetNext(&x));

[Rick Byers, 2014/09/23 14:27:14]

I think we should check to see if there are args and fail gracefully (with an
exception) if there isn't.  See the uses of args->PeekNext().IsEmpty()
throughout this file.  The main reason to do this even though this is only test
code is that we do fuzz testing that creates semi-random html/JavaScript pages
that may make use of EventSender (eg. see http://crbug.com/390623).  So any
crash you can trigger with EventSender is a potential clusterfuzz failure point
(which would ultimately be a false positive since it doesn't ship, but still
worth avoiding the noise).

[earthdok, 2014/09/23 14:33:08]

DCHECKs aren't evaluated in Release builds, so this function call won't happen.
Worse, MSan can no longer catch this bug because you've pre-initialized the
variables (though in this particular case you'll get a compiler warning about
unused variables).

Why not change those to CHECKs, and remove explicit zero-initialization of x and
y?

+  DCHECK(args->GetNext(&y));
 
   WebGestureEvent event;
   event.type = type;
 
   switch (type) {
     case WebInputEvent::GestureScrollUpdate:
     case WebInputEvent::GestureScrollUpdateWithoutPropagation:
       event.data.scrollUpdate.deltaX = static_cast<float>(x);
       event.data.scrollUpdate.deltaY = static_cast<float>(y);
       event.x = current_gesture_location_.x;
       event.y = current_gesture_location_.y;
       current_gesture_location_.x =
           current_gesture_location_.x + event.data.scrollUpdate.deltaX;
       current_gesture_location_.y =
           current_gesture_location_.y + event.data.scrollUpdate.deltaY;
       break;
     case WebInputEvent::GestureScrollBegin:
-      current_gesture_location_ = WebPoint(point.x, point.y);
+      current_gesture_location_ = WebPoint(x, y);
       event.x = current_gesture_location_.x;
       event.y = current_gesture_location_.y;
       break;
     case WebInputEvent::GestureScrollEnd:
     case WebInputEvent::GestureFlingStart:
       event.x = current_gesture_location_.x;
       event.y = current_gesture_location_.y;
       break;
     case WebInputEvent::GestureTap:
     {
@@ skipping 14 matching lines @@
       }
       if (!args->PeekNext().IsEmpty()) {
         if (!args->GetNext(&height)) {
           args->ThrowError();
           return;
         }
       }
       event.data.tap.tapCount = tap_count;
       event.data.tap.width = width;
       event.data.tap.height = height;
-      event.x = point.x;
-      event.y = point.y;
+      event.x = x;
+      event.y = y;
       break;
     }
     case WebInputEvent::GestureTapUnconfirmed:
       if (!args->PeekNext().IsEmpty()) {
         float tap_count;
         if (!args->GetNext(&tap_count)) {
           args->ThrowError();
           return;
         }
         event.data.tap.tapCount = tap_count;
       } else {
         event.data.tap.tapCount = 1;
       }
-      event.x = point.x;
-      event.y = point.y;
+      event.x = x;
+      event.y = y;
       break;
     case WebInputEvent::GestureTapDown:
     {
       float width = 30;
       float height = 30;
       if (!args->PeekNext().IsEmpty()) {
         if (!args->GetNext(&width)) {
           args->ThrowError();
           return;
         }
       }
       if (!args->PeekNext().IsEmpty()) {
         if (!args->GetNext(&height)) {
           args->ThrowError();
           return;
         }
       }
-      event.x = point.x;
-      event.y = point.y;
+      event.x = x;
+      event.y = y;
       event.data.tapDown.width = width;
       event.data.tapDown.height = height;
       break;
     }
     case WebInputEvent::GestureShowPress:
     {
       float width = 30;
       float height = 30;
       if (!args->PeekNext().IsEmpty()) {
         if (!args->GetNext(&width)) {
           args->ThrowError();
           return;
         }
         if (!args->PeekNext().IsEmpty()) {
           if (!args->GetNext(&height)) {
             args->ThrowError();
             return;
           }
         }
       }
-      event.x = point.x;
-      event.y = point.y;
+      event.x = x;
+      event.y = y;
       event.data.showPress.width = width;
       event.data.showPress.height = height;
       break;
     }
     case WebInputEvent::GestureTapCancel:
-      event.x = point.x;
-      event.y = point.y;
+      event.x = x;
+      event.y = y;
       break;
     case WebInputEvent::GestureLongPress:
-      event.x = point.x;
-      event.y = point.y;
+      event.x = x;
+      event.y = y;
       if (!args->PeekNext().IsEmpty()) {
         float width;
         if (!args->GetNext(&width)) {
           args->ThrowError();
           return;
         }
         event.data.longPress.width = width;
         if (!args->PeekNext().IsEmpty()) {
           float height;
           if (!args->GetNext(&height)) {
             args->ThrowError();
             return;
           }
           event.data.longPress.height = height;
         }
       }
       break;
     case WebInputEvent::GestureLongTap:
-      event.x = point.x;
-      event.y = point.y;
+      event.x = x;
+      event.y = y;
       if (!args->PeekNext().IsEmpty()) {
         float width;
         if (!args->GetNext(&width)) {
           args->ThrowError();
           return;
         }
         event.data.longPress.width = width;
         if (!args->PeekNext().IsEmpty()) {
           float height;
           if (!args->GetNext(&height)) {
             args->ThrowError();
             return;
           }
           event.data.longPress.height = height;
         }
       }
       break;
     case WebInputEvent::GestureTwoFingerTap:
-      event.x = point.x;
-      event.y = point.y;
+      event.x = x;
+      event.y = y;
       if (!args->PeekNext().IsEmpty()) {
         float first_finger_width;
         if (!args->GetNext(&first_finger_width)) {
           args->ThrowError();
           return;
         }
         event.data.twoFingerTap.firstFingerWidth = first_finger_width;
         if (!args->PeekNext().IsEmpty()) {
           float first_finger_height;
           if (!args->GetNext(&first_finger_height)) {
@@ skipping 15 matching lines @@
   if (force_layout_on_events_)
     view_->layout();
 
   bool result = view_->handleInputEvent(event);
 
   // Long press might start a drag drop session. Complete it if so.
   if (type == WebInputEvent::GestureLongPress && !current_drag_data_.isNull()) {
     WebMouseEvent mouse_event;
     InitMouseEvent(WebInputEvent::MouseDown,
                    pressed_button_,
-                   point,
+                   WebPoint(x, y),
                    GetCurrentEventTimeSec(),
                    click_count_,
                    0,
                    &mouse_event);
 
     FinishDragAndDrop(mouse_event, blink::WebDragOperationNone);
   }
   args->Return(result);
 }
 
@@ skipping 154 matching lines @@
       }
       default:
         NOTREACHED();
     }
   }
 
   replaying_saved_events_ = false;
 }
 
 }  // namespace content