diff options
author | nasko <nasko@chromium.org> | 2014-10-20 14:05:02 -0700 |
---|---|---|
committer | Commit bot <commit-bot@chromium.org> | 2014-10-20 21:05:53 +0000 |
commit | d2c7272b80fe61a11cd2f04f17fb6caf52631010 (patch) | |
tree | b1ff489847b6c061fc1ff0b0897915e5b4848938 /content/browser/frame_host/render_frame_host_manager_unittest.cc | |
parent | b7893322082382329bf46d20d91c4695c234026c (diff) | |
download | chromium_src-d2c7272b80fe61a11cd2f04f17fb6caf52631010.zip chromium_src-d2c7272b80fe61a11cd2f04f17fb6caf52631010.tar.gz chromium_src-d2c7272b80fe61a11cd2f04f17fb6caf52631010.tar.bz2 |
Revert of Drop CreateChildFrame messages when swapping out. (patchset #1 id:1 of https://codereview.chromium.org/649683007/)
Reason for revert:
It broke compile since this CL relies on https://crrev.com/cce56cd951f6685a0120db63418aa7e6d3df28f2 and it isn't in this branch.
Original issue's description:
> Drop CreateChildFrame messages when swapping out.
>
> There is a race condition in the current state of the code where in cross-process navigation we swap the existing RenderFrameHost with a new RenderFrameHost. If the existing host sends an IPC message to create a new child frame, it arrives on the IO thread, allocates a routing id based of the existing process (p1) and does a PostTask to the UI thread. If there is a CommitPending event either executing on the UI thread or in the task queue before the task posted from the IO thread, it will end up putting the existing RenderFrameHost in swapped out state (or waiting for swapped out). When the task to create a child frame is executed after that, it creates a new RenderFrameHost, but it uses the "current" process (p2), which is different than the process that sent the message (p1). This manifests sometimes as adding duplicate routing ids to RenderProcessHost and is in general really bad bug.
>
> BUG=415059, 423691, 381990
>
> Review URL: https://codereview.chromium.org/642813007
>
> Cr-Commit-Position: refs/heads/master@{#299939}
> (cherry picked from commit dcdb02fab210ec5f7b8b560075ce96d0f48f344c)
>
> Conflicts:
> content/browser/frame_host/navigator_impl_unittest.cc
>
> R=creis@chromium.org
>
> Committed: https://chromium.googlesource.com/chromium/src/+/a6a21983b1a29ad11d30782c66d95facca65ab55
TBR=creis@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=415059, 423691, 381990
Review URL: https://codereview.chromium.org/663183003
Cr-Commit-Position: refs/heads/master@{#300332}
Diffstat (limited to 'content/browser/frame_host/render_frame_host_manager_unittest.cc')
-rw-r--r-- | content/browser/frame_host/render_frame_host_manager_unittest.cc | 65 |
1 files changed, 1 insertions, 64 deletions
diff --git a/content/browser/frame_host/render_frame_host_manager_unittest.cc b/content/browser/frame_host/render_frame_host_manager_unittest.cc index c718043..b03471e 100644 --- a/content/browser/frame_host/render_frame_host_manager_unittest.cc +++ b/content/browser/frame_host/render_frame_host_manager_unittest.cc @@ -148,29 +148,6 @@ class RenderViewHostDeletedObserver : public WebContentsObserver { DISALLOW_COPY_AND_ASSIGN(RenderViewHostDeletedObserver); }; -// This observer keeps track of the last created RenderFrameHost to allow tests -// to ensure that no RenderFrameHost objects are created when not expected. -class RenderFrameHostCreatedObserver : public WebContentsObserver { - public: - RenderFrameHostCreatedObserver(WebContents* web_contents) - : WebContentsObserver(web_contents), - created_(false) { - } - - virtual void RenderFrameCreated(RenderFrameHost* render_frame_host) override { - created_ = true; - } - - bool created() { - return created_; - } - - private: - bool created_; - - DISALLOW_COPY_AND_ASSIGN(RenderFrameHostCreatedObserver); -}; - // This observer keeps track of the last deleted RenderFrameHost to avoid // accessing it and causing use-after-free condition. class RenderFrameHostDeletedObserver : public WebContentsObserver { @@ -201,6 +178,7 @@ class RenderFrameHostDeletedObserver : public WebContentsObserver { DISALLOW_COPY_AND_ASSIGN(RenderFrameHostDeletedObserver); }; + // This observer is used to check whether IPC messages are being filtered for // swapped out RenderFrameHost objects. It observes the plugin crash and favicon // update events, which the FilterMessagesWhileSwappedOut test simulates being @@ -589,47 +567,6 @@ TEST_F(RenderFrameHostManagerTest, FilterMessagesWhileSwappedOut) { EXPECT_TRUE(ntp_process_host->sink().GetUniqueMessageMatching(IPC_REPLY_ID)); } -// Ensure that frames aren't added to the frame tree, if the message is coming -// from a process different than the parent frame's current RenderFrameHost -// process. Otherwise it is possible to have collisions of routing ids, as they -// are scoped per process. See https://crbug.com/415059. -TEST_F(RenderFrameHostManagerTest, DropCreateChildFrameWhileSwappedOut) { - const GURL kUrl1("http://foo.com"); - const GURL kUrl2("http://www.google.com/"); - - // Navigate to the first site. - NavigateActiveAndCommit(kUrl1); - TestRenderFrameHost* initial_rfh = contents()->GetMainFrame(); - { - RenderFrameHostCreatedObserver observer(contents()); - initial_rfh->OnCreateChildFrame( - initial_rfh->GetProcess()->GetNextRoutingID(), std::string()); - EXPECT_TRUE(observer.created()); - } - - // Create one more frame in the same SiteInstance where initial_rfh - // exists so that initial_rfh doesn't get deleted on navigation to another - // site. - initial_rfh->GetSiteInstance()->increment_active_frame_count(); - - // Navigate to a cross-site URL. - NavigateActiveAndCommit(kUrl2); - EXPECT_TRUE(initial_rfh->is_swapped_out()); - - TestRenderFrameHost* dest_rfh = contents()->GetMainFrame(); - ASSERT_TRUE(dest_rfh); - EXPECT_NE(initial_rfh, dest_rfh); - - { - // Since the old RFH is now swapped out, it shouldn't process any messages - // to create child frames. - RenderFrameHostCreatedObserver observer(contents()); - initial_rfh->OnCreateChildFrame( - initial_rfh->GetProcess()->GetNextRoutingID(), std::string()); - EXPECT_FALSE(observer.created()); - } -} - TEST_F(RenderFrameHostManagerTest, WhiteListSwapCompositorFrame) { TestRenderFrameHost* swapped_out_rfh = CreateSwappedOutRenderFrameHost(); TestRenderWidgetHostView* swapped_out_rwhv = |