Changeset 71249 in webkit


Ignore:
Timestamp:
Nov 3, 2010 10:32:56 AM (13 years ago)
Author:
Adam Roben
Message:

Add a plugin test that evaluates JS after removing the plugin element from the document

This test replaces platform/win/plugins/plugin-delayed-destroy.html.
That test was made to prevent a crash very similar to this one, but
unfortunately tested only the mechanism that prevented the crash and
not whether the crash itself was prevented. Since WebKit2 uses a
different mechanism to prevent the crash, the test was failing even
though WebKit2 was not vulnerable to the crash. This new test crashes
if there is no mechanism in place to prevent it and passes in both
WebKit1 and WebKit2.

Fixes <​http://webkit.org/b/46711> <rdar://problem/8485903>
platform/win/plugins/plugin-delayed-destroy.html fails in WebKit2

Reviewed by Anders Carlsson.

WebKitTools:

  • DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
  • DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
  • DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
  • GNUmakefile.am:

Added new file.

  • DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp:

(pluginDeallocate): Make sure we delete the PluginTest object. This
prevents a leak and also allows us to test the crash.

  • DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:

(PluginTest::executeScript): Made this into a non-static member
function.

(PluginTest::waitUntilDone):
(PluginTest::notifyDone):
Updated for changes to executeScript.

  • DumpRenderTree/TestNetscapePlugIn/PluginTest.h: Added executeScript.
  • DumpRenderTree/TestNetscapePlugIn/Tests/EvaluateJSAfterRemovingPluginElement.cpp: Added.

(EvaluateJSAfterRemovingPluginElement::EvaluateJSAfterRemovingPluginElement):
Initialize ourselves and tell the test harness to wait.
(EvaluateJSAfterRemovingPluginElement::NPP_DestroyStream): Remove our
plugin element from the document, then execute some JavaScript. If
WebKit does not have appropriate mechanisms in place, we'll be
destroyed inside the first call to executeScript and crash on the
second call.

LayoutTests:

  • platform/mac/Skipped: Added the new test, which fails in WebKit1 on SnowLeopard.
  • platform/win-wk2/Skipped: Removed platform/win/plugins/plugin-delayed-destroy.html.
  • platform/win/plugins/plugin-delayed-destroy-expected.txt: Removed.
  • platform/win/plugins/plugin-delayed-destroy.html: Removed.
  • plugins/evaluate-js-after-removing-plugin-element-expected.txt: Added.
  • plugins/evaluate-js-after-removing-plugin-element.html: Added.
Location:
trunk
Files:
3 added
2 deleted
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r71245 r71249  
     12010-11-03  Adam Roben  <aroben@apple.com>
     2
     3        Add a plugin test that evaluates JS after removing the plugin element
     4        from the document
     5
     6        This test replaces platform/win/plugins/plugin-delayed-destroy.html.
     7        That test was made to prevent a crash very similar to this one, but
     8        unfortunately tested only the mechanism that prevented the crash and
     9        not whether the crash itself was prevented. Since WebKit2 uses a
     10        different mechanism to prevent the crash, the test was failing even
     11        though WebKit2 was not vulnerable to the crash. This new test crashes
     12        if there is no mechanism in place to prevent it and passes in both
     13        WebKit1 and WebKit2.
     14
     15        Fixes <http://webkit.org/b/46711> <rdar://problem/8485903>
     16        platform/win/plugins/plugin-delayed-destroy.html fails in WebKit2
     17
     18        Reviewed by Anders Carlsson.
     19
     20        * platform/mac/Skipped: Added the new test, which fails in WebKit1 on SnowLeopard.
     21
     22        * platform/win-wk2/Skipped: Removed platform/win/plugins/plugin-delayed-destroy.html.
     23
     24        * platform/win/plugins/plugin-delayed-destroy-expected.txt: Removed.
     25        * platform/win/plugins/plugin-delayed-destroy.html: Removed.
     26
     27        * plugins/evaluate-js-after-removing-plugin-element-expected.txt: Added.
     28        * plugins/evaluate-js-after-removing-plugin-element.html: Added.
     29
    1302010-11-03  Stephen White  <senorblanco@chromium.org>
    231

  • trunk/LayoutTests/platform/mac/Skipped

    r70803 r71249  
    273273# https://bugs.webkit.org/show_bug.cgi?id=47901
    274274fast/canvas/canvas-getImageData-negative-source.html
     275
     276# Times out because plugins aren't allowed to execute JS after NPP_Destroy has been called in WebKit1's OOP plugins implementation http://webkit.org/b/48929
     277plugins/evaluate-js-after-removing-plugin-element.html

  • trunk/LayoutTests/platform/win-wk2/Skipped

    r70781 r71249  
    7676plugins/embed-attributes-style.html
    7777
    78 # http://webkit.org/b/46711
    79 platform/win/plugins/plugin-delayed-destroy.html
    80 
    8178# http://webkit.org/b/46715
    8279plugins/npruntime/invoke-failure.html

  • trunk/WebKitTools/ChangeLog

    r71238 r71249  
     12010-11-03  Adam Roben  <aroben@apple.com>
     2
     3        Add a plugin test that evaluates JS after removing the plugin element
     4        from the document
     5
     6        This test replaces platform/win/plugins/plugin-delayed-destroy.html.
     7        That test was made to prevent a crash very similar to this one, but
     8        unfortunately tested only the mechanism that prevented the crash and
     9        not whether the crash itself was prevented. Since WebKit2 uses a
     10        different mechanism to prevent the crash, the test was failing even
     11        though WebKit2 was not vulnerable to the crash. This new test crashes
     12        if there is no mechanism in place to prevent it and passes in both
     13        WebKit1 and WebKit2.
     14
     15        Fixes <http://webkit.org/b/46711> <rdar://problem/8485903>
     16        platform/win/plugins/plugin-delayed-destroy.html fails in WebKit2
     17
     18        Reviewed by Anders Carlsson.
     19
     20        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
     21        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
     22        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro:
     23        * GNUmakefile.am:
     24        Added new file.
     25
     26        * DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp:
     27        (pluginDeallocate): Make sure we delete the PluginTest object. This
     28        prevents a leak and also allows us to test the crash.
     29
     30        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
     31        (PluginTest::executeScript): Made this into a non-static member
     32        function.
     33
     34        (PluginTest::waitUntilDone):
     35        (PluginTest::notifyDone):
     36        Updated for changes to executeScript.
     37
     38        * DumpRenderTree/TestNetscapePlugIn/PluginTest.h: Added executeScript.
     39
     40        * DumpRenderTree/TestNetscapePlugIn/Tests/EvaluateJSAfterRemovingPluginElement.cpp: Added.
     41        (EvaluateJSAfterRemovingPluginElement::EvaluateJSAfterRemovingPluginElement):
     42        Initialize ourselves and tell the test harness to wait.
     43        (EvaluateJSAfterRemovingPluginElement::NPP_DestroyStream): Remove our
     44        plugin element from the document, then execute some JavaScript. If
     45        WebKit does not have appropriate mechanisms in place, we'll be
     46        destroyed inside the first call to executeScript and crash on the
     47        second call.
     48
    1492010-11-02  Stephen White  <senorblanco@chromium.org>
    250

  • trunk/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj

    r70653 r71249  
    133133                BCF6C6500C98E9C000AC063E /* GCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF6C64F0C98E9C000AC063E /* GCController.cpp */; };
    134134                C06F9ABC1267A7060058E1F6 /* PassDifferentNPPStruct.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C06F9ABB1267A7060058E1F6 /* PassDifferentNPPStruct.cpp */; };
     135                C0E720751281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0E720741281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp */; };
    135136                C0EC3C9C12787F0500939164 /* NullNPPGetValuePointer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C0EC3C9B12787F0500939164 /* NullNPPGetValuePointer.cpp */; };
    136137                E1B7816511AF31B7007E1BC2 /* MockGeolocationProvider.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1B7808711AF1669007E1BC2 /* MockGeolocationProvider.mm */; };
    … …  
    308309                BCF6C64F0C98E9C000AC063E /* GCController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = GCController.cpp; sourceTree = "<group>"; };
    309310                C06F9ABB1267A7060058E1F6 /* PassDifferentNPPStruct.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PassDifferentNPPStruct.cpp; sourceTree = "<group>"; };
     311                C0E720741281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EvaluateJSAfterRemovingPluginElement.cpp; sourceTree = "<group>"; };
    310312                C0EC3C9B12787F0500939164 /* NullNPPGetValuePointer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NullNPPGetValuePointer.cpp; sourceTree = "<group>"; };
    311313                E1B7808511AF1643007E1BC2 /* MockGeolocationProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = MockGeolocationProvider.h; path = mac/MockGeolocationProvider.h; sourceTree = "<group>"; };
    … …  
    463465                        children = (
    464466                                1A215A7511F26072008AD0F5 /* DocumentOpenInDestroyStream.cpp */,
     467                                C0E720741281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp */,
    465468                                1A24BAA8120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp */,
    466469                                1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */,
    … …  
    752755                                C06F9ABC1267A7060058E1F6 /* PassDifferentNPPStruct.cpp in Sources */,
    753756                                C0EC3C9C12787F0500939164 /* NullNPPGetValuePointer.cpp in Sources */,
     757                                C0E720751281C828004EF533 /* EvaluateJSAfterRemovingPluginElement.cpp in Sources */,
    754758                        );
    755759                        runOnlyForDeploymentPostprocessing = 0;

  • trunk/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp

    r70653 r71249  
    2828#include "PluginObject.h"
    2929
     30#include "PluginTest.h"
    3031#include "TestObject.h"
    3132#include <assert.h>
    … …  
    991992{
    992993    PluginObject* plugin = reinterpret_cast<PluginObject*>(header);
     994    delete plugin->pluginTest;
    993995    if (plugin->testObject)
    994996        browser->releaseobject(plugin->testObject);

  • trunk/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp

    r70662 r71249  
    102102}
    103103
    104 static void executeScript(NPP npp, const char* script)
     104void PluginTest::executeScript(const char* script)
    105105{
    106106    NPObject* windowScriptObject;
    107     browser->getvalue(npp, NPNVWindowNPObject, &windowScriptObject);
     107    browser->getvalue(m_npp, NPNVWindowNPObject, &windowScriptObject);
    108108
    109109    NPString npScript;
    … …  
    112112
    113113    NPVariant browserResult;
    114     browser->evaluate(npp, windowScriptObject, &npScript, &browserResult);
     114    browser->evaluate(m_npp, windowScriptObject, &npScript, &browserResult);
    115115    browser->releasevariantvalue(&browserResult);
    116116}
    … …  
    118118void PluginTest::waitUntilDone()
    119119{
    120     executeScript(m_npp, "layoutTestController.waitUntilDone()");
     120    executeScript("layoutTestController.waitUntilDone()");
    121121}
    122122
    123123void PluginTest::notifyDone()
    124124{
    125     executeScript(m_npp, "layoutTestController.notifyDone()");
     125    executeScript("layoutTestController.notifyDone()");
    126126}
    127127

  • trunk/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h

    r70662 r71249  
    6969    bool NPN_RemoveProperty(NPObject*, NPIdentifier propertyName);
    7070   
     71    void executeScript(const char*);
     72
    7173    template<typename TestClassTy> class Register {
    7274    public:

  • trunk/WebKitTools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj

    r70653 r71249  
    376376                        </File>
    377377                        <File
     378                                RelativePath="..\Tests\EvaluateJSAfterRemovingPluginElement.cpp"
     379                                >
     380                        </File>
     381                        <File
    378382                                RelativePath="..\Tests\NPRuntimeObjectFromDestroyedPlugin.cpp"
    379383                                >

  • trunk/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro

    r70653 r71249  
    3030          TestObject.cpp \
    3131          Tests/DocumentOpenInDestroyStream.cpp \
     32          Tests/EvaluateJSAfterRemovingPluginElement.cpp \
    3233          Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
    3334          Tests/NPRuntimeRemoveProperty.cpp \

  • trunk/WebKitTools/GNUmakefile.am

    r70653 r71249  
    168168        WebKitTools/DumpRenderTree/unix/TestNetscapePlugin/TestNetscapePlugin.cpp \
    169169        WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/DocumentOpenInDestroyStream.cpp \
     170        WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/EvaluateJSAfterRemovingPluginElement.cpp \
    170171        WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
    171172        WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/NPRuntimeRemoveProperty.cpp \
Note: See TracChangeset for help on using the changeset viewer.