Bug 594774. Tests for this bug. r=dbaron a=blocking

2010-09-17 12:09:09 -07:00 · 2010-09-17 12:09:09 -07:00 · 4c11a9961d
--- a/modules/plugin/test/crashtests/522512-1.html
+++ b/modules/plugin/test/crashtests/522512-1.html
@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<script>
+var doingTest = false;
+function onPaint() {
+  if (!doingTest)
+    return;
+
+  var d = document.getElementById("d");
+  if (d) {
+    document.body.removeChild(d);
+  }
+  document.documentElement.removeAttribute("class");
+}
+function runTest() {
+  doingTest = true;
+  // Force a repaint of the entire page
+  document.body.style.backgroundColor = "lime";
+}
+window.addEventListener("MozReftestInvalidate", runTest, false);
+</script>
+</head>
+<body>
+  <embed type="application/x-test" paintscript="onPaint()"
+         style="position:absolute; top:20px; left:20px; width:200px; height:200px;"></embed>
+  <div id="d" style="position:absolute; top:50px; left:50px; width:100px; height:100px">
+    Hello Kitty
+  </div>
+</body>
+</html>
--- a/modules/plugin/test/crashtests/crashtests.list
+++ b/modules/plugin/test/crashtests/crashtests.list
@ -1,7 +1,7 @@
 load 41276-1.html
 load 48856-1.html
-
 load 110650-1.html
+skip-if(winWidget) asserts(4) load 522512-1.html
 skip-if(cocoaWidget) script 539897-1.html
 script 540114-1.html
 load 570884.html
--- a/modules/plugin/test/testplugin/README
+++ b/modules/plugin/test/testplugin/README
@ -130,6 +130,13 @@ with a boolean value, indicating whether the tests were successful.
 NPN_PluginThreadAsyncCall.  When finished, calls the script callback
 with a boolean value, indicating whether the tests were successful.

+* paintscript="..." content attribute
+If the "paintscript" attribute is set on the plugin element during plugin
+initialization, then every time the plugin paints it gets the contents of that
+attribute and evaluates it as a script in the context of the plugin's DOM
+window. This is useful for testing evil plugin code that might, for example,
+modify the DOM during painting.
+
 == Private browsing ==

 The test plugin object supports the following scriptable methods:
--- a/modules/plugin/test/testplugin/nptest.cpp
+++ b/modules/plugin/test/testplugin/nptest.cpp
@ -693,6 +693,7 @@ NPP_New(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc, char*
  instanceData->fileBuf = NULL;
  instanceData->fileBufSize = 0;
  instanceData->throwOnNextInvoke = false;
+  instanceData->runScriptOnPaint = false;
  instanceData->testrange = NULL;
  instanceData->hasWidget = false;
  instanceData->npnNewStream = false;
@ -743,7 +744,7 @@ NPP_New(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc, char*
        requestWindow = true;
      }
    }
-	  if (strcmp(argn[i], "streammode") == 0) {
+    if (strcmp(argn[i], "streammode") == 0) {
      if (strcmp(argv[i], "normal") == 0) {
        instanceData->streamMode = NP_NORMAL;
      }
@ -757,7 +758,7 @@ NPP_New(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc, char*
      else if (strcmp(argv[i], "seek") == 0) {
        instanceData->streamMode = NP_SEEK;
      }
-	  }
+    }
    if (strcmp(argn[i], "streamchunksize") == 0) {
      instanceData->streamChunkSize = atoi(argv[i]);
    }
@ -811,6 +812,9 @@ NPP_New(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc, char*
    if (strcmp(argn[i], "newcrash") == 0) {
      IntentionalCrash();
    }
+    if (strcmp(argn[i], "paintscript") == 0) {
+      instanceData->runScriptOnPaint = true;
+    }
    // "cleanupwidget" is only used with nptest_gtk, defaulting to true.  It
    // indicates whether the plugin should destroy its window in response to
    // NPP_Destroy (or let the platform destroy the widget when the parent
@ -2390,6 +2394,33 @@ void notifyDidPaint(InstanceData* instanceData)
    r.bottom = instanceData->window.height;
    NPN_InvalidateRect(instanceData->npp, &r);
  }
+
+  if (instanceData->runScriptOnPaint) {
+    NPObject* o = NULL;
+    NPN_GetValue(instanceData->npp, NPNVPluginElementNPObject, &o);
+    if (o) {
+      NPVariant param;
+      STRINGZ_TO_NPVARIANT("paintscript", param);
+      NPVariant result;
+      NPN_Invoke(instanceData->npp, o, NPN_GetStringIdentifier("getAttribute"),
+                 &param, 1, &result);
+
+      if (NPVARIANT_IS_STRING(result)) {
+        NPObject* windowObject;
+        NPN_GetValue(instanceData->npp, NPNVWindowNPObject, &windowObject);
+        if (windowObject) {
+          NPVariant evalResult;
+          NPN_Evaluate(instanceData->npp, windowObject,
+                       (NPString*)&NPVARIANT_TO_STRING(result), &evalResult);
+          NPN_ReleaseVariantValue(&evalResult);
+          NPN_ReleaseObject(windowObject);
+        }
+      }
+
+      NPN_ReleaseVariantValue(&result);
+      NPN_ReleaseObject(o);
+    }
+  }
 }

 static const NPClass kTestSharedNPClass = {
--- a/modules/plugin/test/testplugin/nptest.h
+++ b/modules/plugin/test/testplugin/nptest.h
@ -99,6 +99,7 @@ typedef struct InstanceData {
  bool hasWidget;
  bool npnNewStream;
  bool throwOnNextInvoke;
+  bool runScriptOnPaint;
  uint32_t timerID[2];
  bool timerTestResult;
  bool asyncCallbackResult;
--- a/modules/plugin/test/testplugin/nptest_gtk2.cpp
+++ b/modules/plugin/test/testplugin/nptest_gtk2.cpp
@ -165,13 +165,14 @@ pluginDrawWindow(InstanceData* instanceData, GdkDrawable* gdkWindow,
  int y = instanceData->hasWidget ? 0 : window.y;
  int width = window.width;
  int height = window.height;
+  
+  notifyDidPaint(instanceData);

  if (instanceData->scriptableObject->drawMode == DM_SOLID_COLOR) {
    // drawing a solid color for reftests
    pluginDrawSolid(instanceData, gdkWindow,
                    invalidRect.x, invalidRect.y,
                    invalidRect.width, invalidRect.height);
-    notifyDidPaint(instanceData);
    return;
  }

@ -217,8 +218,6 @@ pluginDrawWindow(InstanceData* instanceData, GdkDrawable* gdkWindow,
  g_object_unref(pangoTextLayout);

  g_object_unref(gdkContext);
-
-  notifyDidPaint(instanceData);
 }

 static gboolean
--- a/modules/plugin/test/testplugin/nptest_macosx.mm
+++ b/modules/plugin/test/testplugin/nptest_macosx.mm
@ -139,6 +139,8 @@ pluginDraw(InstanceData* instanceData, NPCocoaEvent* event)
  if (!instanceData)
    return;

+  notifyDidPaint(instanceData);
+
  NPP npp = instanceData->npp;
  if (!npp)
    return;
@ -241,8 +243,6 @@ pluginDraw(InstanceData* instanceData, NPCocoaEvent* event)
    break;
  }
  }
-
-  notifyDidPaint(instanceData);
 }

 int16_t
--- a/modules/plugin/test/testplugin/nptest_windows.cpp
+++ b/modules/plugin/test/testplugin/nptest_windows.cpp
@ -202,6 +202,8 @@ pluginDraw(InstanceData* instanceData)
  HDC hdc = NULL;
  PAINTSTRUCT ps;

+  notifyDidPaint(instanceData);
+
  if (instanceData->hasWidget)
    hdc = ::BeginPaint((HWND)instanceData->window.window, &ps);
  else
@ -227,8 +229,6 @@ pluginDraw(InstanceData* instanceData)

  if (instanceData->hasWidget)
    ::EndPaint((HWND)instanceData->window.window, &ps);
-
-  notifyDidPaint(instanceData);
 }

 /* script interface */