Support window.opener after a process swap.

content/browser/renderer_host/render_view_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_view_host.h"
 
 #include <string>
 #include <utility>
 #include <vector>
 
@@ skipping 74 matching lines @@
 
 RenderViewHost::RenderViewHost(SiteInstance* instance,
                                RenderViewHostDelegate* delegate,
                                int routing_id,
                                SessionStorageNamespace* session_storage)
     : RenderWidgetHost(instance->GetProcess(), routing_id),
       instance_(instance),
       delegate_(delegate),
       waiting_for_drag_context_response_(false),
       enabled_bindings_(0),
-      pending_request_id_(0),
+      pending_request_id_(-1),
       navigations_suspended_(false),
       suspended_nav_message_(NULL),
+      is_swapped_out_(false),
       run_modal_reply_msg_(NULL),
       is_waiting_for_beforeunload_ack_(false),
       is_waiting_for_unload_ack_(false),
       unload_ack_is_for_cross_site_transition_(false),
       are_javascript_messages_suppressed_(false),
       sudden_termination_allowed_(false),
       session_storage_namespace_(session_storage),
       is_extension_process_(false),
       save_accessibility_tree_for_testing_(false),
       render_view_termination_status_(base::TERMINATION_STATUS_STILL_RUNNING) {
@@ skipping 143 matching lines @@
   Navigate(params);
 }
 
 void RenderViewHost::SetNavigationsSuspended(bool suspend) {
   // This should only be called to toggle the state.
   DCHECK(navigations_suspended_ != suspend);
 
   navigations_suspended_ = suspend;
   if (!suspend && suspended_nav_message_.get()) {
     // There's a navigation message waiting to be sent.  Now that we're not
-    // suspended anymore, resume navigation by sending it.
+    // suspended anymore, resume navigation by sending it.  If we were swapped
+    // out, we should also stop filtering out the IPC messages now.
+    is_swapped_out_ = false;
     Send(suspended_nav_message_.release());
   }
 }
 
+void RenderViewHost::CancelSuspendedNavigations() {
+  // Clear any state if a pending navigation is canceled or pre-empted.
+  if (suspended_nav_message_.get())
+    suspended_nav_message_.reset();
+  navigations_suspended_ = false;
+}
+
 void RenderViewHost::FirePageBeforeUnload(bool for_cross_site_transition) {
   if (!IsRenderViewLive()) {
     // This RenderViewHost doesn't have a live renderer, so just skip running
     // the onbeforeunload handler.
     is_waiting_for_beforeunload_ack_ = true;  // Checked by OnMsgShouldCloseACK.
     unload_ack_is_for_cross_site_transition_ = for_cross_site_transition;
     OnMsgShouldCloseACK(true);
     return;
   }
 
@@ skipping 12 matching lines @@
   } else {
     // Start the hang monitor in case the renderer hangs in the beforeunload
     // handler.
     is_waiting_for_beforeunload_ack_ = true;
     unload_ack_is_for_cross_site_transition_ = for_cross_site_transition;
     StartHangMonitorTimeout(TimeDelta::FromMilliseconds(kUnloadTimeoutMS));
     Send(new ViewMsg_ShouldClose(routing_id()));
   }
 }
 
-void RenderViewHost::ClosePage(bool for_cross_site_transition,
-                               int new_render_process_host_id,
-                               int new_request_id) {
-  // This will be set back to false in OnClosePageACK, just before we close the
-  // tab or replace it with a pending RVH.  There are some cases (such as 204
-  // errors) where we'll continue to show this RVH.
+void RenderViewHost::SwapOut(int new_render_process_host_id,
+                             int new_request_id) {
+  // Start filtering IPC messages to avoid confusing the delegate.  This will
+  // prevent any dialogs from appearing during unload handlers, but we've
+  // already decided to silence them in crbug.com/68780.  We will set it back
+  // to false in SetNavigationsSuspended if we swap back in.
+  is_swapped_out_ = true;
+
+  // This will be set back to false in OnSwapOutACK, just before we replace
+  // this RVH with the pending RVH.
   is_waiting_for_unload_ack_ = true;
   // Start the hang monitor in case the renderer hangs in the unload handler.
   StartHangMonitorTimeout(TimeDelta::FromMilliseconds(kUnloadTimeoutMS));
 
-  ViewMsg_ClosePage_Params params;
+  ViewMsg_SwapOut_Params params;
   params.closing_process_id = process()->id();
   params.closing_route_id = routing_id();
-  params.for_cross_site_transition = for_cross_site_transition;
   params.new_render_process_host_id = new_render_process_host_id;
   params.new_request_id = new_request_id;
   if (IsRenderViewLive()) {
+    Send(new ViewMsg_SwapOut(routing_id(), params));
+  } else {
+    // This RenderViewHost doesn't have a live renderer, so just skip the unload
+    // event.  We must notify the ResourceDispatcherHost on the IO thread,
+    // which we will do through the RenderProcessHost's widget helper.
+    process()->CrossSiteSwapOutACK(params);
+  }
+}
+
+void RenderViewHost::OnSwapOutACK() {
+  // Stop the hang monitor now that the unload handler has finished.
+  StopHangMonitorTimeout();
+  is_waiting_for_unload_ack_ = false;
+}
+
+void RenderViewHost::WasSwappedOut() {
+  // Don't bother reporting hung state anymore.
+  StopHangMonitorTimeout();
+
+  // Inform the renderer that it can exit if no one else is using it.
+  Send(new ViewMsg_WasSwappedOut(routing_id()));
+}
+
+void RenderViewHost::ClosePage() {
+  // Start the hang monitor in case the renderer hangs in the unload handler.
+  is_waiting_for_unload_ack_ = true;
+  StartHangMonitorTimeout(TimeDelta::FromMilliseconds(kUnloadTimeoutMS));
+
+  if (IsRenderViewLive()) {
+    // TODO(creis): Should this be moved to Shutdown?  It may not be called for
+    // RenderViewHosts that have been swapped out.
     NotificationService::current()->Notify(
         NotificationType::RENDER_VIEW_HOST_WILL_CLOSE_RENDER_VIEW,
         Source<RenderViewHost>(this),
         NotificationService::NoDetails());
 
-    Send(new ViewMsg_ClosePage(routing_id(), params));
+    Send(new ViewMsg_ClosePage(routing_id()));
   } else {
-    // This RenderViewHost doesn't have a live renderer, so just skip closing
-    // the page.  We must notify the ResourceDispatcherHost on the IO thread,
-    // which we will do through the RenderProcessHost's widget helper.
-    process()->CrossSiteClosePageACK(params);
-  }
-}
-
-void RenderViewHost::OnClosePageACK(bool for_cross_site_transition) {
-  StopHangMonitorTimeout();
-  is_waiting_for_unload_ack_ = false;
-
-  // If this ClosePageACK is not for a cross-site transition, then it is for an
-  // attempt to close the tab.  We have now finished the unload handler and can
-  // proceed with closing the tab.
-  if (!for_cross_site_transition) {
+    // This RenderViewHost doesn't have a live renderer, so just skip the unload
+    // event and close the page.
     ClosePageIgnoringUnloadEvents();
   }
 }
 
 void RenderViewHost::ClosePageIgnoringUnloadEvents() {
   StopHangMonitorTimeout();
   is_waiting_for_beforeunload_ack_ = false;
   is_waiting_for_unload_ack_ = false;
 
   sudden_termination_allowed_ = true;
@@ skipping 333 matching lines @@
   return sudden_termination_allowed_ || process()->sudden_termination_allowed();
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 // RenderViewHost, IPC message handlers:
 
 bool RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
   if (!BrowserMessageFilter::CheckCanDispatchOnUI(msg, this))
     return true;
 
+  // Filter out most IPC messages if this renderer is swapped out.
+  // We still want to certain ACKs to keep our state consistent.
+  if (is_swapped_out_)
+    if (!CanHandleWhileSwappedOut(msg))
+      return true;
+
   {
     // delegate_->OnMessageReceived can end up deleting |this|, in which case
     // the destructor for ObserverListBase::Iterator would access the deleted
     // observers_.
     ObserverListBase<RenderViewHostObserver>::Iterator it(observers_);
     RenderViewHostObserver* observer;
     while ((observer = it.GetNext()) != NULL)
       if (observer->OnMessageReceived(msg))
         return true;
   }
@@ skipping 37 matching lines @@
     IPC_MESSAGE_HANDLER(ViewHostMsg_SetTooltipText, OnMsgSetTooltipText)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunJavaScriptMessage,
                                     OnMsgRunJavaScriptMessage)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunBeforeUnloadConfirm,
                                     OnMsgRunBeforeUnloadConfirm)
     IPC_MESSAGE_HANDLER(DragHostMsg_StartDragging, OnMsgStartDragging)
     IPC_MESSAGE_HANDLER(DragHostMsg_UpdateDragCursor, OnUpdateDragCursor)
     IPC_MESSAGE_HANDLER(ViewHostMsg_TakeFocus, OnTakeFocus)
     IPC_MESSAGE_HANDLER(ViewHostMsg_AddMessageToConsole, OnAddMessageToConsole)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShouldClose_ACK, OnMsgShouldCloseACK)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_ClosePage_ACK, OnMsgClosePageACK)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SelectionChanged, OnMsgSelectionChanged)
     IPC_MESSAGE_HANDLER(ViewHostMsg_AccessibilityNotifications,
                         OnAccessibilityNotifications)
     IPC_MESSAGE_HANDLER(ViewHostMsg_OnCSSInserted, OnCSSInserted)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ContentBlocked, OnContentBlocked)
     IPC_MESSAGE_HANDLER(ViewHostMsg_AppCacheAccessed, OnAppCacheAccessed)
     IPC_MESSAGE_HANDLER(ViewHostMsg_WebDatabaseAccessed, OnWebDatabaseAccessed)
     IPC_MESSAGE_HANDLER(ViewHostMsg_FocusedNodeChanged, OnMsgFocusedNodeChanged)
     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateZoomLimits, OnUpdateZoomLimits)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ScriptEvalResponse, OnScriptEvalResponse)
 #if defined(OS_MACOSX)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowPopup, OnMsgShowPopup)
 #endif
     IPC_MESSAGE_HANDLER(ViewHostMsg_CommandStateChanged,
                         OnCommandStateChanged)
     // Have the super handle all other messages.
     IPC_MESSAGE_UNHANDLED(handled = RenderWidgetHost::OnMessageReceived(msg))
   IPC_END_MESSAGE_MAP_EX()
 
   if (!msg_is_ok) {
     // The message had a handler, but its de-serialization failed.
     // Kill the renderer.
     UserMetrics::RecordAction(UserMetricsAction("BadMessageTerminate_RVH"));
     process()->ReceivedBadMessage();
   }
 
   return handled;
 }
 
+bool RenderViewHost::CanHandleWhileSwappedOut(const IPC::Message& msg) {
+  // We drop most messages that arrive from a swapped out renderer.  However,
+  // some are important (e.g., ACKs) for keeping the browser and renderer state
+  // consistent in case we later return to the renderer.
+  switch (msg.type()) {
+    // Sends an ACK.
+    case ViewHostMsg_ShowView::ID:
+    // Sends an ACK.
+    case ViewHostMsg_ShowWidget::ID:
+    // Sends an ACK.
+    case ViewHostMsg_ShowFullscreenWidget::ID:
+    // Updates browser state.
+    case ViewHostMsg_RenderViewReady::ID:
+    // Updates browser state.
+    case ViewHostMsg_RenderViewGone::ID:
+    // Updates the previous navigation entry.
+    case ViewHostMsg_UpdateState::ID:
+    // Sends an ACK.
+    case ViewHostMsg_UpdateTargetURL::ID:
+    // Updates browser state.
+    case ViewHostMsg_Snapshot::ID:
+    // We allow closing even if we are in the process of swapping out.
+    case ViewHostMsg_Close::ID:
+    // Sends an ACK.
+    case ViewHostMsg_RequestMove::ID:
+    // Updates browser state, and important for tests.
+    case ViewHostMsg_DomOperationResponse::ID:
+    // Suppresses dialog and sends an ACK.
+    case ViewHostMsg_RunJavaScriptMessage::ID:
+    // Suppresses dialog and sends an ACK.
+    case ViewHostMsg_RunBeforeUnloadConfirm::ID:
+    // Stops hang monitor.
+    case ViewHostMsg_ShouldClose_ACK::ID:
+    // We allow closing even if we are in the process of swapping out.
+    case ViewHostMsg_ClosePage_ACK::ID:
+    // Sends an ACK.
+    case ViewHostMsg_AccessibilityNotifications::ID:
+      return true;
+    default:
+      break;
+  }
+  return false;
+}
+
 void RenderViewHost::Shutdown() {
   // If we are being run modally (see RunModal), then we need to cleanup.
   if (run_modal_reply_msg_) {
     Send(run_modal_reply_msg_);
     run_modal_reply_msg_ = NULL;
   }
 
   RenderWidgetHost::Shutdown();
 }
 
@@ skipping 23 matching lines @@
   if (view)
     view->CreateNewFullscreenWidget(route_id);
 }
 
 void RenderViewHost::OnMsgShowView(int route_id,
                                    WindowOpenDisposition disposition,
                                    const gfx::Rect& initial_pos,
                                    bool user_gesture) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
   if (view) {
-    view->ShowCreatedWindow(route_id, disposition, initial_pos, user_gesture);
+    if (!is_swapped_out_)
+      view->ShowCreatedWindow(route_id, disposition, initial_pos, user_gesture);
     Send(new ViewMsg_Move_ACK(route_id));
   }
 }
 
 void RenderViewHost::OnMsgShowWidget(int route_id,
                                      const gfx::Rect& initial_pos) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
   if (view) {
-    view->ShowCreatedWidget(route_id, initial_pos);
+    if (!is_swapped_out_)
+      view->ShowCreatedWidget(route_id, initial_pos);
     Send(new ViewMsg_Move_ACK(route_id));
   }
 }
 
 void RenderViewHost::OnMsgShowFullscreenWidget(int route_id) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
   if (view) {
-    view->ShowCreatedFullscreenWidget(route_id);
+    if (!is_swapped_out_)
+      view->ShowCreatedFullscreenWidget(route_id);
     Send(new ViewMsg_Move_ACK(route_id));
   }
 }
 
 void RenderViewHost::OnMsgRunModal(IPC::Message* reply_msg) {
   DCHECK(!run_modal_reply_msg_);
   run_modal_reply_msg_ = reply_msg;
 
   // TODO(darin): Bug 1107929: Need to inform our delegate to show this view in
   // an app-modal fashion.
@@ skipping 101 matching lines @@
   }
   delegate_->UpdateTitle(this, page_id, title);
 }
 
 void RenderViewHost::OnMsgUpdateEncoding(const std::string& encoding_name) {
   delegate_->UpdateEncoding(this, encoding_name);
 }
 
 void RenderViewHost::OnMsgUpdateTargetURL(int32 page_id,
                                           const GURL& url) {
-  delegate_->UpdateTargetURL(page_id, url);
+  if (!is_swapped_out_)
+    delegate_->UpdateTargetURL(page_id, url);
 
   // Send a notification back to the renderer that we are ready to
   // receive more target urls.
   Send(new ViewMsg_UpdateTargetURL_ACK(routing_id()));
 }
 
 void RenderViewHost::OnUpdateInspectorSetting(
     const std::string& key, const std::string& value) {
   delegate_->UpdateInspectorSetting(key, value);
 }
 
 void RenderViewHost::OnMsgClose() {
   // If the renderer is telling us to close, it has already run the unload
   // events, and we can take the fast path.
   ClosePageIgnoringUnloadEvents();
 }
 
 void RenderViewHost::OnMsgRequestMove(const gfx::Rect& pos) {
-  delegate_->RequestMove(pos);
+  if (!is_swapped_out_)
+    delegate_->RequestMove(pos);
   Send(new ViewMsg_Move_ACK(routing_id()));
 }
 
 void RenderViewHost::OnMsgDidStartLoading() {
   delegate_->DidStartLoading();
 }
 
 void RenderViewHost::OnMsgDidStopLoading() {
   delegate_->DidStopLoading();
 }
@@ skipping 100 matching lines @@
 void RenderViewHost::OnMsgRunJavaScriptMessage(
     const std::wstring& message,
     const std::wstring& default_prompt,
     const GURL& frame_url,
     const int flags,
     IPC::Message* reply_msg) {
   // While a JS message dialog is showing, tabs in the same process shouldn't
   // process input events.
   process()->set_ignore_input_events(true);
   StopHangMonitorTimeout();
-  delegate_->RunJavaScriptMessage(message, default_prompt, frame_url, flags,
-                                  reply_msg,
+  delegate_->RunJavaScriptMessage(this, message, default_prompt, frame_url,
+                                  flags, reply_msg,
                                   &are_javascript_messages_suppressed_);
 }
 
 void RenderViewHost::OnMsgRunBeforeUnloadConfirm(const GURL& frame_url,
                                                  const std::wstring& message,
                                                  IPC::Message* reply_msg) {
   // While a JS before unload dialog is showing, tabs in the same process
   // shouldn't process input events.
   process()->set_ignore_input_events(true);
   StopHangMonitorTimeout();
-  delegate_->RunBeforeUnloadConfirm(message, reply_msg);
+  delegate_->RunBeforeUnloadConfirm(this, message, reply_msg);
 }
 
 void RenderViewHost::MediaPlayerActionAt(const gfx::Point& location,
                                          const WebMediaPlayerAction& action) {
   // TODO(ajwong): Which thread should run this?  Does it matter?
   Send(new ViewMsg_MediaPlayerActionAt(routing_id(), location, action));
 }
 
 void RenderViewHost::ContextMenuClosed(
     const webkit_glue::CustomContextMenuContext& custom_context) {
   Send(new ViewMsg_ContextMenuClosed(routing_id(), custom_context));
 }
 
 void RenderViewHost::OnMsgStartDragging(
     const WebDropData& drop_data,
     WebDragOperationsMask drag_operations_mask,
     const SkBitmap& image,
     const gfx::Point& image_offset) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
   if (view)
-      view->StartDragging(drop_data, drag_operations_mask, image, image_offset);
+    view->StartDragging(drop_data, drag_operations_mask, image, image_offset);
 }
 
 void RenderViewHost::OnUpdateDragCursor(WebDragOperation current_op) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
   if (view)
     view->UpdateDragCursor(current_op);
 }
 
 void RenderViewHost::OnTakeFocus(bool reverse) {
   RenderViewHostDelegate::View* view = delegate_->GetViewDelegate();
@@ skipping 36 matching lines @@
 
 void RenderViewHost::OnUserGesture() {
   delegate_->OnUserGesture();
 }
 
 void RenderViewHost::OnMsgShouldCloseACK(bool proceed) {
   StopHangMonitorTimeout();
   // If this renderer navigated while the beforeunload request was in flight, we
   // may have cleared this state in OnMsgNavigate, in which case we can ignore
   // this message.
-  if (!is_waiting_for_beforeunload_ack_)
+  if (!is_waiting_for_beforeunload_ack_ || is_swapped_out_)
     return;
 
   is_waiting_for_beforeunload_ack_ = false;
 
   RenderViewHostDelegate::RendererManagement* management_delegate =
       delegate_->GetRendererManagementDelegate();
   if (management_delegate) {
     management_delegate->ShouldClosePage(
         unload_ack_is_for_cross_site_transition_, proceed);
   }
 
   // If canceled, notify the delegate to cancel its pending navigation entry.
   if (!proceed)
     delegate_->DidCancelLoading();
 }
 
+void RenderViewHost::OnMsgClosePageACK() {
+  ClosePageIgnoringUnloadEvents();
+}
+
 void RenderViewHost::WindowMoveOrResizeStarted() {
   Send(new ViewMsg_MoveOrResizeStarted(routing_id()));
 }
 
 void RenderViewHost::NotifyRendererUnresponsive() {
   delegate_->RendererUnresponsive(
       this, is_waiting_for_beforeunload_ack_ || is_waiting_for_unload_ack_);
 }
 
 void RenderViewHost::NotifyRendererResponsive() {
@@ skipping 122 matching lines @@
     // If this renderer is not permitted to request this URL, we invalidate the
     // URL.  This prevents us from storing the blocked URL and becoming confused
     // later.
     VLOG(1) << "Blocked URL " << url->spec();
     *url = GURL();
   }
 }
 
 void RenderViewHost::OnAccessibilityNotifications(
     const std::vector<ViewHostMsg_AccessibilityNotification_Params>& params) {
-  if (view())
+  if (view() && !is_swapped_out_)
     view()->OnAccessibilityNotifications(params);
 
   if (!params.empty()) {
     for (unsigned i = 0; i < params.size(); i++) {
       const ViewHostMsg_AccessibilityNotification_Params& param = params[i];
 
       if (param.notification_type ==
               ViewHostMsg_AccessibilityNotification_Type::
                   NOTIFICATION_TYPE_LOAD_COMPLETE) {
         // TODO(ctguil): Remove when mac processes OnAccessibilityNotifications.
@@ skipping 96 matching lines @@
     LOG(DFATAL) << "Invalid checked state " << checked_state;
     return;
   }
 
   CommandState state;
   state.is_enabled = is_enabled;
   state.checked_state =
       static_cast<RenderViewCommandCheckedState>(checked_state);
   command_states_[static_cast<RenderViewCommand>(command)] = state;
 }