Support window.opener after a process swap.

content/browser/tab_contents/render_view_host_manager.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/tab_contents/render_view_host_manager.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_switches.h"
@@ skipping 31 matching lines @@
 }
 
 RenderViewHostManager::~RenderViewHostManager() {
   if (pending_render_view_host_)
     CancelPending();
 
   // We should always have a main RenderViewHost.
   RenderViewHost* render_view_host = render_view_host_;
   render_view_host_ = NULL;
   render_view_host->Shutdown();
+
+  // Shut down any swapped out RenderViewHosts.
+  for (RenderViewHostMap::iterator iter = swapped_out_hosts_.begin();
+       iter != swapped_out_hosts_.end();
+       ++iter) {
+    iter->second->Shutdown();
+  }
 }
 
 void RenderViewHostManager::Init(Profile* profile,
                                  SiteInstance* site_instance,
                                  int routing_id) {
   // Create a RenderViewHost, once we have an instance.  It is important to
   // immediately give this SiteInstance to a RenderViewHost so that it is
   // ref counted.
   if (!site_instance)
     site_instance = SiteInstance::CreateSiteInstance(profile);
@@ skipping 79 matching lines @@
   if (pending_request_id == -1) {
     // Haven't gotten around to starting the request, because we're still
     // waiting for the beforeunload handler to finish.  We'll pretend that it
     // did finish, to let the navigation proceed.  Note that there's a danger
     // that the beforeunload handler will later finish and possibly return
     // false (meaning the navigation should not proceed), but we'll ignore it
     // in this case because it took too long.
     if (pending_render_view_host_->are_navigations_suspended())
       pending_render_view_host_->SetNavigationsSuspended(false);
   } else {
-    // The request has been started and paused, while we're waiting for the
+    // The request has been started and paused while we're waiting for the
     // unload handler to finish.  We'll pretend that it did, by notifying the
     // IO thread to let the response continue.  The pending renderer will then
     // be swapped in as part of the usual DidNavigate logic.  (If the unload
     // handler later finishes, this call will be ignored because the state in
     // CrossSiteResourceHandler will already be cleaned up.)
-    ViewMsg_ClosePage_Params params;
-    params.closing_process_id =
-        render_view_host_->process()->id();
-    params.closing_route_id = render_view_host_->routing_id();
-    params.for_cross_site_transition = true;
+    ViewMsg_SwapOut_Params params;
     params.new_render_process_host_id =
         pending_render_view_host_->process()->id();
     params.new_request_id = pending_request_id;
-    current_host()->process()->CrossSiteClosePageACK(params);
+    current_host()->process()->CrossSiteSwapOutACK(params);
   }
   return false;
 }
 
 void RenderViewHostManager::DidNavigateMainFrame(
     RenderViewHost* render_view_host) {
   if (!cross_navigation_pending_) {
     DCHECK(!pending_render_view_host_);
 
     // We should only hear this from our current renderer.
     DCHECK(render_view_host == render_view_host_);
 
     // Even when there is no pending RVH, there may be a pending Web UI.
     if (pending_web_ui_.get())
       CommitPending();
     return;
   }
 
   if (render_view_host == pending_render_view_host_) {
     // The pending cross-site navigation completed, so show the renderer.
+    // If it committed without sending network requests (e.g., data URLs),
+    // then we still need to swap out the old RVH first and run its unload
+    // handler.  OK for that to happen in the background.
+    if (pending_render_view_host_->GetPendingRequestId() == -1)
+      OnCrossSiteResponse(pending_render_view_host_->process()->id(),
+                          pending_render_view_host_->routing_id());
+
     CommitPending();
     cross_navigation_pending_ = false;
   } else if (render_view_host == render_view_host_) {
     // A navigation in the original page has taken place.  Cancel the pending
     // one.
     CancelPending();
     cross_navigation_pending_ = false;
   } else {
     // No one else should be sending us DidNavigate in this state.
     DCHECK(false);
@@ skipping 12 matching lines @@
   // looks for this TabContents based on a render view ID.  Instead, we just
   // leave the pending renderer around until the next navigation event
   // (Navigate, DidNavigate, etc), which will clean it up properly.
   // TODO(creis): All of this will go away when we move the cross-site logic
   // to ResourceDispatcherHost, so that we intercept responses rather than
   // navigation events.  (That's necessary to support onunload anyway.)  Once
   // we've made that change, we won't create a pending renderer until we know
   // the response is not a download.
 }
 
+void RenderViewHostManager::RendererProcessClosing(
+    RenderProcessHost* render_process_host) {
+  // Remove any swapped out RVHs from this process, so that we don't try to
+  // swap them back in while the process is exiting.  Start by finding them,
+  // since there could be more than one.
+  std::list<int> ids_to_remove;
+  for (RenderViewHostMap::iterator iter = swapped_out_hosts_.begin();
+       iter != swapped_out_hosts_.end();
+       ++iter) {
+    if (iter->second->process() == render_process_host)
+      ids_to_remove.push_back(iter->first);
+  }
+
+  // Now delete them.
+  while (!ids_to_remove.empty()) {
+    swapped_out_hosts_[ids_to_remove.back()]->Shutdown();
+    swapped_out_hosts_.erase(ids_to_remove.back());
+    ids_to_remove.pop_back();
+  }
+}
+
 void RenderViewHostManager::ShouldClosePage(bool for_cross_site_transition,
                                             bool proceed) {
   if (for_cross_site_transition) {
     // Ignore if we're not in a cross-site navigation.
     if (!cross_navigation_pending_)
       return;
 
     if (proceed) {
       // Ok to unload the current page, so proceed with the cross-site
       // navigation.  Note that if navigations are not currently suspended, it
       // might be because the renderer was deemed unresponsive and this call was
       // already made by ShouldCloseTabOnUnresponsiveRenderer.  In that case, it
       // is ok to do nothing here.
       if (pending_render_view_host_ &&
           pending_render_view_host_->are_navigations_suspended())
         pending_render_view_host_->SetNavigationsSuspended(false);
     } else {
       // Current page says to cancel.
       CancelPending();
       cross_navigation_pending_ = false;
     }
   } else {
     // Non-cross site transition means closing the entire tab.
     bool proceed_to_fire_unload;
     delegate_->BeforeUnloadFiredFromRenderManager(proceed,
                                                   &proceed_to_fire_unload);
 
     if (proceed_to_fire_unload) {
       // This is not a cross-site navigation, the tab is being closed.
-      render_view_host_->ClosePage(false, -1, -1);
+      render_view_host_->ClosePage();
     }
   }
 }
 
 void RenderViewHostManager::OnCrossSiteResponse(int new_render_process_host_id,
                                                 int new_request_id) {
   // Should only see this while we have a pending renderer.
   if (!cross_navigation_pending_)
     return;
   DCHECK(pending_render_view_host_);
 
-  // Tell the old renderer to run its onunload handler.  When it finishes, it
-  // will send a ClosePage_ACK to the ResourceDispatcherHost with the given
-  // IDs (of the pending RVH's request), allowing the pending RVH's response to
-  // resume.
-  render_view_host_->ClosePage(true,
-                               new_render_process_host_id, new_request_id);
+  // Tell the old renderer it is being swapped out.  This will fire the unload
+  // handler (without firing the beforeunload handler a second time).  When the
+  // unload handler finishes and the navigation completes, we will send a
+  // message to the ResourceDispatcherHost with the given pending request IDs,
+  // allowing the pending RVH's response to resume.
+  render_view_host_->SwapOut(new_render_process_host_id, new_request_id);
 
   // ResourceDispatcherHost has told us to run the onunload handler, which
   // means it is not a download or unsafe page, and we are going to perform the
   // navigation.  Thus, we no longer need to remember that the RenderViewHost
   // is part of a pending cross-site request.
   pending_render_view_host_->SetHasPendingCrossSiteRequest(false,
                                                            new_request_id);
 }
 
 void RenderViewHostManager::OnCrossSiteNavigationCanceled() {
@@ skipping 177 matching lines @@
 bool RenderViewHostManager::CreatePendingRenderView(
     const NavigationEntry& entry, SiteInstance* instance) {
   NavigationEntry* curr_entry =
       delegate_->GetControllerForRenderManager().GetLastCommittedEntry();
   if (curr_entry) {
     DCHECK(!curr_entry->content_state().empty());
     // TODO(creis): Should send a message to the RenderView to let it know
     // we're about to switch away, so that it sends an UpdateState message.
   }
 
+  // Check if we've already created an RVH for this SiteInstance.
+  CHECK(instance);
+  RenderViewHostMap::iterator iter =
+      swapped_out_hosts_.find(instance->id());
+  if (iter != swapped_out_hosts_.end()) {
+    // Re-use the existing RenderViewHost, which has already been initialized.
+    // We'll remove it from the list of swapped out hosts if it commits.
+    pending_render_view_host_ = iter->second;
+
+    // Prevent the process from exiting while we're trying to use it.
+    pending_render_view_host_->process()->AddPendingView();
+
+    return true;
+  }
+
   pending_render_view_host_ = RenderViewHostFactory::Create(
       instance, render_view_delegate_, MSG_ROUTING_NONE, delegate_->
       GetControllerForRenderManager().session_storage_namespace());
 
+  // Prevent the process from exiting while we're trying to use it.
+  pending_render_view_host_->process()->AddPendingView();
+
   bool success = InitRenderView(pending_render_view_host_, entry);
   if (success) {
     // Don't show the view until we get a DidNavigate from it.
     pending_render_view_host_->view()->Hide();
   } else {
     CancelPending();
   }
   return success;
 }
 
@@ skipping 32 matching lines @@
     if (will_focus_location_bar)
       delegate_->SetFocusToLocationBar(false);
     return;
   }
 
   // Remember if the page was focused so we can focus the new renderer in
   // that case.
   bool focus_render_view = !will_focus_location_bar &&
       render_view_host_->view() && render_view_host_->view()->HasFocus();
 
-  // Hide the current view and prepare to destroy it.
-  // TODO(creis): Get the old RenderViewHost to send us an UpdateState message
-  // before we destroy it.
-  if (render_view_host_->view())
-    render_view_host_->view()->Hide();
+  // Swap in the pending view and make it active.
   RenderViewHost* old_render_view_host = render_view_host_;
-
-  // Swap in the pending view and make it active.
   render_view_host_ = pending_render_view_host_;
   pending_render_view_host_ = NULL;
 
+  // The process will no longer try to exit, so we can decrement the count.
+  render_view_host_->process()->RemovePendingView();
+
   // If the view is gone, then this RenderViewHost died while it was hidden.
   // We ignored the RenderViewGone call at the time, so we should send it now
   // to make sure the sad tab shows up, etc.
   if (render_view_host_->view())
     render_view_host_->view()->Show();
   else
     delegate_->RenderViewGoneFromRenderManager(render_view_host_);
 
+  // Hide the old view now that the new one is visible.
+  if (old_render_view_host->view()) {
+    old_render_view_host->view()->Hide();
+    old_render_view_host->WasSwappedOut();
+  }
+
   // Make sure the size is up to date.  (Fix for bug 1079768.)
   delegate_->UpdateRenderViewSizeForRenderManager();
 
   if (will_focus_location_bar)
     delegate_->SetFocusToLocationBar(false);
   else if (focus_render_view && render_view_host_->view())
     render_view_host_->view()->Focus();
 
   RenderViewHostSwitchedDetails details;
   details.new_host = render_view_host_;
   details.old_host = old_render_view_host;
   NotificationService::current()->Notify(
       NotificationType::RENDER_VIEW_HOST_CHANGED,
       Source<NavigationController>(&delegate_->GetControllerForRenderManager()),
       Details<RenderViewHostSwitchedDetails>(&details));
 
-  old_render_view_host->Shutdown();
+  // If the pending view was on the swapped out list, we can remove it.
+  swapped_out_hosts_.erase(render_view_host_->site_instance()->id());
+
+  // If the old RVH is live, we are swapping it out and should keep track of it
+  // in case we navigate back to it.
+  if (old_render_view_host->IsRenderViewLive()) {
+    DCHECK(old_render_view_host->is_swapped_out());
+    swapped_out_hosts_[old_render_view_host->site_instance()->id()] =
+        old_render_view_host;
+  } else {
+    old_render_view_host->Shutdown();
+  }
 
   // Let the task manager know that we've swapped RenderViewHosts, since it
   // might need to update its process groupings.
   delegate_->NotifySwappedFromRenderManager();
 }
 
 RenderViewHost* RenderViewHostManager::UpdateRendererStateForNavigate(
     const NavigationEntry& entry) {
   // If we are cross-navigating, then we want to get back to normal and navigate
   // as usual.
@@ skipping 90 matching lines @@
 
   // Same SiteInstance can be used.  Navigate render_view_host_ if we are not
   // cross navigating.
   DCHECK(!cross_navigation_pending_);
   return render_view_host_;
 }
 
 void RenderViewHostManager::CancelPending() {
   RenderViewHost* pending_render_view_host = pending_render_view_host_;
   pending_render_view_host_ = NULL;
-  pending_render_view_host->Shutdown();
+
+  // We no longer need to prevent the process from exiting.
+  pending_render_view_host->process()->RemovePendingView();
+
+  // The pending RVH may already be on the swapped out list if we started to
+  // swap it back in and then canceled.  If so, make sure it gets swapped out
+  // again.  If it's not on the swapped out list (e.g., aborting a pending
+  // load), then it's safe to shut down.
+  if (IsSwappedOut(pending_render_view_host)) {
+    // Any currently suspended navigations are no longer needed.
+    pending_render_view_host->CancelSuspendedNavigations();
+
+    // We can pass -1,-1 because there is no pending response in the
+    // ResourceDispatcherHost to unpause.
+    pending_render_view_host->SwapOut(-1, -1);
+  } else {
+    // We won't be coming back, so shut this one down.
+    pending_render_view_host->Shutdown();
+  }
 
   pending_web_ui_.reset();
 }
 
 void RenderViewHostManager::RenderViewDeleted(RenderViewHost* rvh) {
   // We are doing this in order to work around and to track a crasher
   // (http://crbug.com/23411) where it seems that pending_render_view_host_ is
   // deleted (not sure from where) but not NULLed.
   if (rvh == pending_render_view_host_) {
     // If you hit this NOTREACHED, please report it in the following bug
     // http://crbug.com/23411 Make sure to include what you were doing when it
     // happened  (navigating to a new page, closing a tab...) and if you can
     // reproduce.
     NOTREACHED();
     pending_render_view_host_ = NULL;
   }
+
+  // Make sure deleted RVHs are not kept in the swapped out list while we are
+  // still alive.  (If render_view_host_ is null, we're already being deleted.)
+  if (!render_view_host_)
+    return;
+  // We can't look it up by SiteInstance ID, which may no longer be valid.
+  for (RenderViewHostMap::iterator iter = swapped_out_hosts_.begin();
+       iter != swapped_out_hosts_.end();
+       ++iter) {
+    if (iter->second == rvh) {
+      swapped_out_hosts_.erase(iter);
+      break;
+    }
+  }
 }
 
 void RenderViewHostManager::SwapInRenderViewHost(RenderViewHost* rvh) {
+  // TODO(creis): Abstract out the common code between this and CommitPending.
   web_ui_.reset();
 
-  // Hide the current view and prepare to destroy it.
-  if (render_view_host_->view())
-    render_view_host_->view()->Hide();
-  RenderViewHost* old_render_view_host = render_view_host_;
+  // Make sure the current RVH is swapped out so that it filters out any
+  // disruptive messages from the renderer.  We can pass -1,-1 because there is
+  // no pending response in the ResourceDispatcherHost to unpause.
+  render_view_host_->SwapOut(-1, -1);
 
   // Swap in the new view and make it active.
+  RenderViewHost* old_render_view_host = render_view_host_;
   render_view_host_ = rvh;
   render_view_host_->set_delegate(render_view_delegate_);
   // Remove old RenderWidgetHostView with mocked out methods so it can be
   // replaced with a new one that's a child of |delegate_|'s view.
   scoped_ptr<RenderWidgetHostView> old_view(render_view_host_->view());
   render_view_host_->set_view(NULL);
   delegate_->CreateViewAndSetSizeForRVH(render_view_host_);
   render_view_host_->ActivateDeferredPluginHandles();
   // If the view is gone, then this RenderViewHost died while it was hidden.
   // We ignored the RenderViewGone call at the time, so we should send it now
   // to make sure the sad tab shows up, etc.
   if (render_view_host_->view()) {
     // The Hide() is needed to sync the state of |render_view_host_|, which is
     // hidden, with the newly created view, which does not know the
     // RenderViewHost is hidden.
     // TODO(tburkard,cbentzel): Figure out if this hack can be removed
     //                          (http://crbug.com/79891).
     render_view_host_->view()->Hide();
     render_view_host_->view()->Show();
   }
 
+  // Hide the current view and prepare to swap it out.
+  if (old_render_view_host->view()) {
+    old_render_view_host->view()->Hide();
+    old_render_view_host->WasSwappedOut();
+  }
+
   delegate_->UpdateRenderViewSizeForRenderManager();
 
   RenderViewHostSwitchedDetails details;
   details.new_host = render_view_host_;
   details.old_host = old_render_view_host;
   NotificationService::current()->Notify(
       NotificationType::RENDER_VIEW_HOST_CHANGED,
       Source<NavigationController>(&delegate_->GetControllerForRenderManager()),
       Details<RenderViewHostSwitchedDetails>(&details));
 
-  // This will cause the old RenderViewHost to delete itself.
-  old_render_view_host->Shutdown();
+  // If the given RVH was on the swapped out list, we can remove it.
+  swapped_out_hosts_.erase(render_view_host_->site_instance()->id());
+
+  // If the old RVH is live, we are swapping it out and should keep track of it
+  // in case we navigate back to it.
+  if (old_render_view_host->IsRenderViewLive()) {
+    DCHECK(old_render_view_host->is_swapped_out());
+    swapped_out_hosts_[old_render_view_host->site_instance()->id()] =
+        old_render_view_host;
+  } else {
+    old_render_view_host->Shutdown();
+  }
 
   // Let the task manager know that we've swapped RenderViewHosts, since it
   // might need to update its process groupings.
   delegate_->NotifySwappedFromRenderManager();
 }
+
+bool RenderViewHostManager::IsSwappedOut(RenderViewHost* rvh) {
+  if (!rvh->site_instance())
+    return false;
+
+  return swapped_out_hosts_.find(rvh->site_instance()->id()) !=
+      swapped_out_hosts_.end();
+}