Fix a bug where redirect chain gets lost on process swap.

content/browser/renderer_host/resource_dispatcher_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/browser/renderer_host/resource_dispatcher_host.h"
 
 #include <set>
 #include <vector>
@@ skipping 434 matching lines @@
 // If sync_result is non-null, then a SyncLoad reply will be generated, else
 // a normal asynchronous set of response messages will be generated.
 void ResourceDispatcherHost::OnSyncLoad(
     int request_id,
     const ResourceHostMsg_Request& request_data,
     IPC::Message* sync_result) {
   BeginRequest(request_id, request_data, sync_result,
                sync_result->routing_id());
 }
 
+// TODO(mpcomplete): hack
+static GURL g_deferred_url;
+static int g_deferred_child_id;
+static int g_deferred_request_id;
+
 void ResourceDispatcherHost::BeginRequest(
     int request_id,
     const ResourceHostMsg_Request& request_data,
     IPC::Message* sync_result,  // only valid for sync
     int route_id) {
   ChildProcessInfo::ProcessType process_type = filter_->process_type();
   int child_id = filter_->child_id();
 
   // If we crash here, figure out what URL the renderer was requesting.
   // http://crbug.com/91398
   char url_buf[128];
   base::strlcpy(url_buf, request_data.url.spec().c_str(), arraysize(url_buf));
   base::debug::Alias(url_buf);
 
+  // TODO(mpcomplete): Step 3. (See steps 1-2 below).
+  // If the request that's coming in is a cross-process transferring, then we
+  // want to reuse and resume the old request rather than start a new one.
+  // I'm not entirely sure how much of the BeginRequest code should run. We
+  // definitely want to create new ResourceHandlers and ExtraInfo, since those
+  // are tied to the process.
+  // Also, I'm not clear what should happen if any of the early returns are hit
+  // before we actually resume the request via FollowDeferredRedirect. I think
+  // we're then left with an orphaned request that will never be deleted. We
+  // probably want to cancel it in those cases.
+  // It's probably best to split apart BeginRequest into 2 methods, 1 for
+  // regular requests and one for transferred ones - probably with some shared
+  // code, but not all.
+  net::URLRequest* deferred_request = NULL;
+  if (!g_deferred_url.is_empty() && request_data.url == g_deferred_url) {
+    g_deferred_url = GURL();
+    GlobalRequestID old_id(g_deferred_child_id, g_deferred_request_id);
+    PendingRequestList::iterator i = pending_requests_.find(old_id);
+    DCHECK(i != pending_requests_.end());
+    deferred_request = i->second;
+    ResourceDispatcherHostRequestInfo* info = InfoForRequest(deferred_request);
+
+    pending_requests_.erase(old_id);
+  }
+
   const content::ResourceContext& resource_context =
       filter_->resource_context();
 
   // Might need to resolve the blob references in the upload data.
   if (request_data.upload_data) {
     resource_context.blob_storage_context()->controller()->
         ResolveBlobReferencesInUploadData(request_data.upload_data.get());
   }
 
   if (is_shutdown_ ||
@@ skipping 31 matching lines @@
     handler = new RedirectToFileResourceHandler(handler, child_id, this);
 
   if (HandleExternalProtocol(request_id, child_id, route_id,
                              request_data.url, request_data.resource_type,
                              *resource_context.request_context()->job_factory(),
                              handler)) {
     return;
   }
 
   // Construct the request.
-  net::URLRequest* request = new net::URLRequest(request_data.url, this);
-  request->set_method(request_data.method);
-  request->set_first_party_for_cookies(request_data.first_party_for_cookies);
-  request->set_referrer(referrer.spec());
-  net::HttpRequestHeaders headers;
-  headers.AddHeadersFromString(request_data.headers);
-  request->SetExtraRequestHeaders(headers);
+  net::URLRequest* request;
+  if (deferred_request) {
+    request = deferred_request;
+  } else {
+    request = new net::URLRequest(request_data.url, this);
+    request->set_method(request_data.method);
+    request->set_first_party_for_cookies(request_data.first_party_for_cookies);
+    request->set_referrer(referrer.spec());
+    net::HttpRequestHeaders headers;
+    headers.AddHeadersFromString(request_data.headers);
+    request->SetExtraRequestHeaders(headers);
 
-  int load_flags = request_data.load_flags;
-  // Although EV status is irrelevant to sub-frames and sub-resources, we have
-  // to perform EV certificate verification on all resources because an HTTP
-  // keep-alive connection created to load a sub-frame or a sub-resource could
-  // be reused to load a main frame.
-  load_flags |= net::LOAD_VERIFY_EV_CERT;
-  if (request_data.resource_type == ResourceType::MAIN_FRAME) {
-    load_flags |= net::LOAD_MAIN_FRAME;
-  } else if (request_data.resource_type == ResourceType::SUB_FRAME) {
-    load_flags |= net::LOAD_SUB_FRAME;
-  } else if (request_data.resource_type == ResourceType::PREFETCH) {
-    load_flags |= (net::LOAD_PREFETCH | net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
-  } else if (request_data.resource_type == ResourceType::FAVICON) {
-    load_flags |= net::LOAD_DO_NOT_PROMPT_FOR_LOGIN;
+    int load_flags = request_data.load_flags;
+    // Although EV status is irrelevant to sub-frames and sub-resources, we have
+    // to perform EV certificate verification on all resources because an HTTP
+    // keep-alive connection created to load a sub-frame or a sub-resource could
+    // be reused to load a main frame.
+    load_flags |= net::LOAD_VERIFY_EV_CERT;
+    if (request_data.resource_type == ResourceType::MAIN_FRAME) {
+      load_flags |= net::LOAD_MAIN_FRAME;
+    } else if (request_data.resource_type == ResourceType::SUB_FRAME) {
+      load_flags |= net::LOAD_SUB_FRAME;
+    } else if (request_data.resource_type == ResourceType::PREFETCH) {
+      load_flags |= (net::LOAD_PREFETCH | net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
+    } else if (request_data.resource_type == ResourceType::FAVICON) {
+      load_flags |= net::LOAD_DO_NOT_PROMPT_FOR_LOGIN;
+    }
+
+    if (sync_result)
+      load_flags |= net::LOAD_IGNORE_LIMITS;
+
+    // Raw headers are sensitive, as they inclide Cookie/Set-Cookie, so only
+    // allow requesting them if requestor has ReadRawCookies permission.
+    if ((load_flags & net::LOAD_REPORT_RAW_HEADERS)
+        && !ChildProcessSecurityPolicy::GetInstance()->
+                CanReadRawCookies(child_id)) {
+      VLOG(1) << "Denied unathorized request for raw headers";
+      load_flags &= ~net::LOAD_REPORT_RAW_HEADERS;
+    }
+
+    request->set_load_flags(load_flags);
   }
 
-  if (sync_result)
-    load_flags |= net::LOAD_IGNORE_LIMITS;
-
-  // Raw headers are sensitive, as they inclide Cookie/Set-Cookie, so only
-  // allow requesting them if requestor has ReadRawCookies permission.
-  if ((load_flags & net::LOAD_REPORT_RAW_HEADERS)
-      && !ChildProcessSecurityPolicy::GetInstance()->
-              CanReadRawCookies(child_id)) {
-    VLOG(1) << "Denied unathorized request for raw headers";
-    load_flags &= ~net::LOAD_REPORT_RAW_HEADERS;
-  }
-
-  request->set_load_flags(load_flags);
   request->set_context(
       filter_->GetURLRequestContext(request_data.resource_type));
   request->set_priority(DetermineRequestPriority(request_data.resource_type));
 
   // Set upload data.
   uint64 upload_size = 0;
   if (request_data.upload_data) {
     request->set_upload(request_data.upload_data);
     upload_size = request_data.upload_data->GetContentLength();
   }
@@ skipping 52 matching lines @@
         resource_context.blob_storage_context()->controller();
     extra_info->set_requested_blob_data(
         controller->GetBlobDataFromUrl(request->url()));
   }
 
   // Have the appcache associate its extra info with the request.
   appcache::AppCacheInterceptor::SetExtraRequestInfo(
       request, resource_context.appcache_service(), child_id,
       request_data.appcache_host_id, request_data.resource_type);
 
-  BeginRequestInternal(request);
+  if (deferred_request) {
+    GlobalRequestID global_id(extra_info->child_id(), extra_info->request_id());
+    pending_requests_[global_id] = request;
+    request->FollowDeferredRedirect();
+  } else {
+    BeginRequestInternal(request);
+  }
 }
 
 void ResourceDispatcherHost::OnReleaseDownloadedFile(int request_id) {
   DCHECK(pending_requests_.end() ==
          pending_requests_.find(
              GlobalRequestID(filter_->child_id(), request_id)));
   UnregisterDownloadedTempFile(filter_->child_id(), request_id);
 }
 
 void ResourceDispatcherHost::OnDataReceivedACK(int request_id) {
@@ skipping 538 matching lines @@
     NOTREACHED() << "Trying to remove a request that's not here";
     return;
   }
   RemovePendingRequest(i);
 }
 
 void ResourceDispatcherHost::RemovePendingRequest(
     const PendingRequestList::iterator& iter) {
   ResourceDispatcherHostRequestInfo* info = InfoForRequest(iter->second);
 
+  // This is called via CancelRequestsForRoute to remove all requests for a
+  // closing tab. We don't want to remove requests that are being transferred
+  // to a new tab.
+  if (info->child_id() == g_deferred_child_id &&
+      info->request_id() == g_deferred_request_id)
+    return;
+
   // Remove the memory credit that we added when pushing the request onto
   // the pending list.
   IncrementOutstandingRequestsMemoryCost(-1 * info->memory_cost(),
                                          info->child_id());
 
   // Notify interested parties that the request object is going away.
   if (info->login_delegate())
     info->login_delegate()->OnRequestCancelled();
   if (info->ssl_client_auth_handler())
     info->ssl_client_auth_handler()->OnRequestCancelled();
   resource_queue_.RemoveRequest(iter->first);
 
   delete iter->second;
   pending_requests_.erase(iter);
 
   // If we have no more pending requests, then stop the load state monitor
   if (pending_requests_.empty())
     update_load_states_timer_.Stop();
 }
 
+// TODO(mpcomplete): ILLEGAL! remove this
+#include "chrome/browser/profiles/profile_io_data.h"
+#include "chrome/browser/extensions/extension_info_map.h"
 // net::URLRequest::Delegate ---------------------------------------------------
 
+
 void ResourceDispatcherHost::OnReceivedRedirect(net::URLRequest* request,
                                                 const GURL& new_url,
                                                 bool* defer_redirect) {
   VLOG(1) << "OnReceivedRedirect: " << request->url().spec();
   ResourceDispatcherHostRequestInfo* info = InfoForRequest(request);
 
   DCHECK(request->status().is_success());
 
   if (info->process_type() != ChildProcessInfo::PLUGIN_PROCESS &&
       !ChildProcessSecurityPolicy::GetInstance()->
@@ skipping 11 matching lines @@
   if (HandleExternalProtocol(info->request_id(), info->child_id(),
                              info->route_id(), new_url,
                              info->resource_type(),
                              *request->context()->job_factory(),
                              info->resource_handler())) {
     // The request is complete so we can remove it.
     RemovePendingRequest(info->child_id(), info->request_id());
     return;
   }
 
+  // If we're redirecting into an extension process, we want to switch
+  // processes. We do this by cancelling the redirect and reissuing the request,
+  // so that the navigation controller properly assigns the right process to
+  // host the new URL.
+  const content::ResourceContext& resource_context = *info->context();
+  ProfileIOData* io_data =
+      reinterpret_cast<ProfileIOData*>(resource_context.GetUserData(NULL));
+
+  // TODO(mpcomplete): Step 1.
+  // This code should move into a resource handler instead. See the call to
+  // delegate_->RequestBeginning below - the resource handler should live in
+  // chrome/ so that it can reference extensions.
+  if (io_data->GetExtensionInfoMap()->extensions().GetByURL(new_url) !=
+      io_data->GetExtensionInfoMap()->extensions().GetByURL(request->url())) {
+    int render_process_id, render_view_id;
+    if (RenderViewForRequest(request, &render_process_id, &render_view_id)) {
+      // TODO(mpcomplete): Step 2.
+      // This is uber hacky to short-circuit all the plumbing gunk we need to
+      // do. We'll have to thread the child_id/request_id pair through the
+      // navigation calls from browser to renderer and back again:
+      // 1. new RVHD method that TabContents implements, like TransferNavigation
+      // that issues a new navigation in a new renderer but tells it the ID
+      // pair. Use NavigationController::LoadURL to load the request.
+      // 2. thread the ID pair through
+      //   [browser] NavigationEntry,
+      //   [browser->renderer] ViewMsg_Navigate,
+      //   [renderer] NavigationState -> RequestExtraData,
+      //   [renderer->browser] ResourceHostMsg_RequestResource
+      // 3. In ResourceDispatcherHost::BeginRequest (which handles the message
+      // above), check if it is a transferred navigation. If so, proceed as I do
+      // below when g_deferred_url is non-empty.
+
+      g_deferred_url = new_url;
+      g_deferred_child_id = render_process_id;
+      g_deferred_request_id = info->request_id();
+      CallRenderViewHostDelegate(
+          render_process_id, render_view_id,
+          &RenderViewHostDelegate::RequestOpenURL,
+          new_url, GURL(request->referrer()), CURRENT_TAB, info->frame_id_);
+      *defer_redirect = true;
+      return;
+    }
+  }
+
   scoped_refptr<ResourceResponse> response(new ResourceResponse);
   PopulateResourceResponse(request, response);
   if (!info->resource_handler()->OnRequestRedirected(info->request_id(),
                                                      new_url,
                                                      response, defer_redirect))
     CancelRequestInternal(request, false);
 }
 
 void ResourceDispatcherHost::OnAuthRequired(
     net::URLRequest* request,
@@ skipping 159 matching lines @@
 
   NotifyResponseStarted(request, info->child_id());
   info->set_called_on_response_started(true);
   return info->resource_handler()->OnResponseStarted(info->request_id(),
                                                      response.get());
 }
 
 void ResourceDispatcherHost::CancelRequest(int child_id,
                                            int request_id,
                                            bool from_renderer) {
+  if (from_renderer &&
+      child_id == g_deferred_child_id &&
+      request_id == g_deferred_request_id) {
+    // When the old renderer dies, it sends a message to us to cancel its
+    // requests.
+    return;
+  }
+
   PendingRequestList::iterator i = pending_requests_.find(
       GlobalRequestID(child_id, request_id));
   if (i == pending_requests_.end()) {
     // We probably want to remove this warning eventually, but I wanted to be
     // able to notice when this happens during initial development since it
     // should be rare and may indicate a bug.
     DLOG(WARNING) << "Canceling a request that wasn't found";
     return;
   }
   net::URLRequest* request = i->second;
@@ skipping 43 matching lines @@
   OutstandingRequestsMemoryCostMap::iterator prev_entry =
       outstanding_requests_memory_cost_map_.find(child_id);
   int new_cost = 0;
   if (prev_entry != outstanding_requests_memory_cost_map_.end())
     new_cost = prev_entry->second;
 
   // Insert/update the total; delete entries when their value reaches 0.
   new_cost += cost;
   CHECK(new_cost >= 0);
   if (new_cost == 0)
-    outstanding_requests_memory_cost_map_.erase(prev_entry);
+    outstanding_requests_memory_cost_map_.erase(child_id);
   else
     outstanding_requests_memory_cost_map_[child_id] = new_cost;
 
   return new_cost;
 }
 
 // static
 int ResourceDispatcherHost::CalculateApproximateMemoryCost(
     net::URLRequest* request) {
   // The following fields should be a minor size contribution (experimentally
@@ skipping 668 matching lines @@
   return HTTP_AUTH_RESOURCE_BLOCKED_CROSS;
 }
 
 bool ResourceDispatcherHost::allow_cross_origin_auth_prompt() {
   return allow_cross_origin_auth_prompt_;
 }
 
 void ResourceDispatcherHost::set_allow_cross_origin_auth_prompt(bool value) {
   allow_cross_origin_auth_prompt_ = value;
 }