Fix a bug where redirect chain gets lost on process swap.

content/browser/renderer_host/resource_dispatcher_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/browser/renderer_host/resource_dispatcher_host.h"
 
 #include <set>
 #include <vector>
@@ skipping 294 matching lines @@
       allow_cross_origin_auth_prompt_(false) {
   resource_queue_.Initialize(resource_queue_delegates);
 
   ANNOTATE_BENIGN_RACE(
       &last_user_gesture_time_,
       "We don't care about the precise value, see http://crbug.com/92889");
 }
 
 ResourceDispatcherHost::~ResourceDispatcherHost() {
   AsyncResourceHandler::GlobalCleanup();
+  for (PendingRequestList::const_iterator i = pending_requests_.begin();
+       i != pending_requests_.end(); ++i) {
+    transferred_navigations_.erase(i->first);
+  }
   STLDeleteValues(&pending_requests_);
+  DCHECK(transferred_navigations_.empty());
 }
 
 void ResourceDispatcherHost::Initialize() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       base::Bind(&appcache::AppCacheInterceptor::EnsureRegistered));
 }
 
 void ResourceDispatcherHost::Shutdown() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   BrowserThread::PostTask(BrowserThread::IO,
                           FROM_HERE,
                           base::Bind(&ResourceDispatcherHost::OnShutdown,
                                      base::Unretained(this)));
 }
 
 void ResourceDispatcherHost::SetRequestInfo(
     net::URLRequest* request,
     ResourceDispatcherHostRequestInfo* info) {
   request->SetUserData(NULL, info);
 }
 
 void ResourceDispatcherHost::OnShutdown() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   is_shutdown_ = true;
   resource_queue_.Shutdown();
+  for (PendingRequestList::const_iterator i = pending_requests_.begin();
+       i != pending_requests_.end(); ++i) {
+    transferred_navigations_.erase(i->first);
+  }
   STLDeleteValues(&pending_requests_);
   // Make sure we shutdown the timer now, otherwise by the time our destructor
   // runs if the timer is still running the Task is deleted twice (once by
   // the MessageLoop and the second time by RepeatingTimer).
   update_load_states_timer_.Stop();
 
   // Clear blocked requests if any left.
   // Note that we have to do this in 2 passes as we cannot call
   // CancelBlockedRequestsForRoute while iterating over
   // blocked_requests_map_, as it modifies it.
@@ skipping 97 matching lines @@
     int route_id) {
   content::ProcessType process_type = filter_->process_type();
   int child_id = filter_->child_id();
 
   // If we crash here, figure out what URL the renderer was requesting.
   // http://crbug.com/91398
   char url_buf[128];
   base::strlcpy(url_buf, request_data.url.spec().c_str(), arraysize(url_buf));
   base::debug::Alias(url_buf);
 
+  // If the request that's coming in is being transferred from another process,
+  // we want to reuse and resume the old request rather than start a new one.
+  net::URLRequest* deferred_request = NULL;
+
+  GlobalRequestID old_request_id(request_data.transferred_request_child_id,
+                                 request_data.transferred_request_request_id);
+  TransferredNavigations::iterator iter =
+      transferred_navigations_.find(old_request_id);
+  if (iter != transferred_navigations_.end()) {
+    deferred_request = iter->second;
+    pending_requests_.erase(old_request_id);
+    transferred_navigations_.erase(iter);
+  }
+
   const content::ResourceContext& resource_context =
       filter_->resource_context();
 
   // Might need to resolve the blob references in the upload data.
   if (request_data.upload_data) {
     resource_context.blob_storage_context()->controller()->
         ResolveBlobReferencesInUploadData(request_data.upload_data.get());
   }
 
   if (is_shutdown_ ||
@@ skipping 31 matching lines @@
     handler = new RedirectToFileResourceHandler(handler, child_id, this);
 
   if (HandleExternalProtocol(request_id, child_id, route_id,
                              request_data.url, request_data.resource_type,
                              *resource_context.request_context()->job_factory(),
                              handler)) {
     return;
   }
 
   // Construct the request.
-  net::URLRequest* request = new net::URLRequest(request_data.url, this);
-  request->set_method(request_data.method);
-  request->set_first_party_for_cookies(request_data.first_party_for_cookies);
-  request->set_referrer(referrer.spec());
-  net::HttpRequestHeaders headers;
-  headers.AddHeadersFromString(request_data.headers);
-  request->SetExtraRequestHeaders(headers);
+  net::URLRequest* request;
+  if (deferred_request) {
+    request = deferred_request;
+  } else {
+    request = new net::URLRequest(request_data.url, this);
+    request->set_method(request_data.method);
+    request->set_first_party_for_cookies(request_data.first_party_for_cookies);
+    request->set_referrer(referrer.spec());
+    net::HttpRequestHeaders headers;
+    headers.AddHeadersFromString(request_data.headers);
+    request->SetExtraRequestHeaders(headers);
+  }
 
   int load_flags = request_data.load_flags;
   // Although EV status is irrelevant to sub-frames and sub-resources, we have
   // to perform EV certificate verification on all resources because an HTTP
   // keep-alive connection created to load a sub-frame or a sub-resource could
   // be reused to load a main frame.
   load_flags |= net::LOAD_VERIFY_EV_CERT;
   if (request_data.resource_type == ResourceType::MAIN_FRAME) {
     load_flags |= net::LOAD_MAIN_FRAME;
   } else if (request_data.resource_type == ResourceType::SUB_FRAME) {
     load_flags |= net::LOAD_SUB_FRAME;
   } else if (request_data.resource_type == ResourceType::PREFETCH) {
     load_flags |= (net::LOAD_PREFETCH | net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
   } else if (request_data.resource_type == ResourceType::FAVICON) {
     load_flags |= net::LOAD_DO_NOT_PROMPT_FOR_LOGIN;
   }
 
   if (sync_result)
     load_flags |= net::LOAD_IGNORE_LIMITS;
 
   ChildProcessSecurityPolicy* policy =
       ChildProcessSecurityPolicy::GetInstance();
   if (!policy->CanUseCookiesForOrigin(child_id, request_data.url)) {
     load_flags |= (net::LOAD_DO_NOT_SEND_COOKIES |
                    net::LOAD_DO_NOT_SEND_AUTH_DATA |
                    net::LOAD_DO_NOT_SAVE_COOKIES);
   }
 
-  // Raw headers are sensitive, as they inclide Cookie/Set-Cookie, so only
-  // allow requesting them if requestor has ReadRawCookies permission.
+  // Raw headers are sensitive, as they include Cookie/Set-Cookie, so only
+  // allow requesting them if requester has ReadRawCookies permission.
   if ((load_flags & net::LOAD_REPORT_RAW_HEADERS)
       && !policy->CanReadRawCookies(child_id)) {
-    VLOG(1) << "Denied unathorized request for raw headers";
+    VLOG(1) << "Denied unauthorized request for raw headers";
     load_flags &= ~net::LOAD_REPORT_RAW_HEADERS;
   }
 
   request->set_load_flags(load_flags);
+
   request->set_context(
       filter_->GetURLRequestContext(request_data.resource_type));
   request->set_priority(DetermineRequestPriority(request_data.resource_type));
 
   // Set upload data.
   uint64 upload_size = 0;
   if (request_data.upload_data) {
     request->set_upload(request_data.upload_data);
     upload_size = request_data.upload_data->GetContentLength();
   }
@@ skipping 12 matching lines @@
                                            child_id,
                                            route_id,
                                            this);
   }
 
   // Insert a buffered event handler before the actual one.
   handler = new BufferedResourceHandler(handler, this, request);
 
   if (delegate_) {
     bool sub = request_data.resource_type != ResourceType::MAIN_FRAME;
-    handler = delegate_->RequestBeginning(handler, request, resource_context,
-                                          sub, child_id, route_id);
+    bool is_continuation_of_transferred_request =
+        (deferred_request != NULL);
+    handler = delegate_->RequestBeginning(
+        handler, request, resource_context, sub, child_id, route_id,
+        is_continuation_of_transferred_request);
   }
 
   // Make extra info and read footer (contains request ID).
   ResourceDispatcherHostRequestInfo* extra_info =
       new ResourceDispatcherHostRequestInfo(
           handler,
           process_type,
           child_id,
           route_id,
           request_data.origin_pid,
@@ skipping 18 matching lines @@
         resource_context.blob_storage_context()->controller();
     extra_info->set_requested_blob_data(
         controller->GetBlobDataFromUrl(request->url()));
   }
 
   // Have the appcache associate its extra info with the request.
   appcache::AppCacheInterceptor::SetExtraRequestInfo(
       request, resource_context.appcache_service(), child_id,
       request_data.appcache_host_id, request_data.resource_type);
 
-  BeginRequestInternal(request);
+  if (deferred_request) {
+    // This is a request that has been transferred from another process, so
+    // resume it rather than continuing the regular procedure for starting a
+    // request. Currently this is only done for redirects.
+    GlobalRequestID global_id(extra_info->child_id(), extra_info->request_id());
+    pending_requests_[global_id] = request;
+    request->FollowDeferredRedirect();
+  } else {
+    BeginRequestInternal(request);
+  }
 }
 
 void ResourceDispatcherHost::OnReleaseDownloadedFile(int request_id) {
   DCHECK(pending_requests_.end() ==
          pending_requests_.find(
              GlobalRequestID(filter_->child_id(), request_id)));
   UnregisterDownloadedTempFile(filter_->child_id(), request_id);
 }
 
 void ResourceDispatcherHost::OnDataReceivedACK(int request_id) {
@@ skipping 394 matching lines @@
   // matching requests to be cancelled, and then we cancel them.  Since there
   // may be more than one request to cancel, we cannot simply hold onto the map
   // iterators found in the first loop.
 
   // Find the global ID of all matching elements.
   std::vector<GlobalRequestID> matching_requests;
   for (PendingRequestList::const_iterator i = pending_requests_.begin();
        i != pending_requests_.end(); ++i) {
     if (i->first.child_id == child_id) {
       ResourceDispatcherHostRequestInfo* info = InfoForRequest(i->second);
+      GlobalRequestID id(child_id, i->first.request_id);
+      DCHECK(id == i->first);
+      // Don't cancel navigations that are transferring to another process,
+      // since they belong to another process now.
       if (!info->is_download() &&
+          (transferred_navigations_.find(id) ==
+               transferred_navigations_.end()) &&
           (route_id == -1 || route_id == info->route_id())) {
         matching_requests.push_back(
             GlobalRequestID(child_id, i->first.request_id));
       }
     }
   }
 
   // Remove matches.
   for (size_t i = 0; i < matching_requests.size(); ++i) {
     PendingRequestList::iterator iter =
@@ skipping 358 matching lines @@
 
   NotifyResponseStarted(request, info->child_id());
   info->set_called_on_response_started(true);
   return info->resource_handler()->OnResponseStarted(info->request_id(),
                                                      response.get());
 }
 
 void ResourceDispatcherHost::CancelRequest(int child_id,
                                            int request_id,
                                            bool from_renderer) {
-  PendingRequestList::iterator i = pending_requests_.find(
-      GlobalRequestID(child_id, request_id));
+  GlobalRequestID id(child_id, request_id);
+  if (from_renderer) {
+    // When the old renderer dies, it sends a message to us to cancel its
+    // requests.
+    if (transferred_navigations_.find(id) != transferred_navigations_.end())
+      return;
+  }
+
+  PendingRequestList::iterator i = pending_requests_.find(id);
   if (i == pending_requests_.end()) {
     // We probably want to remove this warning eventually, but I wanted to be
     // able to notice when this happens during initial development since it
     // should be rare and may indicate a bug.
     DLOG(WARNING) << "Canceling a request that wasn't found";
     return;
   }
   net::URLRequest* request = i->second;
   const bool started_before_cancel = request->is_pending();
 
@@ skipping 41 matching lines @@
   OutstandingRequestsMemoryCostMap::iterator prev_entry =
       outstanding_requests_memory_cost_map_.find(child_id);
   int new_cost = 0;
   if (prev_entry != outstanding_requests_memory_cost_map_.end())
     new_cost = prev_entry->second;
 
   // Insert/update the total; delete entries when their value reaches 0.
   new_cost += cost;
   CHECK(new_cost >= 0);
   if (new_cost == 0)
-    outstanding_requests_memory_cost_map_.erase(prev_entry);
+    outstanding_requests_memory_cost_map_.erase(child_id);
   else
     outstanding_requests_memory_cost_map_[child_id] = new_cost;
 
   return new_cost;
 }
 
 // static
 int ResourceDispatcherHost::CalculateApproximateMemoryCost(
     net::URLRequest* request) {
   // The following fields should be a minor size contribution (experimentally
@@ skipping 677 matching lines @@
   return HTTP_AUTH_RESOURCE_BLOCKED_CROSS;
 }
 
 bool ResourceDispatcherHost::allow_cross_origin_auth_prompt() {
   return allow_cross_origin_auth_prompt_;
 }
 
 void ResourceDispatcherHost::set_allow_cross_origin_auth_prompt(bool value) {
   allow_cross_origin_auth_prompt_ = value;
 }
+
+void ResourceDispatcherHost::MarkAsTransferredNavigation(
+    const GlobalRequestID& transferred_request_id,
+    net::URLRequest* ransferred_request) {
+  transferred_navigations_[transferred_request_id] = ransferred_request;
+}