Allow RenderFrames to swap out for subframe navigations.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 0fd1953d11f4ab361b0de24689e997e6e5107d88..5246612c1e5b61da8f8d3c0f0d0caf911768907c 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -114,6 +114,16 @@ RenderFrameImpl* RenderFrameImpl::Create(RenderViewImpl* render_view,
     return new RenderFrameImpl(render_view, routing_id);
 }
 
+RenderFrameImpl* RenderFrameImpl::FindByWebFrame(blink::WebFrame* web_frame) {
+  if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess)) {
+    FrameMap::iterator iter = g_child_frame_map.Get().find(web_frame);
+    if (iter != g_child_frame_map.Get().end())
+      return iter->second;
+  }
+
+  return NULL;
+}
+
 // static
 void RenderFrameImpl::InstallCreateHook(
     RenderFrameImpl* (*create_render_frame_impl)(RenderViewImpl*, int32)) {
@@ -123,7 +133,8 @@ void RenderFrameImpl::InstallCreateHook(
 
 // RenderFrameImpl ----------------------------------------------------------
 RenderFrameImpl::RenderFrameImpl(RenderViewImpl* render_view, int routing_id)
-    : render_view_(render_view),
+    : frame_(NULL),
+      render_view_(render_view),
       routing_id_(routing_id),
       is_swapped_out_(false),
       is_detaching_(false) {
@@ -147,6 +158,12 @@ void RenderFrameImpl::MainWebFrameCreated(blink::WebFrame* frame) {
                     WebFrameCreated(frame));
 }
 
+void RenderFrameImpl::SetWebFrame(blink::WebFrame* web_frame) {
+  DCHECK(!frame_);
+  if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess))
+    frame_ = web_frame;
+}
+
 RenderWidget* RenderFrameImpl::GetRenderWidget() {
   return render_view_;
 }
@@ -461,9 +478,52 @@ bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
       return true;
   }
 
-  // TODO(ajwong): Fill in with message handlers as various components
-  // are migrated over to understand frames.
-  return false;
+  bool handled = true;
+  bool msg_is_ok = true;
+  IPC_BEGIN_MESSAGE_MAP_EX(RenderFrameImpl, msg, msg_is_ok)
+     IPC_MESSAGE_HANDLER(FrameMsg_SwapOut, OnSwapOut)

[nasko, 2013/12/20 22:59:51]

nit: this is 3 spaces indented, should be 2. Also, no need for empty line after.

[Charlie Reis, 2013/12/21 00:26:42]

Oops!  That was a copy paste error from the other patch.  Thanks.

+
+   IPC_END_MESSAGE_MAP()
+
+   if (!msg_is_ok) {
+     // The message had a handler, but its deserialization failed.
+     // Kill the renderer to avoid potential spoofing attacks.
+     CHECK(false) << "Unable to deserialize message in RenderFrameImpl.";
+   }
+
+   return handled;
+ }
+
+void RenderFrameImpl::OnSwapOut() {
+  // Only run unload if we're not swapped out yet, but send the ack either way.
+  if (!is_swapped_out_) {
+    // Swap this RenderView out so the tab can navigate to a page rendered by a
+    // different process.  This involves running the unload handler and clearing
+    // the page.  Once WasSwappedOut is called, we also allow this process to
+    // exit if there are no other active RenderViews in it.
+
+    // Send an UpdateState message before we get swapped out.
+    render_view_->SyncNavigationState();
+
+    // Synchronously run the unload handler before sending the ACK.
+    // TODO(creis): Add a WebFrame::dispatchUnloadEvent and call it here.
+
+    // Swap out and stop sending any IPC messages that are not ACKs.
+    is_swapped_out_ = true;
+
+    // Now that we're swapped out and filtering IPC messages, stop loading to
+    // ensure that no other in-progress navigation continues.  We do this here
+    // to avoid sending a DidStopLoading message to the browser process.
+    frame_->stopLoading();

[nasko, 2013/12/20 22:59:51]

This seems to be missing the StopAltErrorPageFetcher calls that are in
RVH::OnStop. Is this intentional?

[Charlie Reis, 2013/12/21 00:26:42]

Yeah, though I'm not 100% sure it's right.  I did this to stop loading on this
particular frame (and its children) rather than from the top-level page down. 
I'm not certain what the right semantics are here, but since there's other
issues with this hack (e.g., lack of dispatchUnloadEvent), I didn't investigate.

I've added a TODO.

+
+    // Replace the page with a blank dummy URL. The unload handler will not be
+    // run a second time, thanks to a check in FrameLoader::stopLoading.
+    // TODO(creis): Need to add a better way to do this that avoids running the
+    // beforeunload handler. For now, we just run it a second time silently.
+    render_view_->NavigateToSwappedOutURL(frame_);
+  }
+
+  Send(new FrameHostMsg_SwapOut_ACK(routing_id_));
 }
 
 RenderView* RenderFrameImpl::GetRenderView() {
@@ -621,6 +681,7 @@ blink::WebFrame* RenderFrameImpl::createChildFrame(
                                                 child_frame_identifier);
 
   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess)) {
+    child_render_frame->SetWebFrame(web_frame);
     g_child_frame_map.Get().insert(
         std::make_pair(web_frame, child_render_frame));
   } else {
@@ -805,6 +866,7 @@ void RenderFrameImpl::didStartProvisionalLoad(blink::WebFrame* frame) {
 
   // We should only navigate to swappedout:// when is_swapped_out_ is true.
   CHECK((ds->request().url() != GURL(kSwappedOutURL)) ||
+        is_swapped_out_ ||
         render_view_->is_swapped_out()) <<
         "Heard swappedout:// when not swapped out.";