Fix the commit type for out-of-process iframes.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 403 matching lines @@
 bool NavigationControllerImpl::IsInitialNavigation() const {
   return is_initial_navigation_;
 }
 
 NavigationEntryImpl* NavigationControllerImpl::GetEntryWithPageID(
   SiteInstance* instance, int32 page_id) const {
   int index = GetEntryIndexWithPageID(instance, page_id);
   return (index != -1) ? entries_[index].get() : NULL;
 }
 
+bool NavigationControllerImpl::HasCommittedRealLoad(
+    FrameTreeNode* frame_tree_node) const {
+  NavigationEntryImpl* last_committed = GetLastCommittedEntry();
+  return last_committed && last_committed->HasFrameEntry(frame_tree_node);
+}
+
 void NavigationControllerImpl::LoadEntry(NavigationEntryImpl* entry) {
   // When navigating to a new page, we don't know for sure if we will actually
   // end up leaving the current page.  The new page load could for example
   // result in a download or a 'no content' response (e.g., a mailto: URL).
   SetPendingEntry(entry);
   NavigateToPendingEntry(NO_RELOAD);
 }
 
 void NavigationControllerImpl::SetPendingEntry(NavigationEntryImpl* entry) {
   DiscardNonCommittedEntriesInternal();
@@ skipping 392 matching lines @@
   NavigationType new_type = ClassifyNavigationWithoutPageID(rfh, params);
   bool ignore_mismatch = false;
   // There are disagreements on some Android bots over SAME_PAGE between the two
   // classifiers so ignore disagreements if that's the case.
   ignore_mismatch |= details->type == NAVIGATION_TYPE_EXISTING_PAGE &&
                      new_type == NAVIGATION_TYPE_SAME_PAGE;
   ignore_mismatch |= details->type == NAVIGATION_TYPE_SAME_PAGE &&
                      new_type == NAVIGATION_TYPE_EXISTING_PAGE;
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
         switches::kSitePerProcess)) {
-    // In site-per-process mode, the new classifier sometimes correctly
-    // classifies things as auto-subframe where the old classifier incorrectly
-    // ignored them or called them NEW_SUBFRAME.
-    ignore_mismatch |= details->type == NAVIGATION_TYPE_NAV_IGNORE &&
-                       new_type == NAVIGATION_TYPE_AUTO_SUBFRAME;
-    ignore_mismatch |= details->type == NAVIGATION_TYPE_NEW_SUBFRAME &&
-                       new_type == NAVIGATION_TYPE_AUTO_SUBFRAME;
+    // We know that the old classifier is wrong for OOPIFs, so use the new one
+    // in --site-per-process mode.
+    details->type = new_type;
+    ignore_mismatch = true;
   }
   if (!ignore_mismatch) {
     DCHECK_EQ(details->type, new_type);
   }
 #endif  // DCHECK_IS_ON()
 
   // is_in_page must be computed before the entry gets committed.
   details->is_in_page = AreURLsInPageNavigation(rfh->GetLastCommittedURL(),
       params.url, params.was_within_same_page, rfh);
 
@@ skipping 83 matching lines @@
   details->serialized_security_info = params.security_info;
   details->http_status_code = params.http_status_code;
   NotifyNavigationEntryCommitted(details);
 
   return true;
 }
 
 NavigationType NavigationControllerImpl::ClassifyNavigation(
     RenderFrameHostImpl* rfh,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) const {
-  // Hack; remove once http://crbug.com/464014 is fixed.
-  if (rfh->IsCrossProcessSubframe())
-    return NAVIGATION_TYPE_NEW_SUBFRAME;
-
   if (params.page_id == -1) {
     // The renderer generates the page IDs, and so if it gives us the invalid
     // page ID (-1) we know it didn't actually navigate. This happens in a few
     // cases:
     //
     // - If a page makes a popup navigated to about blank, and then writes
     //   stuff like a subframe navigated to a real page. We'll get the commit
     //   for the subframe, but there won't be any commit for the outer page.
     //
     // - We were also getting these for failed loads (for example, bug 21849).
@@ skipping 129 matching lines @@
   }
 
   // Since we weeded out "new" navigations above, we know this is an existing
   // (back/forward) navigation.
   return NAVIGATION_TYPE_EXISTING_PAGE;
 }
 
 NavigationType NavigationControllerImpl::ClassifyNavigationWithoutPageID(
     RenderFrameHostImpl* rfh,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) const {
-  // Hack; remove once http://crbug.com/464014 is fixed.
-  if (rfh->IsCrossProcessSubframe())
-    return NAVIGATION_TYPE_NEW_SUBFRAME;
-
   if (params.did_create_new_entry) {
     // A new entry. We may or may not have a pending entry for the page, and
     // this may or may not be the main frame.
     if (ui::PageTransitionIsMainFrame(params.transition)) {
       // TODO(avi): I want to use |if (!rfh->GetParent())| here but lots of unit
       // tests fake auto subframe commits by sending the main frame a
       // PAGE_TRANSITION_AUTO_SUBFRAME transition. Fix those, and adjust here.
       return NAVIGATION_TYPE_NEW_PAGE;
     }
 
@@ skipping 330 matching lines @@
     RenderFrameHostImpl* rfh,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
   DCHECK(ui::PageTransitionCoreTypeIs(params.transition,
                                       ui::PAGE_TRANSITION_AUTO_SUBFRAME));
 
   // We're guaranteed to have a previously committed entry, and we now need to
   // handle navigation inside of a subframe in it without creating a new entry.
   DCHECK(GetLastCommittedEntry());
 
   if (params.nav_entry_id) {
-    // If the |nav_entry_id| is non-zero, this is a browser-initiated navigation
-    // and is thus a "history auto" navigation. TODO(creis): Implement
-    // back/forward this way for site-per-process.
+    int entry_index = GetEntryIndexWithUniqueID(params.nav_entry_id);
 
-    int entry_index = GetEntryIndexWithUniqueID(params.nav_entry_id);
-    if (entry_index == -1) {
-      NOTREACHED();
-      return false;
-    }
-
-    // Update the current navigation entry in case we're going back/forward.
-    if (entry_index != last_committed_entry_index_) {
+    // If the |nav_entry_id| is non-zero and matches an existing entry, this is
+    // a history auto" navigation.  Update the last committed index accordingly.
+    // If we don't recognize the |nav_entry_id|, it might be either a pending
+    // entry for a transfer or a recently pruned entry.  We'll handle it below.
+    if (entry_index != -1 && entry_index != last_committed_entry_index_) {
       // Make sure that a subframe commit isn't changing the main frame's
       // origin. Otherwise the renderer process may be confused, leading to a
       // URL spoof. We can't check the path since that may change
       // (https://crbug.com/373041).
       if (GetLastCommittedEntry()->GetURL().GetOrigin() !=
           GetEntryAtIndex(entry_index)->GetURL().GetOrigin()) {
         // TODO(creis): This is unexpectedly being encountered in practice.  If
         // you encounter this in practice, please post details to
         // https://crbug.com/486916.  Once that's resolved, we'll change this to
         // kill the renderer process with bad_message::NC_AUTO_SUBFRAME.
         NOTREACHED() << "Unexpected main frame origin change on AUTO_SUBFRAME.";
       }
+
+      // TODO(creis): Update the FrameNavigationEntry in --site-per-process.
       last_committed_entry_index_ = entry_index;
       DiscardNonCommittedEntriesInternal();
       return true;
     }
   }
 
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSitePerProcess)) {
     // This may be a "new auto" case where we add a new FrameNavigationEntry, or
     // it may be a "history auto" case where we update an existing one.
     NavigationEntryImpl* last_committed = GetLastCommittedEntry();
     last_committed->AddOrUpdateFrameEntry(rfh->frame_tree_node(),
                                           rfh->GetSiteInstance(), params.url,
                                           params.referrer);
+
+    // Cross-process subframe navigations may leave a pending entry around.
+    // TODO(creis): Don't use pending entries for subframe navigations.
+    DiscardNonCommittedEntriesInternal();
   }
 
   // We do not need to discard the pending entry in this case, since we will
   // not generate commit notifications for this auto-subframe navigation.
   return false;
 }
 
 int NavigationControllerImpl::GetIndexOfEntry(
     const NavigationEntryImpl* entry) const {
   const NavigationEntries::const_iterator i(std::find(
@@ skipping 528 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content