Move existing kSitePerProcess checks to a policy-oracle object

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 
 #include "base/auto_reset.h"
@@ skipping 32 matching lines @@
 #include "content/common/service_worker/service_worker_types.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/context_menu_params.h"
 #include "content/public/common/isolated_world_ids.h"
 #include "content/public/common/page_state.h"
 #include "content/public/common/resource_response.h"
+#include "content/public/common/site_isolation_policy.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/renderer/browser_plugin_delegate.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/renderer/context_menu_client.h"
 #include "content/public/renderer/document_state.h"
 #include "content/public/renderer/navigation_state.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "content/public/renderer/renderer_ppapi_host.h"
 #include "content/renderer/accessibility/renderer_accessibility.h"
@@ skipping 439 matching lines @@
   return media::Context3D(provider->ContextGL(), provider->GrContext());
 }
 #endif
 
 bool IsReload(FrameMsg_Navigate_Type::Value navigation_type) {
   return navigation_type == FrameMsg_Navigate_Type::RELOAD ||
          navigation_type == FrameMsg_Navigate_Type::RELOAD_IGNORING_CACHE ||
          navigation_type == FrameMsg_Navigate_Type::RELOAD_ORIGINAL_REQUEST_URL;
 }
 
-bool IsSwappedOutStateForbidden() {
-  return base::CommandLine::ForCurrentProcess()->HasSwitch(
-      switches::kSitePerProcess);
-}
-
 RenderFrameImpl::CreateRenderFrameImplFunction g_create_render_frame_impl =
     nullptr;
 
 }  // namespace
 
 // static
 RenderFrameImpl* RenderFrameImpl::Create(RenderViewImpl* render_view,
                                          int32 routing_id) {
   DCHECK(routing_id != MSG_ROUTING_NONE);
   CreateParams params(render_view, routing_id);
@@ skipping 54 matching lines @@
         blink::WebLocalFrame::create(replicated_state.scope, render_frame);
     render_frame->proxy_routing_id_ = proxy_routing_id;
     web_frame->initializeToReplaceRemoteFrame(
         proxy->web_frame(), WebString::fromUTF8(replicated_state.name),
         replicated_state.sandbox_flags);
   }
   render_frame->SetWebFrame(web_frame);
   CHECK_IMPLIES(parent_routing_id == MSG_ROUTING_NONE, !web_frame->parent());
 
   if (widget_params.routing_id != MSG_ROUTING_NONE) {
-    CHECK(base::CommandLine::ForCurrentProcess()->HasSwitch(
-        switches::kSitePerProcess));
+    CHECK(SiteIsolationPolicy::AreCrossProcessFramesPossible());
     render_frame->render_widget_ = RenderWidget::CreateForFrame(
         widget_params.routing_id, widget_params.surface_id,
         widget_params.hidden, render_frame->render_view_->screen_info(),
         compositor_deps, web_frame);
     // TODO(kenrb): Observing shouldn't be necessary when we sort out
     // WasShown and WasHidden, separating page-level visibility from
     // frame-level visibility.
     render_frame->render_widget_->RegisterRenderFrame(render_frame);
   }
 
@@ skipping 86 matching lines @@
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnDestruct());
 
   base::trace_event::TraceLog::GetInstance()->RemoveProcessLabel(routing_id_);
 
 #if defined(VIDEO_HOLE)
   if (contains_media_player_)
     render_view_->UnregisterVideoHoleFrame(this);
 #endif
 
   if (!is_subframe_) {
-    if (!IsSwappedOutStateForbidden()) {
-      // When using swapped out frames, RenderFrameProxy is "owned" by
-      // RenderFrameImpl in the case it is the main frame. Ensure it is deleted
-      // along with this object.
-      if (render_frame_proxy_ &&
-          !base::CommandLine::ForCurrentProcess()->HasSwitch(
-              switches::kSitePerProcess)) {
-        // The following method calls back into this object and clears
-        // |render_frame_proxy_|.
-        render_frame_proxy_->frameDetached(
-            blink::WebRemoteFrameClient::DetachType::Remove);
-      }
+    // When using swapped out frames, RenderFrameProxy is owned by
+    // RenderFrameImpl in the case it is the main frame. Ensure it is deleted
+    // along with this object.
+    if (render_frame_proxy_ &&
+        !RenderFrameProxy::IsSwappedOutStateForbidden()) {
+      // The following method calls back into this object and clears
+      // |render_frame_proxy_|.
+      render_frame_proxy_->frameDetached(
+          blink::WebRemoteFrameClient::DetachType::Remove);
     }
 
     // Ensure the RenderView doesn't point to this object, once it is destroyed.
     // TODO(nasko): Add a check that the |main_render_frame_| of |render_view_|
     // is |this|, once the object is no longer leaked.
     // See https://crbug.com/464764.
     render_view_->main_render_frame_ = nullptr;
   }
 
   render_view_->UnregisterRenderFrame(this);
@@ skipping 393 matching lines @@
                                          before_unload_start_time,
                                          before_unload_end_time));
 }
 
 void RenderFrameImpl::OnSwapOut(
     int proxy_routing_id,
     bool is_loading,
     const FrameReplicationState& replicated_frame_state) {
   TRACE_EVENT1("navigation", "RenderFrameImpl::OnSwapOut", "id", routing_id_);
   RenderFrameProxy* proxy = NULL;
-  bool is_site_per_process = base::CommandLine::ForCurrentProcess()->HasSwitch(
-      switches::kSitePerProcess);
+  bool swapped_out_forbidden = RenderFrameProxy::IsSwappedOutStateForbidden();
   bool is_main_frame = !frame_->parent();
 
   // This codepath should only be hit for subframes when in --site-per-process.
-  CHECK_IMPLIES(!is_main_frame, is_site_per_process);
+  CHECK_IMPLIES(!is_main_frame,
+                SiteIsolationPolicy::AreCrossProcessFramesPossible());
 
   // Only run unload if we're not swapped out yet, but send the ack either way.
   if (!is_swapped_out_) {
     // Swap this RenderFrame out so the frame can navigate to a page rendered by
     // a different process.  This involves running the unload handler and
     // clearing the page.  We also allow this process to exit if there are no
     // other active RenderFrames in it.
 
     // Send an UpdateState message before we get swapped out.
     render_view_->SyncNavigationState();
@@ skipping 21 matching lines @@
     // willCheckAndDispatchMessageEvent() that needs the proxy.
     if (proxy)
       set_render_frame_proxy(proxy);
 
     // Now that we're swapped out and filtering IPC messages, stop loading to
     // ensure that no other in-progress navigation continues.  We do this here
     // to avoid sending a DidStopLoading message to the browser process.
     // TODO(creis): Should we be stopping all frames here and using
     // StopAltErrorPageFetcher with RenderView::OnStop, or just stopping this
     // frame?
-    if (!IsSwappedOutStateForbidden())
+    if (!swapped_out_forbidden)
       OnStop();
 
     // Transfer settings such as initial drawing parameters to the remote frame,
     // if one is created, that will replace this frame.
     if (!is_main_frame && proxy)
       proxy->web_frame()->initializeFromFrame(frame_);
 
     // Replace the page with a blank dummy URL. The unload handler will not be
     // run a second time, thanks to a check in FrameLoader::stopLoading.
     // TODO(creis): Need to add a better way to do this that avoids running the
     // beforeunload handler. For now, we just run it a second time silently.
-    if (!IsSwappedOutStateForbidden())
+    if (!swapped_out_forbidden)
       NavigateToSwappedOutURL();
 
     // Let WebKit know that this view is hidden so it can drop resources and
     // stop compositing.
     // TODO(creis): Support this for subframes as well.
     if (is_main_frame) {
       render_view_->webview()->setVisibilityState(
           blink::WebPageVisibilityStateHidden, false);
     }
   }
 
   // It is now safe to show modal dialogs again.
   // TODO(creis): Deal with modal dialogs from subframes.
   if (is_main_frame)
     render_view_->suppress_dialogs_until_swap_out_ = false;
 
   Send(new FrameHostMsg_SwapOut_ACK(routing_id_));
 
   RenderViewImpl* render_view = render_view_.get();
 
   // Now that all of the cleanup is complete and the browser side is notified,
   // start using the RenderFrameProxy, if one is created.
-  if (proxy && IsSwappedOutStateForbidden()) {
+  if (proxy && swapped_out_forbidden) {
     frame_->swap(proxy->web_frame());
 
     if (is_loading)
       proxy->OnDidStartLoading();
   }
 
   // In --site-per-process, initialize the WebRemoteFrame with the replication
   // state passed by the process that is now rendering the frame.
   // TODO(alexmos): We cannot yet do this for swapped-out main frames, because
   // in that case we leave the LocalFrame as the main frame visible to Blink
   // and don't call swap() above. Because swap() is what creates a RemoteFrame
   // in proxy->web_frame(), the RemoteFrame will not exist for main frames.
   // When we do an unconditional swap for all frames, we can remove
   // !is_main_frame below.
-  if (proxy && IsSwappedOutStateForbidden())
+  if (proxy && swapped_out_forbidden)
     proxy->SetReplicatedState(replicated_frame_state);
 
   // Safe to exit if no one else is using the process.
   // TODO(nasko): Remove the dependency on RenderViewImpl here and ref count
   // the process based on the lifetime of this RenderFrameImpl object.
   if (is_main_frame) {
     render_view->WasSwappedOut();
   }
 }
 
@@ skipping 947 matching lines @@
   // We need to clean up subframes by removing them from the map and deleting
   // the RenderFrameImpl.  In contrast, the main frame is owned by its
   // containing RenderViewHost (so that they have the same lifetime), so only
   // removal from the map is needed and no deletion.
   FrameMap::iterator it = g_frame_map.Get().find(frame);
   CHECK(it != g_frame_map.Get().end());
   CHECK_EQ(it->second, this);
   g_frame_map.Get().erase(it);
 
   if (is_subframe_) {
-    if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-            switches::kSitePerProcess) && render_widget_) {
+    if (render_widget_) {
+      CHECK(SiteIsolationPolicy::AreCrossProcessFramesPossible());
       render_widget_->UnregisterRenderFrame(this);
     }
 
     // Only remove the frame from the renderer's frame tree if the frame is
     // being detached for removal. For swaps, WebFrame::swap already takes care
     // of replacing the frame with a RemoteFrame.
     if (type == DetachType::Remove)
       frame->parent()->removeChild(frame);
   }
 
@@ skipping 24 matching lines @@
   DCHECK(!frame_ || frame_ == frame);
 
   // TODO(alexmos): According to https://crbug.com/169110, sending window.name
   // updates may have performance implications for benchmarks like SunSpider.
   // For now, send these updates only for --site-per-process, which needs to
   // replicate frame names to frame proxies, and when
   // |report_frame_name_changes| is set (used by <webview>).  If needed, this
   // can be optimized further by only sending the update if there are any
   // remote frames in the frame tree, or delaying and batching up IPCs if
   // updates are happening too frequently.
-  bool is_site_per_process = base::CommandLine::ForCurrentProcess()->HasSwitch(
-      switches::kSitePerProcess);
-  if (is_site_per_process ||
+  if (SiteIsolationPolicy::AreCrossProcessFramesPossible() ||
       render_view_->renderer_preferences_.report_frame_name_changes) {
     Send(new FrameHostMsg_DidChangeName(routing_id_, base::UTF16ToUTF8(name)));
   }
 }
 
 void RenderFrameImpl::didChangeSandboxFlags(blink::WebFrame* child_frame,
                                             blink::WebSandboxFlags flags) {
   int frame_routing_id = MSG_ROUTING_NONE;
   if (child_frame->isWebRemoteFrame()) {
     frame_routing_id =
@@ skipping 249 matching lines @@
   // In fast/loader/stop-provisional-loads.html, we abort the load before this
   // callback is invoked.
   if (!ds)
     return;
 
   TRACE_EVENT2("navigation", "RenderFrameImpl::didStartProvisionalLoad",
                "id", routing_id_, "url", ds->request().url().string().utf8());
   DocumentState* document_state = DocumentState::FromDataSource(ds);
 
   // We should only navigate to swappedout:// when is_swapped_out_ is true.
-  CHECK((ds->request().url() != GURL(kSwappedOutURL)) ||
-        is_swapped_out_) <<
-        "Heard swappedout:// when not swapped out.";
+  CHECK_IMPLIES(ds->request().url() == GURL(kSwappedOutURL), is_swapped_out_)
+      << "Heard swappedout:// when not swapped out.";
 
   // Update the request time if WebKit has better knowledge of it.
   if (document_state->request_time().is_null() &&
           triggering_event_time != 0.0) {
     document_state->set_request_time(Time::FromDoubleT(triggering_event_time));
   }
 
   // Start time is only set after request time.
   document_state->set_start_load_time(Time::Now());
 
@@ skipping 1376 matching lines @@
 
   params.searchable_form_url = internal_data->searchable_form_url();
   params.searchable_form_encoding = internal_data->searchable_form_encoding();
 
   params.gesture = render_view_->navigation_gesture_;
   render_view_->navigation_gesture_ = NavigationGestureUnknown;
 
   // Make navigation state a part of the DidCommitProvisionalLoad message so
   // that committed entry has it at all times.
   HistoryEntry* entry = render_view_->history_controller()->GetCurrentEntry();
-  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kSitePerProcess)) {
+  if (!SiteIsolationPolicy::UseSubframeNavigationEntries()) {
     if (entry)
       params.page_state = HistoryEntryToPageState(entry);
     else
       params.page_state = PageState::CreateFromURL(request.url());
   } else {
     // In --site-per-process, just send a single HistoryItem for this frame,

[nasko, 2015/07/08 12:52:24]

Should we be dropping these "In --site-per-process" prefixes in the comments?
Similar comment is present further down in this file.

[ncarter (slow), 2015/07/10 23:29:19]

I can try, but I didn't want to throw effort at it until we were all in
agreement about which buckets and to use and what to name them. For the most
part the comments about --site-per-process are still technically correct.

     // rather than the whole tree.  It will be stored in the corresponding
     // FrameNavigationEntry.
     params.page_state = SingleHistoryItemToPageState(item);
   }
   params.item_sequence_number = item.itemSequenceNumber();
   params.document_sequence_number = item.documentSequenceNumber();
 
   if (!frame->parent()) {
     // Top-level navigation.
 
@@ skipping 229 matching lines @@
           info.urlRequest,
           info.navigationType,
           info.defaultPolicy,
           info.isRedirect)) {
     return blink::WebNavigationPolicyIgnore;
   }
 #endif
 
   Referrer referrer(RenderViewImpl::GetReferrerFromRequest(info.frame,
                                                            info.urlRequest));
-  const base::CommandLine& command_line =
-      *base::CommandLine::ForCurrentProcess();
 
-  if (command_line.HasSwitch(switches::kSitePerProcess) && is_subframe_) {
+  // TODO(nick): Is consulting |is_subframe_| here correct?
+  if (RenderFrameProxy::IsSwappedOutStateForbidden() && is_subframe_) {
     // There's no reason to ignore navigations on subframes, since the swap out
     // logic no longer applies.
   } else {
     if (is_swapped_out_) {
       if (info.urlRequest.url() != GURL(kSwappedOutURL)) {
         // Targeted links may try to navigate a swapped out frame.  Allow the
         // browser process to navigate the tab instead.  Note that it is also
         // possible for non-targeted navigations (from this view) to arrive
         // here just after we are swapped out.  It's ok to send them to the
         // browser, as long as they're for the top level frame.
@@ skipping 283 matching lines @@
     scoped_ptr<HistoryEntry> entry =
         PageStateToHistoryEntry(request_params.page_state);
     if (entry) {
       // Ensure we didn't save the swapped out URL in UpdateState, since the
       // browser should never be telling us to navigate to swappedout://.
       CHECK(entry->root().urlString() != WebString::fromUTF8(kSwappedOutURL));
 
       if (!browser_side_navigation) {
         scoped_ptr<NavigationParams> navigation_params(
             new NavigationParams(*pending_navigation_params_.get()));
-        if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
-                switches::kSitePerProcess)) {
+        if (!SiteIsolationPolicy::UseSubframeNavigationEntries()) {
           // By default, tell the HistoryController to go the deserialized
           // HistoryEntry.  This only works if all frames are in the same
           // process.
           DCHECK(!frame_->parent());
           render_view_->history_controller()->GoToEntry(
               frame_, entry.Pass(), navigation_params.Pass(), cache_policy);
         } else {
           // In --site-per-process, the browser process sends a single
           // WebHistoryItem destined for this frame.
           // TODO(creis): Change PageState to FrameState.  In the meantime, we
@@ skipping 520 matching lines @@
         cdm_manager_
 #endif
         ));
 #endif  //  defined(ENABLE_MOJO_MEDIA)
   }
 
   return cdm_factory_.get();
 }
 
 }  // namespace content