Fix cross-process location.replace for main frames and subframes.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 3702 matching lines @@
   // Attach |should_replace_current_entry| state to requests so that, should
   // this navigation later require a request transfer, all state is preserved
   // when it is re-created in the new process.
   bool should_replace_current_entry = false;
   if (navigation_state->IsContentInitiated()) {
     should_replace_current_entry = data_source->replacesCurrentHistoryItem();
   } else {
     // If the navigation is browser-initiated, the NavigationState contains the
     // correct value instead of the WebDataSource.
     //
-    // TODO(davidben): Avoid this awkward duplication of state. See comment on
-    // NavigationState::should_replace_current_entry().
+    // TODO(creis): Remove should_replace_current_entry from NavigationState
+    // once we verify this is correct, since the WebDataSource should now be
+    // correct.  Currently failing in NewAndAutoSubframe test with CHECK_EQ.
+    CHECK(
+        !navigation_state->common_params().should_replace_current_entry ||
+        data_source->replacesCurrentHistoryItem());
     should_replace_current_entry =
         navigation_state->common_params().should_replace_current_entry;
   }
 
   int provider_id = kInvalidServiceWorkerProviderId;
   if (request.frameType() == blink::WebURLRequest::FrameTypeTopLevel ||
       request.frameType() == blink::WebURLRequest::FrameTypeNested) {
     // |provisionalDataSource| may be null in some content::ResourceFetcher
     // use cases, we don't hook those requests.
     if (frame->provisionalDataSource()) {
@@ skipping 640 matching lines @@
       static_cast<NavigationStateImpl*>(document_state->navigation_state());
   InternalDocumentStateData* internal_data =
       InternalDocumentStateData::FromDocumentState(document_state);
 
   FrameHostMsg_DidCommitProvisionalLoad_Params params;
   params.http_status_code = response.httpStatusCode();
   params.url_is_unreachable = ds->hasUnreachableURL();
   params.is_post = false;
   params.intended_as_new_entry =
       navigation_state->request_params().intended_as_new_entry;
-  params.did_create_new_entry = commit_type == blink::WebStandardCommit;
+  // We create a new entry for standard commits, as well as location.replace
+  // navigations that replace the current entry with a different document.
+  params.did_create_new_entry = commit_type == blink::WebStandardCommit ||
+      (ds->replacesCurrentHistoryItem() &&
+       !navigation_state->WasWithinSamePage());
+  CHECK(!navigation_state->common_params().should_replace_current_entry ||
+        ds->replacesCurrentHistoryItem());
+  params.should_replace_current_entry = ds->replacesCurrentHistoryItem();
   params.post_id = -1;
   params.page_id = render_view_->page_id_;
   params.nav_entry_id = navigation_state->request_params().nav_entry_id;
   // We need to track the RenderViewHost routing_id because of downstream
   // dependencies (crbug.com/392171 DownloadRequestHandle, SaveFileManager,
   // ResourceDispatcherHostImpl, MediaStreamUIProxy,
   // SpeechRecognitionDispatcherHost and possibly others). They look up the view
   // based on the ID stored in the resource requests. Once those dependencies
   // are unwound or moved to RenderFrameHost (crbug.com/304341) we can move the
   // client to be based on the routing_id of the RenderFrameHost.
@@ skipping 148 matching lines @@
     // This message needs to be sent before any of allowScripts(),
     // allowImages(), allowPlugins() is called for the new page, so that when
     // these functions send a ViewHostMsg_ContentBlocked message, it arrives
     // after the FrameHostMsg_DidCommitProvisionalLoad message.
     Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
   } else {
     // Subframe navigation: the type depends on whether this navigation
     // generated a new session history entry. When they do generate a session
     // history entry, it means the user initiated the navigation and we should
     // mark it as such.
-    if (commit_type == blink::WebStandardCommit)
+    if (params.did_create_new_entry)
       params.transition = ui::PAGE_TRANSITION_MANUAL_SUBFRAME;
     else
       params.transition = ui::PAGE_TRANSITION_AUTO_SUBFRAME;
 
     DCHECK(!navigation_state->request_params().should_clear_history_list);
     params.history_list_was_cleared = false;
     params.report_type = FrameMsg_UILoadMetricsReportType::NO_REPORT;
 
     // Don't send this message while the subframe is swapped out.
     if (!is_swapped_out())
@@ skipping 400 matching lines @@
                               bool is_history_navigation_in_new_child) {
   FrameHostMsg_OpenURL_Params params;
   params.url = url;
   params.referrer = referrer;
   params.disposition = RenderViewImpl::NavigationPolicyToDisposition(policy);
 
   if (IsBrowserInitiated(pending_navigation_params_.get())) {
     // This is necessary to preserve the should_replace_current_entry value on
     // cross-process redirects, in the event it was set by a previous process.
     //
-    // TODO(davidben): Avoid this awkward duplication of state. See comment on
-    // NavigationState::should_replace_current_entry().
+    // TODO(creis): Remove should_replace_current_entry from NavigationState
+    // once we verify this is correct, since the WebDataSource should now be
+    // correct.
+    WebDataSource* ds = frame_->provisionalDataSource();
+    if (ds) {
+      DocumentState* document_state = DocumentState::FromDataSource(ds);
+      NavigationStateImpl* navigation_state =
+          static_cast<NavigationStateImpl*>(document_state->navigation_state());
+      CHECK_EQ(navigation_state->common_params().should_replace_current_entry,
+               ds->replacesCurrentHistoryItem());
+    }
     params.should_replace_current_entry =
         pending_navigation_params_->common_params.should_replace_current_entry;
   } else {
     params.should_replace_current_entry =
         should_replace_current_entry && render_view_->history_list_length_;
   }
   params.user_gesture = WebUserGestureIndicator::isProcessingUserGesture();
   if (GetContentClient()->renderer()->AllowPopup())
     params.user_gesture = true;
 
@@ skipping 66 matching lines @@
       base::TimeTicks();
 
   // Unless the load is a WebFrameLoadType::Standard, this should remain
   // uninitialized. It will be updated when the load type is determined to be
   // Standard, or after the previous document's unload handler has been
   // triggered. This occurs in UpdateNavigationState.
   // TODO(csharrison) See if we can always use the browser timestamp.
   pending_navigation_params_->common_params.navigation_start =
       base::TimeTicks();
 
-  // Create parameters for a standard navigation.
-  blink::WebFrameLoadType load_type = blink::WebFrameLoadType::Standard;
+  // Create parameters for a standard navigation, indicating whether it should
+  // replace the current NavigationEntry.
+  blink::WebFrameLoadType load_type =
+      common_params.should_replace_current_entry ?
+          blink::WebFrameLoadType::ReplaceCurrentItem :
+          blink::WebFrameLoadType::Standard;
   blink::WebHistoryLoadType history_load_type =
       blink::WebHistoryDifferentDocumentLoad;
   bool should_load_request = false;
   WebHistoryItem item_for_history_navigation;
   WebURLRequest request =
       CreateURLRequestForNavigation(common_params, std::move(stream_params),
                                     frame_->isViewSourceModeEnabled());
 #if defined(OS_ANDROID)
   request.setHasUserGesture(start_params.has_user_gesture);
 #endif
@@ skipping 697 matching lines @@
       media::ConvertToSwitchOutputDeviceCB(web_callbacks);
   scoped_refptr<media::AudioOutputDevice> device =
       AudioDeviceFactory::NewOutputDevice(routing_id_, 0, sink_id.utf8(),
                                           security_origin);
   media::OutputDeviceStatus status = device->GetDeviceStatus();
   device->Stop();
   callback.Run(status);
 }
 
 }  // namespace content