ServiceWorker: Fix the bug in navigate() if windowclient is nested frame.

content/browser/service_worker/service_worker_version.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_version.h"
 
 #include <algorithm>
 #include <map>
 #include <string>
 
 #include "base/command_line.h"
 #include "base/guid.h"
 #include "base/location.h"
 #include "base/memory/ref_counted.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/child_process_security_policy_impl.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/message_port_message_filter.h"
 #include "content/browser/message_port_service.h"
 #include "content/browser/service_worker/embedded_worker_instance.h"
 #include "content/browser/service_worker/embedded_worker_registry.h"
 #include "content/browser/service_worker/service_worker_context_core.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_metrics.h"
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/common/service_worker/service_worker_messages.h"
 #include "content/common/service_worker/service_worker_type_converters.h"
 #include "content/common/service_worker/service_worker_utils.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/page_navigator.h"
-#include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/background_sync.mojom.h"
 #include "content/public/common/child_process_host.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/service_registry.h"
 #include "mojo/common/common_type_converters.h"
@@ skipping 130 matching lines @@
 using OpenURLCallback = base::Callback<void(int, int)>;
 
 // The OpenURLObserver class is a WebContentsObserver that will wait for a
 // WebContents to be initialized, run the |callback| passed to its constructor
 // then self destroy.
 // The callback will receive the process and frame ids. If something went wrong
 // those will be (kInvalidUniqueID, MSG_ROUTING_NONE).
 // The callback will be called in the IO thread.
 class OpenURLObserver : public WebContentsObserver {
  public:
-  OpenURLObserver(WebContents* web_contents, const OpenURLCallback& callback)
-      : WebContentsObserver(web_contents), callback_(callback) {}
+  OpenURLObserver(WebContents* web_contents,
+                  int frame_tree_node_id,
+                  const OpenURLCallback& callback)
+      : WebContentsObserver(web_contents),
+        frame_tree_node_id_(frame_tree_node_id),
+        callback_(callback) {}
 
   void DidCommitProvisionalLoadForFrame(
       RenderFrameHost* render_frame_host,
       const GURL& validated_url,
       ui::PageTransition transition_type) override {
     DCHECK(web_contents());
 
-    if (render_frame_host != web_contents()->GetMainFrame())
+    RenderFrameHostImpl* rfhi =
+        static_cast<RenderFrameHostImpl*>(render_frame_host);
+    if (rfhi->frame_tree_node()->frame_tree_node_id() != frame_tree_node_id_)
       return;
 
     RunCallback(render_frame_host->GetProcess()->GetID(),
                 render_frame_host->GetRoutingID());
   }
 
   void RenderProcessGone(base::TerminationStatus status) override {
     RunCallback(ChildProcessHost::kInvalidUniqueID, MSG_ROUTING_NONE);
   }
 
   void WebContentsDestroyed() override {
     RunCallback(ChildProcessHost::kInvalidUniqueID, MSG_ROUTING_NONE);
   }
 
  private:
   void RunCallback(int render_process_id, int render_frame_id) {
     // After running the callback, |this| will stop observing, thus
     // web_contents() should return nullptr and |RunCallback| should no longer
     // be called. Then, |this| will self destroy.
     DCHECK(web_contents());
 
     BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
                             base::Bind(callback_,
                                        render_process_id,
                                        render_frame_id));
     Observe(nullptr);
     base::MessageLoop::current()->DeleteSoon(FROM_HERE, this);
   }
 
+  int frame_tree_node_id_;
   const OpenURLCallback callback_;
 
   DISALLOW_COPY_AND_ASSIGN(OpenURLObserver);
 };
 
 void DidOpenURL(const OpenURLCallback& callback, WebContents* web_contents) {

[Charlie Reis, 2015/09/24 18:36:58]

Let's add a comment saying this should only be called for main frame
navigations.

[zino, 2015/09/25 01:08:30]

Done.

   DCHECK(web_contents);
 
-  new OpenURLObserver(web_contents, callback);
+  RenderFrameHostImpl* rfhi =
+      static_cast<RenderFrameHostImpl*>(web_contents->GetMainFrame());
+  new OpenURLObserver(web_contents,
+                      rfhi->frame_tree_node()->frame_tree_node_id(), callback);
 }
 
 void NavigateClientOnUI(const GURL& url,
                         const GURL& script_url,
                         int process_id,
                         int frame_id,
                         const OpenURLCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  RenderFrameHost* render_frame_host =
-      RenderFrameHost::FromID(process_id, frame_id);
-  WebContents* web_contents =
-      WebContents::FromRenderFrameHost(render_frame_host);
+  RenderFrameHostImpl* rfhi = RenderFrameHostImpl::FromID(process_id, frame_id);
+  WebContents* web_contents = WebContents::FromRenderFrameHost(rfhi);
 
-  if (!render_frame_host || !web_contents) {
+  if (!rfhi || !web_contents) {
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         base::Bind(callback, ChildProcessHost::kInvalidUniqueID,
                    MSG_ROUTING_NONE));
     return;
   }
 
+  ui::PageTransition transition = rfhi->GetParent()
+                                      ? ui::PAGE_TRANSITION_AUTO_SUBFRAME
+                                      : ui::PAGE_TRANSITION_AUTO_TOPLEVEL;
+  int frame_tree_node_id = rfhi->frame_tree_node()->frame_tree_node_id();
+
   OpenURLParams params(
       url, Referrer::SanitizeForRequest(
                url, Referrer(script_url, blink::WebReferrerPolicyDefault)),
-      CURRENT_TAB, ui::PAGE_TRANSITION_AUTO_TOPLEVEL,
+      frame_tree_node_id, CURRENT_TAB, transition,
       true /* is_renderer_initiated */);
   web_contents->OpenURL(params);
-  DidOpenURL(callback, web_contents);
+  new OpenURLObserver(web_contents, frame_tree_node_id, callback);
 }
 
 void OpenWindowOnUI(
     const GURL& url,
     const GURL& script_url,
     int process_id,
     const scoped_refptr<ServiceWorkerContextWrapper>& context_wrapper,
     const OpenURLCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ skipping 2077 matching lines @@
 void ServiceWorkerVersion::OnBeginEvent() {
   if (should_exclude_from_uma_ || running_status() != RUNNING ||
       idle_time_.is_null()) {
     return;
   }
   ServiceWorkerMetrics::RecordTimeBetweenEvents(base::TimeTicks::Now() -
                                                 idle_time_);
 }
 
 }  // namespace content