Prevent the destruction of WebContents in NavigationThrottle methods

content/browser/frame_host/navigation_handle_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_handle_impl.h"
 
 #include "base/command_line.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/navigator_delegate.h"
@@ skipping 62 matching lines @@
             partition->GetServiceWorkerContext());
     service_worker_handle_.reset(
         new ServiceWorkerNavigationHandle(service_worker_context));
   }
 
   GetDelegate()->DidStartNavigation(this);
 }
 
 NavigationHandleImpl::~NavigationHandleImpl() {
   GetDelegate()->DidFinishNavigation(this);
+
+  // Cancel the navigation on the IO thread if the NavigationHandle was
+  // destroyed in the middle of the NavigationThrottles checks.
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation) &&
+      !complete_callback_.is_null()) {
+    complete_callback_.Run(NavigationThrottle::CANCEL_AND_IGNORE);
+  }
 }
 
 NavigatorDelegate* NavigationHandleImpl::GetDelegate() const {
   return frame_tree_node_->navigator()->GetDelegate();
 }
 
 const GURL& NavigationHandleImpl::GetURL() {
   return url_;
 }
 
@@ skipping 59 matching lines @@
 
 void NavigationHandleImpl::Resume() {
   CHECK(state_ == DEFERRING_START || state_ == DEFERRING_REDIRECT);
   NavigationThrottle::ThrottleCheckResult result = NavigationThrottle::DEFER;
   if (state_ == DEFERRING_START) {
     result = CheckWillStartRequest();
   } else {
     result = CheckWillRedirectRequest();
   }
 
-  if (result != NavigationThrottle::DEFER)
-    complete_callback_.Run(result);
+  // If the navigation is not deferred and the NavigationHandle wasn't
+  // destroyed, run the callback.
+  if (result == NavigationThrottle::DEFER ||
+      result == NavigationThrottle::DESTROYED)
+    return;
+
+  complete_callback_.Run(result);
+  complete_callback_.Reset();
 }
 
 void NavigationHandleImpl::RegisterThrottleForTesting(
     scoped_ptr<NavigationThrottle> navigation_throttle) {
   throttles_.push_back(navigation_throttle.Pass());
 }
 
 NavigationThrottle::ThrottleCheckResult
 NavigationHandleImpl::CallWillStartRequestForTesting(
     bool is_post,
@@ skipping 52 matching lines @@
       GetContentClient()->browser()->CreateThrottlesForNavigation(this);
   if (throttles_to_register.size() > 0) {
     throttles_.insert(throttles_.end(), throttles_to_register.begin(),
                       throttles_to_register.end());
     throttles_to_register.weak_clear();
   }
 
   // Notify each throttle of the request.
   NavigationThrottle::ThrottleCheckResult result = CheckWillStartRequest();
 
-  // If the navigation is not deferred, run the callback.
-  if (result != NavigationThrottle::DEFER)
-    callback.Run(result);
+  // If the navigation is not deferred and the NavigationHandle wasn't
+  // destroyed, run the callback.
+  if (result == NavigationThrottle::DEFER ||
+      result == NavigationThrottle::DESTROYED)
+    return;
+
+  complete_callback_.Run(result);
+  complete_callback_.Reset();
 }
 
 void NavigationHandleImpl::WillRedirectRequest(
     const GURL& new_url,
     bool new_method_is_post,
     const GURL& new_referrer_url,
     bool new_is_external_protocol,
     const ThrottleChecksFinishedCallback& callback) {
   // Update the navigation parameters.
   url_ = new_url;
   is_post_ = new_method_is_post;
   sanitized_referrer_.url = new_referrer_url;
   sanitized_referrer_ = Referrer::SanitizeForRequest(url_, sanitized_referrer_);
   is_external_protocol_ = new_is_external_protocol;
 
   state_ = WILL_REDIRECT_REQUEST;
   complete_callback_ = callback;
 
   // Notify each throttle of the request.
   NavigationThrottle::ThrottleCheckResult result = CheckWillRedirectRequest();
 
-  // If the navigation is not deferred, run the callback.
-  if (result != NavigationThrottle::DEFER)
-    callback.Run(result);
+  // If the navigation is not deferred and the NavigationHandle wasn't
+  // destroyed, run the callback.
+  if (result == NavigationThrottle::DEFER ||
+      result == NavigationThrottle::DESTROYED)
+    return;
+
+  complete_callback_.Run(result);
+  complete_callback_.Reset();
 }
 
 void NavigationHandleImpl::DidRedirectNavigation(const GURL& new_url) {
   url_ = new_url;
   GetDelegate()->DidRedirectNavigation(this);
 }
 
 void NavigationHandleImpl::ReadyToCommitNavigation(
     RenderFrameHostImpl* render_frame_host) {
   CHECK(!render_frame_host_);
@@ skipping 17 matching lines @@
   DCHECK(state_ != WILL_SEND_REQUEST || next_index_ == 0);
   DCHECK(state_ != DEFERRING_START || next_index_ != 0);
   for (size_t i = next_index_; i < throttles_.size(); ++i) {
     NavigationThrottle::ThrottleCheckResult result =
         throttles_[i]->WillStartRequest();
     switch (result) {
       case NavigationThrottle::PROCEED:
         continue;
 
       case NavigationThrottle::CANCEL_AND_IGNORE:
+      case NavigationThrottle::DESTROYED:
         return result;
 
       case NavigationThrottle::DEFER:
         state_ = DEFERRING_START;
         next_index_ = i + 1;
         return result;
 
       default:
         NOTREACHED();
     }
   }
   next_index_ = 0;
   state_ = WILL_SEND_REQUEST;
   return NavigationThrottle::PROCEED;
 }
 
 NavigationThrottle::ThrottleCheckResult
 NavigationHandleImpl::CheckWillRedirectRequest() {
   DCHECK(state_ == WILL_REDIRECT_REQUEST || state_ == DEFERRING_REDIRECT);
   DCHECK(state_ != WILL_REDIRECT_REQUEST || next_index_ == 0);
   DCHECK(state_ != DEFERRING_REDIRECT || next_index_ != 0);
   for (size_t i = next_index_; i < throttles_.size(); ++i) {
     NavigationThrottle::ThrottleCheckResult result =
         throttles_[i]->WillRedirectRequest();
     switch (result) {
       case NavigationThrottle::PROCEED:
         continue;
 
       case NavigationThrottle::CANCEL_AND_IGNORE:
+      case NavigationThrottle::DESTROYED:
         return result;
 
       case NavigationThrottle::DEFER:
         state_ = DEFERRING_REDIRECT;
         next_index_ = i + 1;
         return result;
 
       default:
         NOTREACHED();
     }
   }
   next_index_ = 0;
   state_ = WILL_REDIRECT_REQUEST;
   return NavigationThrottle::PROCEED;
 }
 
 }  // namespace content