Fix a race condition where rapid back/forward clicks could close a tab...

chrome/browser/renderer_host/resource_dispatcher_host.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
 
 #include <vector>
 
@@ skipping 91 matching lines @@
 
 // Maximum number of pending data messages sent to the renderer at any
 // given time for a given request.
 const int kMaxPendingDataMessages = 20;
 
 // Maximum byte "cost" of all the outstanding requests for a renderer.
 // See delcaration of |max_outstanding_requests_cost_per_process_| for details.
 // This bound is 25MB, which allows for around 6000 outstanding requests.
 const int kMaxOutstandingRequestsCostPerProcess = 26214400;
 
-// A NotificationTask proxies a resource dispatcher notification from the IO
-// thread to the RenderViewHostDelegate on the UI thread. It should be
-// constructed on the IO thread and run in the UI thread.
-class NotificationTask : public Task {
+// Calls ClosePageIgnoringUnloadEvents on the UI thread for the given
+// RenderView.
+//
+// If there are more functions we need to call on RVH, we should generalize this
+// like the "Delegate" notification task below.
+class RVHCloseNotificationTask : public Task {
+ public:
+  RVHCloseNotificationTask(int render_process_host_id,
+                           int render_view_host_id)
+      : render_process_host_id_(render_process_host_id),
+        render_view_host_id_(render_view_host_id) {
+  }
+
+  virtual void Run() {
+    RenderViewHost* rvh = RenderViewHost::FromID(render_process_host_id_,
+                                                 render_view_host_id_);
+    if (rvh)
+      rvh->ClosePageIgnoringUnloadEvents();
+  }
+
+ private:
+  int render_process_host_id_;
+  int render_view_host_id_;
+
+  DISALLOW_COPY_AND_ASSIGN(RVHCloseNotificationTask);
+};
+
+// A RVHDelegateNotificationTask proxies a resource dispatcher notification
+// from the IO thread to the RenderViewHostDelegate on the UI thread. It should
+// be constructed on the IO thread and run in the UI thread.
+class RVHDelegateNotificationTask : public Task {
  public:
   typedef void (RenderViewHostDelegate::Resource::* ResourceFunction)
       (ResourceRequestDetails*);
 
   // Supply the originating URLRequest, a function on RenderViewHostDelegate
   // to call, and the details to use as the parameter to the given function.
   //
   // This object will take ownership of the details pointer, which must be
   // allocated on the heap.
-  NotificationTask(
+  RVHDelegateNotificationTask(
       URLRequest* request,
       ResourceFunction function,
       ResourceRequestDetails* details)
-      : function_(function),
+      : render_process_host_id_(-1),
+        render_view_host_id_(-1),
+        function_(function),
         details_(details) {
     if (!ResourceDispatcherHost::RenderViewForRequest(request,
                                                       &render_process_host_id_,
                                                       &render_view_host_id_)) {
       NOTREACHED();
     }
   }
 
   virtual void Run() {
     RenderViewHost* rvh = RenderViewHost::FromID(render_process_host_id_,
                                                  render_view_host_id_);
     if (rvh) {
       RenderViewHostDelegate::Resource* resource_delegate =
           rvh->delegate()->GetResourceDelegate();
       if (resource_delegate)
         (resource_delegate->*function_)(details_.get());
     }
   }
 
  private:
   int render_process_host_id_;
   int render_view_host_id_;
 
   // The function to call on RenderViewHostDelegate::Resource on the UI thread.
   ResourceFunction function_;
 
   // The details for the notification.
   scoped_ptr<ResourceRequestDetails> details_;
 
-  DISALLOW_COPY_AND_ASSIGN(NotificationTask);
+  DISALLOW_COPY_AND_ASSIGN(RVHDelegateNotificationTask);
 };
 
 // Consults the RendererSecurity policy to determine whether the
 // ResourceDispatcherHost should service this request.  A request might be
 // disallowed if the renderer is not authorized to restrive the request URL or
 // if the renderer is attempting to upload an unauthorized file.
 bool ShouldServiceRequest(ChildProcessInfo::ProcessType process_type,
                           int process_id,
                           const ViewHostMsg_Resource_Request& request_data)  {
   if (process_type == ChildProcessInfo::PLUGIN_PROCESS)
@@ skipping 348 matching lines @@
     return;
 
   ExtraRequestInfo* info = ExtraInfoForRequest(i->second);
   info->waiting_for_upload_progress_ack = false;
 }
 
 void ResourceDispatcherHost::OnCancelRequest(int request_id) {
   CancelRequest(receiver_->GetProcessId(), request_id, true, true);
 }
 
-void ResourceDispatcherHost::OnClosePageACK(int new_render_process_host_id,
-                                           int new_request_id) {
-  GlobalRequestID global_id(new_render_process_host_id, new_request_id);
-  PendingRequestList::iterator i = pending_requests_.find(global_id);
-  if (i == pending_requests_.end()) {
-    // If there are no matching pending requests, then this is not a
-    // cross-site navigation and we are just closing the tab/browser.
-    ui_loop_->PostTask(FROM_HERE, NewRunnableFunction(
-        &RenderViewHost::ClosePageIgnoringUnloadEvents,
-        new_render_process_host_id,
-        new_request_id));
-    return;
-  }
-
-  ExtraRequestInfo* info = ExtraInfoForRequest(i->second);
-  if (info->cross_site_handler) {
-    info->cross_site_handler->ResumeResponse();
+void ResourceDispatcherHost::OnClosePageACK(
+    const ViewMsg_ClosePage_Params& params) {
+  if (params.for_cross_site_transition) {
+    // Closes for cross-site transitions are handled such that the cross-site
+    // transition continues.
+    GlobalRequestID global_id(params.new_render_process_host_id,
+                              params.new_request_id);
+    PendingRequestList::iterator i = pending_requests_.find(global_id);
+    if (i != pending_requests_.end()) {
+      // The response we were meant to resume could have already been canceled.
+      ExtraRequestInfo* info = ExtraInfoForRequest(i->second);
+      if (info->cross_site_handler)
+        info->cross_site_handler->ResumeResponse();
+    }
+  } else {
+    // This is a tab close, so just forward the message to close it.
+    DCHECK(params.new_render_process_host_id == -1);
+    DCHECK(params.new_request_id == -1);
+    ui_loop_->PostTask(
+        FROM_HERE,
+        new RVHCloseNotificationTask(params.closing_process_id,
+                                     params.closing_route_id));
   }
 }
 
 // We are explicitly forcing the download of 'url'.
 void ResourceDispatcherHost::BeginDownload(const GURL& url,
                                            const GURL& referrer,
                                            int process_id,
                                            int route_id,
                                            URLRequestContext* request_context) {
   if (is_shutdown_)
@@ skipping 841 matching lines @@
          (request->response_headers()->response_code() <= 599)));
   return 0;
 }
 
 void ResourceDispatcherHost::NotifyResponseStarted(URLRequest* request,
                                                    int process_id) {
   // Notify the observers on the IO thread.
   FOR_EACH_OBSERVER(Observer, observer_list_, OnRequestStarted(this, request));
 
   // Notify the observers on the UI thread.
-  ui_loop_->PostTask(FROM_HERE, new NotificationTask(request,
+  ui_loop_->PostTask(FROM_HERE, new RVHDelegateNotificationTask(request,
       &RenderViewHostDelegate::Resource::DidStartReceivingResourceResponse,
       new ResourceRequestDetails(request,
          GetCertID(request, process_id))));
 }
 
 void ResourceDispatcherHost::NotifyResponseCompleted(
     URLRequest* request,
     int process_id) {
   // Notify the observers on the IO thread.
   FOR_EACH_OBSERVER(Observer, observer_list_,
                     OnResponseCompleted(this, request));
 }
 
 void ResourceDispatcherHost::NotifyReceivedRedirect(URLRequest* request,
                                                     int process_id,
                                                     const GURL& new_url) {
   // Notify the observers on the IO thread.
   FOR_EACH_OBSERVER(Observer, observer_list_,
                     OnReceivedRedirect(this, request, new_url));
 
   int cert_id = GetCertID(request, process_id);
 
   // Notify the observers on the UI thread.
   ui_loop_->PostTask(FROM_HERE,
-      new NotificationTask(request,
+      new RVHDelegateNotificationTask(request,
           &RenderViewHostDelegate::Resource::DidRedirectResource,
           new ResourceRedirectDetails(request, cert_id, new_url)));
 }
 
 namespace {
 
 // This function attempts to return the "more interesting" load state of |a|
 // and |b|.  We don't have temporal information about these load states
 // (meaning we don't know when we transitioned into these states), so we just
 // rank them according to how "interesting" the states are.
@@ skipping 178 matching lines @@
     case ViewHostMsg_UploadProgress_ACK::ID:
     case ViewHostMsg_SyncLoad::ID:
       return true;
 
     default:
       break;
   }
 
   return false;
 }