Fix a race condition where rapid back/forward clicks could close a tab...

chrome/browser/tab_contents/render_view_host_manager.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/tab_contents/render_view_host_manager.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "chrome/browser/dom_ui/dom_ui.h"
 #include "chrome/browser/dom_ui/dom_ui_factory.h"
@@ skipping 127 matching lines @@
     // in this case because it took too long.
     if (pending_render_view_host_->are_navigations_suspended())
       pending_render_view_host_->SetNavigationsSuspended(false);
   } else {
     // The request has been started and paused, while we're waiting for the
     // unload handler to finish.  We'll pretend that it did, by notifying the
     // IO thread to let the response continue.  The pending renderer will then
     // be swapped in as part of the usual DidNavigate logic.  (If the unload
     // handler later finishes, this call will be ignored because the state in
     // CrossSiteResourceHandler will already be cleaned up.)
-    current_host()->process()->CrossSiteClosePageACK(
-        pending_render_view_host_->process()->pid(), pending_request_id);
+    ViewMsg_ClosePage_Params params;
+    params.closing_process_id = render_view_host_->process()->pid();
+    params.closing_route_id = render_view_host_->routing_id();
+    params.for_cross_site_transition = true;
+    params.new_render_process_host_id =
+        pending_render_view_host_->process()->pid();
+    params.new_request_id = pending_request_id;
+    current_host()->process()->CrossSiteClosePageACK(params);
   }
   return false;
 }
 
 void RenderViewHostManager::DidNavigateMainFrame(
     RenderViewHost* render_view_host) {
   if (!cross_navigation_pending_) {
     DCHECK(!pending_render_view_host_);
 
     // We should only hear this from our current renderer.
@@ skipping 48 matching lines @@
 void RenderViewHostManager::ShouldClosePage(bool proceed) {
   // Should only see this while we have a pending renderer.  Otherwise, we
   // should ignore.
   if (!pending_render_view_host_) {
     bool proceed_to_fire_unload;
     delegate_->BeforeUnloadFiredFromRenderManager(proceed,
                                                   &proceed_to_fire_unload);
 
     if (proceed_to_fire_unload) {
       // This is not a cross-site navigation, the tab is being closed.
-      render_view_host_->FirePageUnload();
+      render_view_host_->ClosePage(true, -1, -1);
     }
     return;
   }
 
   if (proceed) {
     // Ok to unload the current page, so proceed with the cross-site
     // navigation.  Note that if navigations are not currently suspended, it
     // might be because the renderer was deemed unresponsive and this call was
     // already made by ShouldCloseTabOnUnresponsiveRenderer.  In that case, it
     // is ok to do nothing here.
@@ skipping 10 matching lines @@
                                                 int new_request_id) {
   // Should only see this while we have a pending renderer.
   if (!cross_navigation_pending_)
     return;
   DCHECK(pending_render_view_host_);
 
   // Tell the old renderer to run its onunload handler.  When it finishes, it
   // will send a ClosePage_ACK to the ResourceDispatcherHost with the given
   // IDs (of the pending RVH's request), allowing the pending RVH's response to
   // resume.
-  render_view_host_->ClosePage(new_render_process_host_id, new_request_id);
+  render_view_host_->ClosePage(true,
+                               new_render_process_host_id, new_request_id);
 
   // ResourceDispatcherHost has told us to run the onunload handler, which
   // means it is not a download or unsafe page, and we are going to perform the
   // navigation.  Thus, we no longer need to remember that the RenderViewHost
   // is part of a pending cross-site request.
   pending_render_view_host_->SetHasPendingCrossSiteRequest(false,
                                                            new_request_id);
 }
 
 void RenderViewHostManager::OnCrossSiteNavigationCanceled() {
@@ skipping 321 matching lines @@
   return render_view_host_;
 }
 
 void RenderViewHostManager::CancelPending() {
   RenderViewHost* pending_render_view_host = pending_render_view_host_;
   pending_render_view_host_ = NULL;
   pending_render_view_host->Shutdown();
 
   pending_dom_ui_.reset();
 }