Fix RenderView reuse issues after a pending RenderFrameHost dies.

content/browser/site_per_process_browsertest.cc

Index: content/browser/site_per_process_browsertest.cc
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 5ec546b2435cbce6616c97a18d0ca2c4c88bb0d2..89a30a7cc81a7d1ab361171ac7124342b40967a2 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -7648,4 +7648,120 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessGestureBrowserTest,
 }
 #endif
 
+// Test for https://crbug.com/627400, where reusing a top-level pending

[nasko, 2016/08/09 18:32:32]

nit: Let's say what the test is testing without the bug itself, then later you
can add it as "See https...." for more details.

[alexmos, 2016/08/09 23:09:46]

Done for both tests.

+// RenderFrameHost which is not live was hitting a CHECK in CreateRenderView
+// due to having neither a main frame routing ID nor a proxy routing ID.  With
+// the fix, the pending RFH should be canceled and destroyed when its process
+// dies.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       PendingRFHIsCanceledWhenItsProcessDies) {
+  GURL main_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+
+  // Open a popup at b.com.
+  GURL popup_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  Shell* popup_shell = OpenPopup(root, popup_url, "foo");
+  EXPECT_TRUE(popup_shell);
+
+  // The RenderViewHost for b.com in the main tab should be swapped-out.

[nasko, 2016/08/09 18:32:32]

nit: s/swapped-out/not active/, especially since that is the method called in
the expectation macro.

[alexmos, 2016/08/09 23:09:46]

Done (here and below)

+  SiteInstance* b_instance = popup_shell->web_contents()->GetSiteInstance();
+  RenderViewHostImpl* rvh =
+      web_contents()->GetFrameTree()->GetRenderViewHost(b_instance);
+  EXPECT_FALSE(rvh->is_active());
+
+  // Navigate main tab to a b.com URL that will not commit.
+  GURL stall_url(embedded_test_server()->GetURL("b.com", "/title2.html"));
+  NavigationStallDelegate stall_delegate(stall_url);

[nasko, 2016/08/09 18:32:32]

Let's start using the TestNavigationManager manager class, as it will be the one
to rule them all : ). Just don't call any of the wait methods and it will be
blocked forever ;).

[alexmos, 2016/08/09 23:09:46]

Done.

+  ResourceDispatcherHost::Get()->SetDelegate(&stall_delegate);
+  shell()->LoadURL(stall_url);
+
+  // The pending RFH should be in the same process as the popup.
+  RenderFrameHostImpl* pending_rfh =
+      IsBrowserSideNavigationEnabled()
+          ? root->render_manager()->speculative_frame_host()
+          : root->render_manager()->pending_frame_host();
+  RenderProcessHost* pending_process = pending_rfh->GetProcess();
+  EXPECT_EQ(pending_process,
+            popup_shell->web_contents()->GetMainFrame()->GetProcess());
+
+  // Kill the b.com process, currently in use by the pending RenderFrameHost
+  // and the popup.
+  RenderProcessHostWatcher crash_observer(
+      pending_process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  EXPECT_TRUE(pending_process->Shutdown(0, false));
+  crash_observer.Wait();
+  ResourceDispatcherHost::Get()->SetDelegate(nullptr);
+
+  // The pending RFH should have been canceled and destroyed, so that it won't
+  // be reused while it's not live in the next navigation.
+  {
+    RenderFrameHostImpl* pending_rfh =
+        IsBrowserSideNavigationEnabled()
+            ? root->render_manager()->speculative_frame_host()
+            : root->render_manager()->pending_frame_host();
+    EXPECT_FALSE(pending_rfh);
+  }
+
+  // Navigate main tab to b.com again.  This should not crash.
+  GURL b_url(embedded_test_server()->GetURL("b.com", "/title3.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), b_url));
+
+  // The b.com RVH in the main tab should become active.
+  EXPECT_TRUE(rvh->is_active());
+}
+
+// Test for https://crbug.com/627893, where killing a pending RenderFrameHost's
+// process left an existing RenderViewHost confused whether it's swapped out or
+// not for future navigations that try to reuse it.  Similar to the test
+// above for https://crbug.com/627400, except the popup is navigated after
+// pending RFH's process is killed, rather than the main tab.

[nasko, 2016/08/09 18:32:32]

Since so much code is common between the two tests, is it worthwhile factoring
it out into a common function and calling it?

[alexmos, 2016/08/09 23:09:46]

Leaving this as-is per the discussion on chat.

+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       RenderViewHostKeepsSwappedOutStateIfPendingRFHDies) {
+  GURL main_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+
+  // Open a popup at b.com.
+  GURL popup_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  Shell* popup_shell = OpenPopup(root, popup_url, "foo");
+  EXPECT_TRUE(popup_shell);
+
+  // The RenderViewHost for b.com in the main tab should be swapped-out.
+  SiteInstance* b_instance = popup_shell->web_contents()->GetSiteInstance();
+  RenderViewHostImpl* rvh =
+      web_contents()->GetFrameTree()->GetRenderViewHost(b_instance);
+  EXPECT_FALSE(rvh->is_active());
+
+  // Navigate main tab to a b.com URL that will not commit.
+  GURL stall_url(embedded_test_server()->GetURL("b.com", "/title2.html"));
+  NavigationStallDelegate stall_delegate(stall_url);
+  ResourceDispatcherHost::Get()->SetDelegate(&stall_delegate);
+  shell()->LoadURL(stall_url);
+
+  // Kill the b.com process, currently in use by the pending RenderFrameHost
+  // and the popup.
+  RenderProcessHost* pending_process =
+      popup_shell->web_contents()->GetMainFrame()->GetProcess();
+  RenderProcessHostWatcher crash_observer(
+      pending_process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  EXPECT_TRUE(pending_process->Shutdown(0, false));
+  crash_observer.Wait();
+  ResourceDispatcherHost::Get()->SetDelegate(nullptr);
+
+  // Since the navigation above didn't commit, the b.com RenderViewHost in the
+  // main tab should still be swapped out.
+  EXPECT_FALSE(rvh->is_active());
+
+  // Navigate popup to b.com to recreate the b.com process.  When creating
+  // opener proxies, |rvh| should be reused as a swapped out RVH.  In
+  // https://crbug.com/627893, recreating the opener RenderView was hitting a
+  // CHECK(params.swapped_out) in the renderer process, since its
+  // RenderViewHost was brought into an active state by the navigation to
+  // |stall_url| above, even though it never committed.
+  GURL b_url(embedded_test_server()->GetURL("b.com", "/title3.html"));
+  EXPECT_TRUE(NavigateToURL(popup_shell, b_url));
+  EXPECT_FALSE(rvh->is_active());
+}
+
 }  // namespace content