Notify the renderer if a history navigation has no subframe items.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 1025 matching lines @@
 
 // RenderFrameImpl ----------------------------------------------------------
 RenderFrameImpl::RenderFrameImpl(const CreateParams& params)
     : frame_(NULL),
       is_main_frame_(true),
       in_browser_initiated_detach_(false),
       in_frame_tree_(false),
       render_view_(params.render_view->AsWeakPtr()),
       routing_id_(params.routing_id),
       proxy_routing_id_(MSG_ROUTING_NONE),
+      browser_has_subtree_history_items_(false),

[alexmos, 2016/09/22 01:44:06]

I was thinking whether "true" might be a safer default, given that the previous
behavior was to always ask the browser.  But I guess it's doesn't really matter
given that this will always be set for history navigations before any child
frames are created.

[Charlie Reis, 2016/09/22 21:00:37]

Right.  I think this is a smaller delta from where we're heading, when the
browser will tell us exactly which frame unique names it should be consulted for
during a history navigation.

 #if defined(ENABLE_PLUGINS)
       plugin_power_saver_helper_(nullptr),
       plugin_find_handler_(nullptr),
 #endif
       cookie_jar_(this),
       selection_text_offset_(0),
       selection_range_(gfx::Range::InvalidRange()),
       handling_select_range_(false),
       web_user_media_client_(NULL),
 #if defined(OS_ANDROID)
@@ skipping 110 matching lines @@
 
   frame_ = web_frame;
 }
 
 void RenderFrameImpl::Initialize() {
   is_main_frame_ = !frame_->parent();
 
   RenderFrameImpl* parent_frame = RenderFrameImpl::FromWebFrame(
       frame_->parent());
   if (parent_frame) {
+    // Inherit knowledge of whether we need to consult the browser process for
+    // a history item on the first navigation.  This is inherited by further
+    // subframes and cleared at didStopLoading.
+    browser_has_subtree_history_items_ =
+        parent_frame->browser_has_subtree_history_items_;
     is_using_lofi_ = parent_frame->IsUsingLoFi();
     effective_connection_type_ = parent_frame->getEffectiveConnectionType();
   }
 
   bool is_tracing_rail = false;
   bool is_tracing_navigation = false;
   TRACE_EVENT_CATEGORY_GROUP_ENABLED("navigation", &is_tracing_navigation);
   TRACE_EVENT_CATEGORY_GROUP_ENABLED("rail", &is_tracing_rail);
   if (is_tracing_rail || is_tracing_navigation) {
     int parent_id = GetRoutingIdForFrameOrProxy(frame_->parent());
@@ skipping 3641 matching lines @@
 
   // PlzNavigate: the browser is responsible for knowing the start of all
   // non-synchronous navigations.
   if (!IsBrowserSideNavigationEnabled() || !to_different_document)
     Send(new FrameHostMsg_DidStartLoading(routing_id_, to_different_document));
 }
 
 void RenderFrameImpl::didStopLoading() {
   TRACE_EVENT1("navigation,rail", "RenderFrameImpl::didStopLoading",
                "id", routing_id_);
+
+  // Any subframes created after this point won't be considered part of the
+  // current history navigation (if this was one), so we don't need to track
+  // this state anymore.
+  browser_has_subtree_history_items_ = false;

[alexmos, 2016/09/22 01:44:06]

This will be reset in all frames, since main frames and subframes all will
eventually fire didStopLoading(), right?  What if we have a main frame with a
subframe, the subframe finishes loading and then creates a new (grandchild)
frame while the main frame hasn't finished loading?  The grandchild is not
considered part of the current history navigation, right?

[Charlie Reis, 2016/09/22 21:00:37]

Exactly.  The newly created child frame checks to see if its parent is still
loading before trying to find a history item for itself.  See this comment/code
in FrameLoaderClientImpl for where it happens:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/web/FrameLoade...

As a side note, didStopLoading happens bottom up.  A frame won't hear it until
all of its subframes are done, so it's possible for the main frame to keep its
bit around much longer than children/grandchildren.

+
   render_view_->FrameDidStopLoading(frame_);
   Send(new FrameHostMsg_DidStopLoading(routing_id_));
 }
 
 void RenderFrameImpl::didChangeLoadProgress(double load_progress) {
   Send(new FrameHostMsg_DidChangeLoadProgress(routing_id_, load_progress));
 }
 
 void RenderFrameImpl::HandleWebAccessibilityEvent(
     const blink::WebAXObject& obj, blink::WebAXEvent event) {
@@ skipping 124 matching lines @@
   if (is_content_initiated && IsTopLevelNavigation(frame_) &&
       render_view_->renderer_preferences_
           .browser_handles_all_top_level_requests) {
     OpenURL(url, IsHttpPost(info.urlRequest),
             GetRequestBodyForWebURLRequest(info.urlRequest), referrer,
             info.defaultPolicy, info.replacesCurrentHistoryItem, false);
     return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
   }
 
   // In OOPIF-enabled modes, back/forward navigations in newly created subframes
-  // should be sent to the browser in case there is a matching
-  // FrameNavigationEntry.  If none is found, fall back to the default url.
+  // should be sent to the browser if there is a chance there is a matching
+  // FrameNavigationEntry.  If none is found (or if the browser has indicated it
+  // has no subtree history items), fall back to loading the default url.
   if (SiteIsolationPolicy::UseSubframeNavigationEntries() &&
-      info.isHistoryNavigationInNewChildFrame && is_content_initiated) {
+      info.isHistoryNavigationInNewChildFrame && is_content_initiated &&
+      browser_has_subtree_history_items_) {
     // Don't do this if |info| also says it is a client redirect, in which case
     // JavaScript on the page is trying to interrupt the history navigation.
     if (!info.isClientRedirect) {
       OpenURL(url, IsHttpPost(info.urlRequest),
               GetRequestBodyForWebURLRequest(info.urlRequest), referrer,
               info.defaultPolicy, info.replacesCurrentHistoryItem, true);
       // Suppress the load in Blink but mark the frame as loading.
       return blink::WebNavigationPolicyHandledByClient;
     } else {
       // Client redirects during an initial history load should attempt to
@@ skipping 575 matching lines @@
         // PageState.
         item_for_history_navigation = entry->root();
         history_load_type = request_params.is_same_document_history_load
                                 ? blink::WebHistorySameDocumentLoad
                                 : blink::WebHistoryDifferentDocumentLoad;
         load_type = request_params.is_history_navigation_in_new_child
                         ? blink::WebFrameLoadType::InitialHistoryLoad
                         : blink::WebFrameLoadType::BackForward;
         should_load_request = true;
 
+        // Remember whether we should consult the browser process for any
+        // subframes created during this history navigation.
+        browser_has_subtree_history_items_ =
+            request_params.has_subtree_history_items;
+
         if (history_load_type == blink::WebHistorySameDocumentLoad) {
           // If this is marked as a same document load but we haven't committed
           // anything, treat it as a new load.  The browser shouldn't let this
           // happen.
           if (current_history_item_.isNull()) {
             history_load_type = blink::WebHistoryDifferentDocumentLoad;
             NOTREACHED();
           } else {
             // Additionally, if the |current_history_item_|'s document
             // sequence number doesn't match the one sent from the browser, it
@@ skipping 808 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content