[DevTools] Fix a couple of issues for cross-site RFDTAH, add a test.

content/browser/devtools/render_frame_devtools_agent_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 
 #include <tuple>
 #include <utility>
 
 #include "base/guid.h"
@@ skipping 551 matching lines @@
 RenderFrameDevToolsAgentHost::~RenderFrameDevToolsAgentHost() {
   Instances::iterator it = std::find(g_instances.Get().begin(),
                                      g_instances.Get().end(),
                                      this);
   if (it != g_instances.Get().end())
     g_instances.Get().erase(it);
 }
 
 void RenderFrameDevToolsAgentHost::ReadyToCommitNavigation(
     NavigationHandle* navigation_handle) {
+  // CommitPending may destruct |this|.
+  scoped_refptr<RenderFrameDevToolsAgentHost> protect(this);
+
   // TODO(clamy): Switch RenderFrameDevToolsAgentHost to always buffer messages
   // until ReadyToCommitNavigation is called, now that it is also called in
   // non-PlzNavigate mode.
   if (!IsBrowserSideNavigationEnabled())
     return;
 
   // If the navigation is not tracked, return;
   if (navigating_handles_.count(navigation_handle) == 0)
     return;
 
   RenderFrameHostImpl* render_frame_host_impl =
       static_cast<RenderFrameHostImpl*>(
           navigation_handle->GetRenderFrameHost());
   if (current_->host() != render_frame_host_impl || current_frame_crashed_) {
     SetPending(render_frame_host_impl);
     pending_handle_ = navigation_handle;
     // Commit when navigating the same frame after crash, avoiding the same
     // host in current_ and pending_.
     if (current_->host() == render_frame_host_impl) {
       pending_handle_ = nullptr;
       CommitPending();
     }
   }
   DCHECK(CheckConsistency());
 }
 
 void RenderFrameDevToolsAgentHost::DidFinishNavigation(
     NavigationHandle* navigation_handle) {
+  // CommitPending may destruct |this|.
+  scoped_refptr<RenderFrameDevToolsAgentHost> protect(this);
+
   if (!IsBrowserSideNavigationEnabled())
     return;
 
   // If the navigation is not tracked, return;
   if (navigating_handles_.count(navigation_handle) == 0)
     return;
 
   // Now that the navigation is finished, remove the handle from the list of
   // navigating handles.
   navigating_handles_.erase(navigation_handle);
@@ skipping 12 matching lines @@
   DispatchBufferedProtocolMessagesIfNecessary();
 
   DCHECK(CheckConsistency());
   if (navigation_handle->HasCommitted())
     target_handler_->UpdateServiceWorkers();
 }
 
 void RenderFrameDevToolsAgentHost::AboutToNavigateRenderFrame(
     RenderFrameHost* old_host,
     RenderFrameHost* new_host) {
+  // CommitPending may destruct |this|.
+  scoped_refptr<RenderFrameDevToolsAgentHost> protect(this);
+
   if (IsBrowserSideNavigationEnabled())
     return;
 
   DCHECK(!pending_ || pending_->host() != old_host);
   if (!current_ || current_->host() != old_host) {
     DCHECK(CheckConsistency());
     return;
   }
   if (old_host == new_host && !current_frame_crashed_) {
     DCHECK(CheckConsistency());
@@ skipping 13 matching lines @@
   if (!IsBrowserSideNavigationEnabled())
     return;
   DCHECK(current_);
   navigating_handles_.insert(navigation_handle);
   DCHECK(CheckConsistency());
 }
 
 void RenderFrameDevToolsAgentHost::RenderFrameHostChanged(
     RenderFrameHost* old_host,
     RenderFrameHost* new_host) {
+  // CommitPending may destruct |this|.
+  scoped_refptr<RenderFrameDevToolsAgentHost> protect(this);
+
   target_handler_->UpdateFrames();
 
   if (IsBrowserSideNavigationEnabled())
     return;
 
   DCHECK(!pending_ || pending_->host() != old_host);
   if (!current_ || current_->host() != old_host) {
     DCHECK(CheckConsistency());
     return;
   }
@@ skipping 137 matching lines @@
 
 void RenderFrameDevToolsAgentHost::DidDetachInterstitialPage() {
   if (page_handler_)
     page_handler_->DidDetachInterstitialPage();
 }
 
 void RenderFrameDevToolsAgentHost::DidCommitProvisionalLoadForFrame(
     RenderFrameHost* render_frame_host,
     const GURL& url,
     ui::PageTransition transition_type) {
+  // CommitPending may destruct |this|.
+  scoped_refptr<RenderFrameDevToolsAgentHost> protect(this);
+
   if (IsBrowserSideNavigationEnabled())
     return;
   if (pending_ && pending_->host() == render_frame_host)
     CommitPending();
   DCHECK(CheckConsistency());
   target_handler_->UpdateServiceWorkers();
 }
 
 void RenderFrameDevToolsAgentHost::DidFailProvisionalLoad(
     RenderFrameHost* render_frame_host,
@@ skipping 59 matching lines @@
   disconnected_ = std::move(current_);
   disconnected_->Detach();
   frame_tree_node_ = nullptr;
   in_navigation_protocol_message_buffer_.clear();
   navigating_handles_.clear();
   pending_handle_ = nullptr;
   WebContentsObserver::Observe(nullptr);
 }
 
 void RenderFrameDevToolsAgentHost::ConnectWebContents(WebContents* wc) {
+  // CommitPending may destruct |this|.
+  scoped_refptr<RenderFrameDevToolsAgentHost> protect(this);
+
   DCHECK(!current_);
   DCHECK(!pending_);
   RenderFrameHostImpl* host =
       static_cast<RenderFrameHostImpl*>(wc->GetMainFrame());
   DCHECK(host);
   frame_tree_node_ = host->frame_tree_node();
   current_ = std::move(disconnected_);
   SetPending(host);
   CommitPending();
   WebContentsObserver::Observe(WebContents::FromRenderFrameHost(host));
@@ skipping 12 matching lines @@
   if (!contents)
     return "";
   contents = contents->GetOuterWebContents();
   if (contents)
     return DevToolsAgentHost::GetOrCreateFor(contents)->GetId();
   return "";
 }
 
 std::string RenderFrameDevToolsAgentHost::GetType() {
   DevToolsManager* manager = DevToolsManager::GetInstance();
-  if (manager->delegate())
-    return manager->delegate()->GetTargetType(current_->host());
+  if (manager->delegate() && current_) {
+    std::string result = manager->delegate()->GetTargetType(current_->host());
+    if (!result.empty())
+      return result;
+  }
   if (IsChildFrame())
     return kTypeFrame;
   return kTypePage;
 }
 
 std::string RenderFrameDevToolsAgentHost::GetTitle() {
   DevToolsManager* manager = DevToolsManager::GetInstance();
-  std::string result;
-  if (manager->delegate())
-    result = manager->delegate()->GetTargetTitle(current_->host());
-  if (!result.empty())
-    return result;
+  if (manager->delegate() && current_) {
+    std::string result = manager->delegate()->GetTargetTitle(current_->host());
+    if (!result.empty())
+      return result;
+  }
   content::WebContents* web_contents = GetWebContents();
   if (web_contents)
-    result = base::UTF16ToUTF8(web_contents->GetTitle());
+    return base::UTF16ToUTF8(web_contents->GetTitle());
   return GetURL().spec();
 }
 
 std::string RenderFrameDevToolsAgentHost::GetDescription() {
   DevToolsManager* manager = DevToolsManager::GetInstance();
-  if (manager->delegate())
+  if (manager->delegate() && current_)
     return manager->delegate()->GetTargetDescription(current_->host());
   return "";
 }
 
 GURL RenderFrameDevToolsAgentHost::GetURL() {
   // Order is important here.
   WebContents* web_contents = GetWebContents();
   if (web_contents && !IsChildFrame())
     return web_contents->GetVisibleURL();
   if (pending_)
@@ skipping 107 matching lines @@
     RenderFrameHost* host) {
   return (current_ && current_->host() == host) ||
       (pending_ && pending_->host() == host);
 }
 
 bool RenderFrameDevToolsAgentHost::IsChildFrame() {
   return current_ && current_->host()->GetParent();
 }
 
 }  // namespace content