Send a subtree of same-process PageStates for back/forward child frames.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 3226 matching lines @@
                                       suggested_name));
   } else {
     OpenURL(request.url(), IsHttpPost(request),
             GetRequestBodyForWebURLRequest(request),
             GetWebURLRequestHeaders(request), referrer, policy,
             should_replace_current_entry, false);
   }
 }
 
 blink::WebHistoryItem RenderFrameImpl::historyItemForNewChildFrame() {
-  // OOPIF enabled modes will punt this navigation to the browser in
-  // decidePolicyForNavigation.
-  if (SiteIsolationPolicy::UseSubframeNavigationEntries())
+  if (SiteIsolationPolicy::UseSubframeNavigationEntries()) {
+    // Check whether the browser process provided a history item to use for this
+    // new frame.  If not, return an empty WebHistoryItem and check with the
+    // browser process in decidePolicyForNavigation.
+    const std::string& unique_name = frame_->uniqueName().utf8();
+    const auto& iter = render_view_->history_page_states_.find(unique_name);
+    if (iter != render_view_->history_page_states_.end()) {
+      const PageState& page_state = iter->second;
+      // If the PageState is non-empty, use it as the history item to load.  If
+      // it is empty, it represents a cross-process history item.  We'll ask the
+      // browser process to handle it in decidePolicyForNavigation.
+      if (page_state.IsValid()) {
+        std::unique_ptr<HistoryEntry> entry =
+            PageStateToHistoryEntry(page_state);
+
+        // Erase the entry now that we've used it (unlike the empty PageState
+        // case).
+        render_view_->history_page_states_.erase(unique_name);
+
+        return entry->root();
+      }
+    }
+
     return WebHistoryItem();
+  }
 
   return render_view_->history_controller()->GetItemForNewChildFrame(this);
 }
 
 void RenderFrameImpl::willSendSubmitEvent(const blink::WebFormElement& form) {
   for (auto& observer : observers_)
     observer.WillSendSubmitEvent(form);
 }
 
 void RenderFrameImpl::willSubmitForm(const blink::WebFormElement& form) {
@@ skipping 1715 matching lines @@
   // PlzNavigate: the browser is responsible for knowing the start of all
   // non-synchronous navigations.
   if (!IsBrowserSideNavigationEnabled() || !to_different_document)
     Send(new FrameHostMsg_DidStartLoading(routing_id_, to_different_document));
 }
 
 void RenderFrameImpl::didStopLoading() {
   TRACE_EVENT1("navigation,rail", "RenderFrameImpl::didStopLoading",
                "id", routing_id_);
 
-  // Any subframes created after this point won't be considered part of the
-  // current history navigation (if this was one), so we don't need to track
-  // this state anymore.
-  history_subframe_unique_names_.clear();
-
   render_view_->FrameDidStopLoading(frame_);
   Send(new FrameHostMsg_DidStopLoading(routing_id_));
 }
 
 void RenderFrameImpl::didChangeLoadProgress(double load_progress) {
   Send(new FrameHostMsg_DidChangeLoadProgress(routing_id_, load_progress));
 }
 
 void RenderFrameImpl::HandleWebAccessibilityEvent(
     const blink::WebAXObject& obj, blink::WebAXEvent event) {
@@ skipping 146 matching lines @@
   if (is_content_initiated && IsTopLevelNavigation(frame_) &&
       render_view_->renderer_preferences_
           .browser_handles_all_top_level_requests) {
     OpenURL(url, IsHttpPost(info.urlRequest),
             GetRequestBodyForWebURLRequest(info.urlRequest),
             GetWebURLRequestHeaders(info.urlRequest), referrer,
             info.defaultPolicy, info.replacesCurrentHistoryItem, false);
     return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
   }
 
-  // In OOPIF-enabled modes, back/forward navigations in newly created subframes
-  // should be sent to the browser if there is a matching FrameNavigationEntry,
-  // and if it isn't just staying at about:blank.  If this frame isn't in the
-  // map of unique names that have history items, or if it's staying at the
-  // initial about:blank URL, fall back to loading the default url.  (We remove
-  // each name as we encounter it, because it will only be used once as the
-  // frame is created.)
+  // Back/forward navigations in newly created subframes should be sent to the
+  // browser process if there is a matching unique name in the PageState map but
+  // the PageState is empty.  This is a signal that the browser process has a
+  // FrameNavigationEntry for it but that it will load in a different process.
+  // We remove each name as we encounter it, because it will only be used once
+  // as the frame is created.
+  //
+  // If this frame isn't in the map (or has already been removed during
+  // historyItemForNewChildFrame), allow the navigation to continue.  For frames
+  // that were never in the map, this effectively falls back to loading the
+  // default URL for the frame.
   if (SiteIsolationPolicy::UseSubframeNavigationEntries() &&
       info.isHistoryNavigationInNewChildFrame && is_content_initiated &&
       frame_->parent()) {
-    // Check whether the browser has a history item for this frame that isn't
-    // just staying at the initial about:blank document.
+    // Check whether the browser process sent an empty PageState for this frame,
+    // indicating that it should load in a different process.
     bool should_ask_browser = false;
-    RenderFrameImpl* parent = RenderFrameImpl::FromWebFrame(frame_->parent());
-    const auto& iter = parent->history_subframe_unique_names_.find(
-        frame_->uniqueName().utf8());
-    if (iter != parent->history_subframe_unique_names_.end()) {
-      bool history_item_is_about_blank = iter->second;
-      should_ask_browser =
-          !history_item_is_about_blank || url != url::kAboutBlankURL;
-      parent->history_subframe_unique_names_.erase(frame_->uniqueName().utf8());
+    const std::string& unique_name = frame_->uniqueName().utf8();
+    const auto& iter = render_view_->history_page_states_.find(unique_name);
+    if (iter != render_view_->history_page_states_.end()) {
+      const PageState& page_state = iter->second;
+
+      // If the PageState were valid, we should have used and removed it in
+      // historyItemForNewChildFrame.
+      DCHECK(!page_state.IsValid());
+
+      should_ask_browser = !page_state.IsValid();
+      render_view_->history_page_states_.erase(unique_name);
     }
 
     if (should_ask_browser) {
       // Don't do this if |info| also says it is a client redirect, in which
       // case JavaScript on the page is trying to interrupt the history
       // navigation.
       if (!info.isClientRedirect) {
         OpenURL(url, IsHttpPost(info.urlRequest),
                 GetRequestBodyForWebURLRequest(info.urlRequest),
                 GetWebURLRequestHeaders(info.urlRequest), referrer,
@@ skipping 632 matching lines @@
         item_for_history_navigation = entry->root();
         history_load_type = request_params.is_same_document_history_load
                                 ? blink::WebHistorySameDocumentLoad
                                 : blink::WebHistoryDifferentDocumentLoad;
         load_type = request_params.is_history_navigation_in_new_child
                         ? blink::WebFrameLoadType::InitialHistoryLoad
                         : blink::WebFrameLoadType::BackForward;
         should_load_request = true;
 
         // Keep track of which subframes the browser process has history items
-        // for during a history navigation.
-        history_subframe_unique_names_ = request_params.subframe_unique_names;
+        // for during a history navigation (in addition to any existing ones,
+        // overwriting any stale entries).
+        for (const auto& iter : request_params.subtree_page_states)
+          render_view_->history_page_states_[iter.first] = iter.second;
 
         if (history_load_type == blink::WebHistorySameDocumentLoad) {
           // If this is marked as a same document load but we haven't committed
           // anything, treat it as a new load.  The browser shouldn't let this
           // happen.
           if (current_history_item_.isNull()) {
             history_load_type = blink::WebHistoryDifferentDocumentLoad;
             NOTREACHED();
           } else {
             // Additionally, if the |current_history_item_|'s document
@@ skipping 839 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content