Check BrowsingInstance before swapping prerenders.

chrome/browser/prerender/prerender_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/prerender/prerender_manager.h"
 
 #include <algorithm>
 #include <functional>
 #include <string>
 #include <vector>
@@ skipping 40 matching lines @@
 #include "chrome/common/prerender_types.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/devtools_agent_host.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/session_storage_namespace.h"
+#include "content/public/browser/site_instance.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_view.h"
 #include "content/public/common/url_constants.h"
 #include "extensions/common/constants.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 
 using content::BrowserThread;
@@ skipping 50 matching lines @@
       final_status != FINAL_STATUS_TIMED_OUT &&
       final_status != FINAL_STATUS_MANAGER_SHUTDOWN &&
       final_status != FINAL_STATUS_PROFILE_DESTROYED &&
       final_status != FINAL_STATUS_APP_TERMINATING &&
       final_status != FINAL_STATUS_WINDOW_OPENER &&
       final_status != FINAL_STATUS_CACHE_OR_HISTORY_CLEARED &&
       final_status != FINAL_STATUS_CANCELLED &&
       final_status != FINAL_STATUS_DEVTOOLS_ATTACHED &&
       final_status != FINAL_STATUS_CROSS_SITE_NAVIGATION_PENDING &&
       final_status != FINAL_STATUS_PAGE_BEING_CAPTURED &&
-      final_status != FINAL_STATUS_NAVIGATION_UNCOMMITTED;
+      final_status != FINAL_STATUS_NAVIGATION_UNCOMMITTED &&
+      final_status != FINAL_STATUS_NON_EMPTY_BROWSING_INSTANCE;
 }
 
 void CheckIfCookiesExistForDomainResultOnUIThread(
     const net::CookieMonster::HasCookiesForETLDP1Callback& callback,
     bool cookies_exist) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   callback.Run(cookies_exist);
 }
 
 void CheckIfCookiesExistForDomainResultOnIOThread(
@@ skipping 380 matching lines @@
     // there is a pending entry, it may not commit.
     // TODO(creis): If there is a pending navigation and no last committed
     // entry, we might be able to transfer the network request instead.
     if (!new_web_contents->GetController().CanPruneAllButLastCommitted()) {
       // Abort this prerender so it is not used later. http://crbug.com/292121
       prerender_data->contents()->Destroy(FINAL_STATUS_NAVIGATION_UNCOMMITTED);
       return NULL;
     }
   }
 
+  // Do not swap if the target WebContents is not the only WebContents in its
+  // current BrowsingInstance.
+  if (web_contents->GetSiteInstance()->GetRelatedActiveContentsCount() != 1u) {

[davidben, 2014/04/28 18:34:39]

Would we ever have a WebContents where a frame is in a different
BrowsingInstance than the top-level?

[Charlie Reis, 2014/04/29 00:48:06]

Let me chat with Nasko about this.  I'd like to say no, because (barring
<webview> tags) subframes can always have a reference to the other window
objects in their frame tree.  That said, we usually put extensions in a
different browsing instance than web pages, and extensions can have web iframes.
 One of those will have to give.

[davidben, 2014/04/29 17:01:25]

Well, if this does end up happening, probably this should switch from a
WebContents count on the SiteInstance to an RFH count, probably managed by RFHM.
Then the condition for swap should be:

1. All RFH's for this WC have related SI's.
2. The SI's related RFH count should equal the number of RFH's in the WC.

[Charlie Reis, 2014/04/29 17:31:08]

Let's assume that it won't happen, apart from <webview> tags where the subframe
thinks it's a top-level page and (at least in our current design) will have its
own WebContents.

The extension issue requires some investigation of whether postMessage is
allowed when an extension page loads a web page via window.open or an iframe, or
vice versa.  Perhaps we should just leave it in the same BrowsingInstance.

+    DCHECK_GT(
+        web_contents->GetSiteInstance()->GetRelatedActiveContentsCount(), 1u);
+    prerender_data->contents()->Destroy(
+        FINAL_STATUS_NON_EMPTY_BROWSING_INSTANCE);
+    return NULL;
+  }
+
   // Do not use the prerendered version if there is an opener object.
   if (web_contents->HasOpener()) {
     prerender_data->contents()->Destroy(FINAL_STATUS_WINDOW_OPENER);
     return NULL;
   }
 
   // Do not swap in the prerender if the current WebContents is being captured.
   if (web_contents->GetCapturerCount() > 0) {
     prerender_data->contents()->Destroy(FINAL_STATUS_PAGE_BEING_CAPTURED);
     return NULL;
@@ skipping 1280 matching lines @@
   histograms_->RecordNetworkBytes(used, prerender_bytes, recent_profile_bytes);
 }
 
 void PrerenderManager::AddProfileNetworkBytesIfEnabled(int64 bytes) {
   DCHECK_GE(bytes, 0);
   if (IsEnabled() && ActuallyPrerendering())
     profile_network_bytes_ += bytes;
 }
 
 }  // namespace prerender