Check BrowsingInstance before swapping prerenders.

chrome/browser/prerender/prerender_manager.cc

Index: chrome/browser/prerender/prerender_manager.cc
diff --git a/chrome/browser/prerender/prerender_manager.cc b/chrome/browser/prerender/prerender_manager.cc
index d98a175f99057315f711de6eb49c483cc5481b7c..a0cb533c78189c822f9e647f2d16eca5d48fc221 100644
--- a/chrome/browser/prerender/prerender_manager.cc
+++ b/chrome/browser/prerender/prerender_manager.cc
@@ -58,6 +58,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/session_storage_namespace.h"
+#include "content/public/browser/site_instance.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_view.h"
@@ -128,7 +129,8 @@ bool NeedMatchCompleteDummyForFinalStatus(FinalStatus final_status) {
       final_status != FINAL_STATUS_DEVTOOLS_ATTACHED &&
       final_status != FINAL_STATUS_CROSS_SITE_NAVIGATION_PENDING &&
       final_status != FINAL_STATUS_PAGE_BEING_CAPTURED &&
-      final_status != FINAL_STATUS_NAVIGATION_UNCOMMITTED;
+      final_status != FINAL_STATUS_NAVIGATION_UNCOMMITTED &&
+      final_status != FINAL_STATUS_NON_EMPTY_BROWSING_INSTANCE;
 }
 
 void CheckIfCookiesExistForDomainResultOnUIThread(
@@ -529,6 +531,16 @@ WebContents* PrerenderManager::SwapInternal(
     }
   }
 
+  // Do not swap if the target WebContents is not the only WebContents in its
+  // current BrowsingInstance.
+  if (web_contents->GetSiteInstance()->GetRelatedActiveContentsCount() != 1u) {

[davidben, 2014/04/28 18:34:39]

Would we ever have a WebContents where a frame is in a different
BrowsingInstance than the top-level?

[Charlie Reis, 2014/04/29 00:48:06]

Let me chat with Nasko about this.  I'd like to say no, because (barring
<webview> tags) subframes can always have a reference to the other window
objects in their frame tree.  That said, we usually put extensions in a
different browsing instance than web pages, and extensions can have web iframes.
 One of those will have to give.

[davidben, 2014/04/29 17:01:25]

Well, if this does end up happening, probably this should switch from a
WebContents count on the SiteInstance to an RFH count, probably managed by RFHM.
Then the condition for swap should be:

1. All RFH's for this WC have related SI's.
2. The SI's related RFH count should equal the number of RFH's in the WC.

[Charlie Reis, 2014/04/29 17:31:08]

Let's assume that it won't happen, apart from <webview> tags where the subframe
thinks it's a top-level page and (at least in our current design) will have its
own WebContents.

The extension issue requires some investigation of whether postMessage is
allowed when an extension page loads a web page via window.open or an iframe, or
vice versa.  Perhaps we should just leave it in the same BrowsingInstance.

+    DCHECK_GT(
+        web_contents->GetSiteInstance()->GetRelatedActiveContentsCount(), 1u);
+    prerender_data->contents()->Destroy(
+        FINAL_STATUS_NON_EMPTY_BROWSING_INSTANCE);
+    return NULL;
+  }
+
   // Do not use the prerendered version if there is an opener object.
   if (web_contents->HasOpener()) {
     prerender_data->contents()->Destroy(FINAL_STATUS_WINDOW_OPENER);