PlzNavigate: identify same-page browser-initiated navigation.

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 1155 matching lines @@
                                   ? determineFrameLoadType(request)
                                   : frameLoadType;
   bool sameDocumentHistoryNavigation =
       isBackForwardLoadType(newLoadType) &&
       historyLoadType == HistorySameDocumentLoad;
   bool sameDocumentNavigation =
       policy == NavigationPolicyCurrentTab &&
       shouldPerformFragmentNavigation(request.form(),
                                       request.resourceRequest().httpMethod(),
                                       newLoadType, url);
-
   // Perform same document navigation.
   if (sameDocumentHistoryNavigation || sameDocumentNavigation) {
     DCHECK(historyItem || !sameDocumentHistoryNavigation);
     RefPtr<SerializedScriptValue> stateObject =
         sameDocumentHistoryNavigation ? historyItem->stateObject() : nullptr;
 
     if (!sameDocumentHistoryNavigation) {
       m_documentLoader->setNavigationType(determineNavigationType(
           newLoadType, false, request.triggeringEvent()));
       if (shouldTreatURLAsSameAsCurrent(url))
         newLoadType = FrameLoadTypeReplaceCurrentItem;
     }
 
     loadInSameDocument(url, stateObject, newLoadType, historyLoadType,
                        request.clientRedirect(), request.originDocument());
     return;
   }
 
+  // PlzNavigate
+  // If the loader classifies this navigation as a different document navigation
+  // while the browser intended the navigation to be same-document, it means
+  // that a different navigation must have committed while the IPC was sent.
+  // This navigation is no more same-document. The navigation is simply dropped.

[nasko, 2017/01/13 19:36:57]

Looking at the code in RenderFrameImpl::NavigateInternal, it should already
detect the race condition and should have changed the load type to be different
document. Why do we need to special case this case here at all?

[arthursonzogni, 2017/01/17 15:24:48]

It's because the response body stream is empty.
The browser wanted the navigation to be same-document. So no network response
was needed to navigate. The problem is that now, the renderer is not okay to do
a same-document navigation, so the main frame resource data is needed, but we
don't have it.

It's forbidden with PlzNavigate to request the main frame resource from the
renderer, so it will fail.

We can try several things from here:
 * Relaunch the navigation as if it was renderer-initiated  by writing
request.setCheckForBrowserSideNavigation(true). Nevertheless, there is a problem
when it's an history-navigation (they are always browser-initiated). The
PlzNavigate path through RenderFrameImpl::BeginNavigation doesn't allow
history-navigation.
 * Drop the navigation request.

[nasko, 2017/01/19 00:43:35]

How about JS executing "window.history.back()" or similar? Those are
renderer-initiated signals to the browser to do history navigation. Wouldn't it
be more correct to look like one of these?

[arthursonzogni, 2017/01/19 17:49:21]

For renderer-initiated history-navigation. The renderer send a
ViewHostMsg_GoToEntryAtOffset to the browser. Then it uses the browser-initiated
path.

+  if (request.resourceRequest().isSameDocumentNavigation())
+    return;
+
   startLoad(request, newLoadType, policy);
 }
 
 SubstituteData FrameLoader::defaultSubstituteDataForURL(const KURL& url) {
   if (!shouldTreatURLAsSrcdocDocument(url))
     return SubstituteData();
   String srcdoc = m_frame->deprecatedLocalOwner()->fastGetAttribute(srcdocAttr);
   DCHECK(!srcdoc.isNull());
   CString encodedSrcdoc = srcdoc.utf8();
   return SubstituteData(
@@ skipping 700 matching lines @@
                          m_documentLoader ? m_documentLoader->url() : String());
   return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }
 
 }  // namespace blink