Move HistoryItem handling to DocumentLoader

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 122 matching lines @@
     return;
   }
   if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(
           document->getSecurityOrigin()->protocol())) {
     return;
   }
   Deprecation::countDeprecation(
       document, UseCounter::LegacyProtocolEmbeddedAsSubresource);
 }
 
-// static
-ResourceRequest FrameLoader::resourceRequestFromHistoryItem(

[Nate Chapin, 2017/03/27 21:02:01]

Moved to HistoryItem, since it actually depends on HistoryItem.

-    HistoryItem* item,
-    WebCachePolicy cachePolicy) {
-  RefPtr<EncodedFormData> formData = item->formData();
-  ResourceRequest request(item->url());
-  request.setHTTPReferrer(item->referrer());
-  request.setCachePolicy(cachePolicy);
-  if (formData) {
-    request.setHTTPMethod(HTTPNames::POST);
-    request.setHTTPBody(formData);
-    request.setHTTPContentType(item->formContentType());
-    request.addHTTPOriginIfNeeded(item->referrer().referrer);
-  }
-  return request;
-}
-
 ResourceRequest FrameLoader::resourceRequestForReload(
     FrameLoadType frameLoadType,
     const KURL& overrideURL,
     ClientRedirectPolicy clientRedirectPolicy) {
   DCHECK(isReloadLoadType(frameLoadType));
   WebCachePolicy cachePolicy =
       frameLoadType == FrameLoadTypeReloadBypassingCache
           ? WebCachePolicy::BypassingCache
           : WebCachePolicy::ValidatingCacheData;
-  if (!m_currentItem)
+  if (!m_documentLoader || !m_documentLoader->historyItem())
     return ResourceRequest();
   ResourceRequest request =
-      resourceRequestFromHistoryItem(m_currentItem.get(), cachePolicy);
+      m_documentLoader->historyItem()->generateResourceRequest(cachePolicy);
 
   // ClientRedirectPolicy is an indication that this load was triggered by some
   // direct interaction with the page. If this reload is not a client redirect,
   // we should reuse the referrer from the original load of the current
   // document. If this reload is a client redirect (e.g., location.reload()), it
   // was initiated by something in the current document and should therefore
   // show the current document's url as the referrer.
   if (clientRedirectPolicy == ClientRedirectPolicy::ClientRedirect) {
     request.setHTTPReferrer(SecurityPolicy::generateReferrer(
         m_frame->document()->getReferrerPolicy(), m_frame->document()->url(),
@@ skipping 29 matching lines @@
 FrameLoader::~FrameLoader() {
   // Verify that this FrameLoader has been detached.
   DCHECK(!m_progressTracker);
 }
 
 DEFINE_TRACE(FrameLoader) {
   visitor->trace(m_frame);
   visitor->trace(m_progressTracker);
   visitor->trace(m_documentLoader);
   visitor->trace(m_provisionalDocumentLoader);
-  visitor->trace(m_currentItem);
-  visitor->trace(m_provisionalItem);
   visitor->trace(m_deferredHistoryLoad);
 }
 
 void FrameLoader::init() {
   ResourceRequest initialRequest(KURL(ParsedURLString, emptyString));
   initialRequest.setRequestContext(WebURLRequest::RequestContextInternal);
   initialRequest.setFrameType(m_frame->isMainFrame()
                                   ? WebURLRequest::FrameTypeTopLevel
                                   : WebURLRequest::FrameTypeNested);
   m_provisionalDocumentLoader =
@@ skipping 38 matching lines @@
            m_deferredHistoryLoad->m_item.get(),
            m_deferredHistoryLoad->m_historyLoadType);
       m_deferredHistoryLoad.clear();
     }
     m_frame->navigationScheduler().startTimer();
     scheduleCheckCompleted();
   }
 }
 
 void FrameLoader::saveScrollState() {
-  if (!m_currentItem || !m_frame->view())
+  if (!m_documentLoader || !m_documentLoader->historyItem() || !m_frame->view())
     return;
 
   // Shouldn't clobber anything if we might still restore later.
-  if (m_documentLoader &&
-      needsHistoryItemRestore(m_documentLoader->loadType()) &&
+  if (needsHistoryItemRestore(m_documentLoader->loadType()) &&
       !m_documentLoader->initialScrollState().wasScrolledByUser)
     return;
 
+  HistoryItem* historyItem = m_documentLoader->historyItem();
   if (ScrollableArea* layoutScrollableArea =
           m_frame->view()->layoutViewportScrollableArea())
-    m_currentItem->setScrollOffset(layoutScrollableArea->getScrollOffset());
-  m_currentItem->setVisualViewportScrollOffset(toScrollOffset(
+    historyItem->setScrollOffset(layoutScrollableArea->getScrollOffset());
+  historyItem->setVisualViewportScrollOffset(toScrollOffset(
       m_frame->page()->visualViewport().visibleRect().location()));
 
   if (m_frame->isMainFrame())
-    m_currentItem->setPageScaleFactor(m_frame->page()->pageScaleFactor());
+    historyItem->setPageScaleFactor(m_frame->page()->pageScaleFactor());
 
   client()->didUpdateCurrentHistoryItem();
 }
 
 void FrameLoader::dispatchUnloadEvent() {
   FrameNavigationDisabler navigationDisabler(*m_frame);
 
   // If the frame is unloading, the provisional loader should no longer be
   // protected. It will be detached soon.
   m_protectProvisionalLoader = false;
@@ skipping 82 matching lines @@
 
   // detachChildren() potentially detaches the frame from the document. The
   // loading cannot continue in that case.
   if (!m_frame->page())
     return;
 
   client()->transitionToCommittedForNewPage();
   documentLoader->replaceDocumentWhileExecutingJavaScriptURL(init, source);
 }
 
-void FrameLoader::clearProvisionalHistoryItem() {
-  m_provisionalItem.clear();
-}
-
-void FrameLoader::setHistoryItemStateForCommit(
-    FrameLoadType loadType,
-    HistoryCommitType historyCommitType,
-    HistoryNavigationType navigationType) {
-  HistoryItem* oldItem = m_currentItem;
-  if (isBackForwardLoadType(loadType) && m_provisionalItem)
-    m_currentItem = m_provisionalItem.release();
-  else
-    m_currentItem = HistoryItem::create();
-  m_currentItem->setURL(m_documentLoader->urlForHistory());
-  m_currentItem->setDocumentState(m_frame->document()->formElementsState());
-  m_currentItem->setReferrer(SecurityPolicy::generateReferrer(
-      m_documentLoader->getRequest().getReferrerPolicy(), m_currentItem->url(),
-      m_documentLoader->getRequest().httpReferrer()));
-  m_currentItem->setFormInfoFromRequest(m_documentLoader->getRequest());
-
-  // Don't propagate state from the old item to the new item if there isn't an
-  // old item (obviously), or if this is a back/forward navigation, since we
-  // explicitly want to restore the state we just committed.
-  if (!oldItem || isBackForwardLoadType(loadType))
-    return;
-  // Don't propagate state from the old item if this is a different-document
-  // navigation, unless the before and after pages are logically related. This
-  // means they have the same url (ignoring fragment) and the new item was
-  // loaded via reload or client redirect.
-  if (navigationType == HistoryNavigationType::DifferentDocument &&
-      (historyCommitType != HistoryInertCommit ||
-       !equalIgnoringFragmentIdentifier(oldItem->url(), m_currentItem->url())))
-    return;
-  m_currentItem->setDocumentSequenceNumber(oldItem->documentSequenceNumber());
-  m_currentItem->setScrollOffset(oldItem->getScrollOffset());
-  m_currentItem->setDidSaveScrollOrScaleState(
-      oldItem->didSaveScrollOrScaleState());
-  m_currentItem->setVisualViewportScrollOffset(
-      oldItem->visualViewportScrollOffset());
-  m_currentItem->setPageScaleFactor(oldItem->pageScaleFactor());
-  m_currentItem->setScrollRestorationType(oldItem->scrollRestorationType());
-
-  // The item sequence number determines whether items are "the same", such
-  // back/forward navigation between items with the same item sequence number is
-  // a no-op. Only treat this as identical if the navigation did not create a
-  // back/forward entry and the url is identical or it was loaded via
-  // history.replaceState().
-  if (historyCommitType == HistoryInertCommit &&
-      (navigationType == HistoryNavigationType::HistoryApi ||
-       oldItem->url() == m_currentItem->url())) {
-    m_currentItem->setStateObject(oldItem->stateObject());
-    m_currentItem->setItemSequenceNumber(oldItem->itemSequenceNumber());
-  }
-}
-
-static HistoryCommitType loadTypeToCommitType(FrameLoadType type) {
-  switch (type) {
-    case FrameLoadTypeStandard:
-      return StandardCommit;
-    case FrameLoadTypeInitialInChildFrame:
-    case FrameLoadTypeInitialHistoryLoad:
-      return InitialCommitInChildFrame;
-    case FrameLoadTypeBackForward:
-      return BackForwardCommit;
-    default:
-      break;
-  }
-  return HistoryInertCommit;
-}
-
-void FrameLoader::receivedFirstData() {
-  FrameLoadType loadType = m_documentLoader->loadType();
-  HistoryCommitType historyCommitType = loadTypeToCommitType(loadType);
-  if (historyCommitType == StandardCommit &&
-      (m_documentLoader->urlForHistory().isEmpty() ||
-       (opener() && !m_currentItem &&
-        m_documentLoader->originalRequest().url().isEmpty())))
-    historyCommitType = HistoryInertCommit;
-  setHistoryItemStateForCommit(loadType, historyCommitType,
-                               HistoryNavigationType::DifferentDocument);
-
-  if (!m_stateMachine.committedMultipleRealLoads() &&
-      loadType == FrameLoadTypeStandard) {
-    m_stateMachine.advanceTo(
-        FrameLoaderStateMachine::CommittedMultipleRealLoads);
-  }
-
-  client()->dispatchDidCommitLoad(m_currentItem.get(), historyCommitType);
-
-  // When the embedder gets notified (above) that the new navigation has
-  // committed, the embedder will drop the old Content Security Policy and
-  // therefore now is a good time to report to the embedder the Content Security
-  // Policies that have accumulated so far for the new navigation.
-  m_frame->securityContext()->contentSecurityPolicy()->reportAccumulatedHeaders(
-      client());
-}
-
-void FrameLoader::didInstallNewDocument() {
-  if (m_provisionalItem &&
-      isBackForwardLoadType(m_documentLoader->loadType())) {
-    m_frame->document()->setStateForNewFormElements(
-        m_provisionalItem->getDocumentState());
-  }
-}
-
 void FrameLoader::finishedParsing() {
   if (m_stateMachine.creatingInitialEmptyDocument())
     return;
 
   m_progressTracker->finishedParsing();
 
   if (client()) {
     ScriptForbiddenScope forbidScripts;
     client()->dispatchDidFinishDocumentLoad();
   }
@@ skipping 174 matching lines @@
 
 void FrameLoader::updateForSameDocumentNavigation(
     const KURL& newURL,
     SameDocumentNavigationSource sameDocumentNavigationSource,
     PassRefPtr<SerializedScriptValue> data,
     HistoryScrollRestorationType scrollRestorationType,
     FrameLoadType type,
     Document* initiatingDocument) {
   TRACE_EVENT1("blink", "FrameLoader::updateForSameDocumentNavigation", "url",
                newURL.getString().ascii().data());
-  // Update the data source's request with the new URL to fake the URL change
-  m_frame->document()->setURL(newURL);
-  documentLoader()->setReplacesCurrentHistoryItem(type !=
-                                                  FrameLoadTypeStandard);
-  documentLoader()->updateForSameDocumentNavigation(
-      newURL, sameDocumentNavigationSource);
 
   // Generate start and stop notifications only when loader is completed so that
   // we don't fire them for fragment redirection that happens in window.onload
   // handler. See https://bugs.webkit.org/show_bug.cgi?id=31838
   // Do not fire the notifications if the frame is concurrently navigating away
   // from the document, since a new document is already loading.
   if (m_frame->document()->loadEventFinished() && !m_provisionalDocumentLoader)
     client()->didStartLoading(NavigationWithinSameDocument);
 
-  HistoryCommitType historyCommitType = loadTypeToCommitType(type);
-  if (!m_currentItem)

[Nate Chapin, 2017/03/27 21:02:01]

I couldn't find any evidence this clause is needed. Everything else in this
function moved to DocumentLoader::updateForSameDocumentNavigation.

-    historyCommitType = HistoryInertCommit;
-  if (m_frame->settings()->getHistoryEntryRequiresUserGesture() &&
-      initiatingDocument &&
-      !initiatingDocument->frame()->hasReceivedUserGesture()) {
-    historyCommitType = HistoryInertCommit;
-  }
+  // Update the data source's request with the new URL to fake the URL change
+  m_frame->document()->setURL(newURL);
+  documentLoader()->updateForSameDocumentNavigation(
+      newURL, sameDocumentNavigationSource, std::move(data),
+      scrollRestorationType, type, initiatingDocument);
 
-  setHistoryItemStateForCommit(
-      type, historyCommitType,
-      sameDocumentNavigationSource == SameDocumentNavigationHistoryApi
-          ? HistoryNavigationType::HistoryApi
-          : HistoryNavigationType::Fragment);
-  if (sameDocumentNavigationSource == SameDocumentNavigationHistoryApi) {
-    m_currentItem->setStateObject(std::move(data));
-    m_currentItem->setScrollRestorationType(scrollRestorationType);
-  }
-  client()->dispatchDidNavigateWithinPage(
-      m_currentItem.get(), historyCommitType, !!initiatingDocument);
   client()->dispatchDidReceiveTitle(m_frame->document()->title());
   if (m_frame->document()->loadEventFinished() && !m_provisionalDocumentLoader)
     client()->didStopLoading();
 }
 
 void FrameLoader::detachDocumentLoader(Member<DocumentLoader>& loader) {
   if (!loader)
     return;
 
   FrameNavigationDisabler navigationDisabler(*m_frame);
   loader->detachFromFrame();
   loader = nullptr;
 }
 
 void FrameLoader::loadInSameDocument(
     const KURL& url,
     PassRefPtr<SerializedScriptValue> stateObject,
     FrameLoadType frameLoadType,
-    HistoryLoadType historyLoadType,
+    HistoryItem* historyItem,
     ClientRedirectPolicy clientRedirect,
     Document* initiatingDocument) {
   // If we have a state object, we cannot also be a new navigation.
   DCHECK(!stateObject || frameLoadType == FrameLoadTypeBackForward);
 
   // If we have a provisional request for a different document, a fragment
   // scroll should cancel it.
   detachDocumentLoader(m_provisionalDocumentLoader);
 
   if (!m_frame->host())
     return;
   saveScrollState();
 
   KURL oldURL = m_frame->document()->url();
   bool hashChange = equalIgnoringFragmentIdentifier(url, oldURL) &&
                     url.fragmentIdentifier() != oldURL.fragmentIdentifier();
   if (hashChange) {
     // If we were in the autoscroll/middleClickAutoscroll mode we want to stop
     // it before following the link to the anchor
     m_frame->eventHandler().stopAutoscroll();
     m_frame->domWindow()->enqueueHashchangeEvent(oldURL, url);
   }
   m_documentLoader->setIsClientRedirect(clientRedirect ==
                                         ClientRedirectPolicy::ClientRedirect);
+  if (historyItem)
+    m_documentLoader->setItemForHistoryNavigation(historyItem);
   updateForSameDocumentNavigation(url, SameDocumentNavigationDefault, nullptr,
                                   ScrollRestorationAuto, frameLoadType,
                                   initiatingDocument);
 
   m_documentLoader->initialScrollState().wasScrolledByUser = false;
 
   checkCompleted();
 
   m_frame->domWindow()->statePopped(stateObject
                                         ? std::move(stateObject)
                                         : SerializedScriptValue::nullValue());
 
-  if (historyLoadType == HistorySameDocumentLoad)
+  if (historyItem)
     restoreScrollPositionAndViewStateForLoadType(frameLoadType);
 
   // We need to scroll to the fragment whether or not a hash change occurred,
   // since the user might have scrolled since the previous navigation.
   processFragment(url, frameLoadType, NavigationWithinSameDocument);
   takeObjectSnapshot();
 }
 
 // static
 void FrameLoader::setReferrerForFrameRequest(FrameLoadRequest& frameRequest) {
@@ skipping 18 matching lines @@
 
   request.setHTTPReferrer(referrer);
   request.addHTTPOriginIfNeeded(referrer.referrer);
 }
 
 FrameLoadType FrameLoader::determineFrameLoadType(
     const FrameLoadRequest& request) {
   if (m_frame->tree().parent() &&
       !m_stateMachine.committedFirstRealDocumentLoad())
     return FrameLoadTypeInitialInChildFrame;
-  if (!m_frame->tree().parent() && !client()->backForwardLength())
+  if (!m_frame->tree().parent() && !client()->backForwardLength()) {
+    if (opener() && request.resourceRequest().url().isEmpty())

[Nate Chapin, 2017/03/27 21:02:01]

Was a special case in FrameLoader::receivedFirstData() to override the history
commit type.

+      return FrameLoadTypeReplaceCurrentItem;
     return FrameLoadTypeStandard;
-  if (m_provisionalDocumentLoader &&
-      request.substituteData().failingURL() ==
-          m_provisionalDocumentLoader->url() &&
-      m_provisionalDocumentLoader->loadType() == FrameLoadTypeBackForward)

[Nate Chapin, 2017/03/27 21:02:01]

This clause moved to WebLocalFrameImpl::loadData(), its only user, and where it
can easily get hold of the HistoryItem needed for the back/forward navigation.

-    return FrameLoadTypeBackForward;
+  }
   if (request.resourceRequest().getCachePolicy() ==
       WebCachePolicy::ValidatingCacheData)
     return FrameLoadTypeReload;
   if (request.resourceRequest().getCachePolicy() ==
       WebCachePolicy::BypassingCache)
     return FrameLoadTypeReloadBypassingCache;
   // From the HTML5 spec for location.assign():
   // "If the browsing context's session history contains only one Document,
   // and that was the about:blank Document created when the browsing context
   // was created, then the navigation must be done with replacement enabled."
@@ skipping 13 matching lines @@
   if (request.substituteData().failingURL() ==
           m_documentLoader->urlForHistory() &&
       m_documentLoader->loadType() == FrameLoadTypeReload)
     return FrameLoadTypeReload;
 
   if (m_frame->settings()->getHistoryEntryRequiresUserGesture() &&
       request.originDocument() &&
       !request.originDocument()->frame()->hasReceivedUserGesture())
     return FrameLoadTypeReplaceCurrentItem;
 
+  if (request.resourceRequest().url().isEmpty() &&
+      request.substituteData().failingURL().isEmpty()) {

[Nate Chapin, 2017/03/27 21:02:01]

Was a special case in FrameLoader::receivedFirstData() to override the history
commit type.

+    return FrameLoadTypeReplaceCurrentItem;
+  }
+
   return FrameLoadTypeStandard;
 }
 
 bool FrameLoader::prepareRequestForThisFrame(FrameLoadRequest& request) {
   // If no origin Document* was specified, skip remaining security checks and
   // assume the caller has fully initialized the FrameLoadRequest.
   if (!request.originDocument())
     return true;
 
   KURL url = request.resourceRequest().url();
@@ skipping 130 matching lines @@
     return;
   }
 
   FrameLoadRequest request(passedRequest);
   request.resourceRequest().setHasUserGesture(
       UserGestureIndicator::processingUserGesture());
 
   if (!prepareRequestForThisFrame(request))
     return;
 
-  if (isBackForwardLoadType(frameLoadType)) {

[Nate Chapin, 2017/03/27 21:02:01]

Equivalent moved to startLoad(), after the provisional DocumentLoader is
created.

-    DCHECK(historyItem);
-    m_provisionalItem = historyItem;
-  }
-
   // Form submissions appear to need their special-case of finding the target at
   // schedule rather than at fire.
   Frame* targetFrame = request.form()
                            ? nullptr
                            : m_frame->findFrameForNavigation(
                                  AtomicString(request.frameName()), *m_frame);
 
   NavigationPolicy policy = navigationPolicyForRequest(request);
   if (targetFrame && targetFrame != m_frame &&
       shouldNavigateTargetFrame(policy)) {
@@ skipping 47 matching lines @@
     RefPtr<SerializedScriptValue> stateObject =
         sameDocumentHistoryNavigation ? historyItem->stateObject() : nullptr;
 
     if (!sameDocumentHistoryNavigation) {
       m_documentLoader->setNavigationType(determineNavigationType(
           newLoadType, false, request.triggeringEvent()));
       if (shouldTreatURLAsSameAsCurrent(url))
         newLoadType = FrameLoadTypeReplaceCurrentItem;
     }
 
-    loadInSameDocument(url, stateObject, newLoadType, historyLoadType,
+    loadInSameDocument(url, stateObject, newLoadType, historyItem,
                        request.clientRedirect(), request.originDocument());
     return;
   }
 
   // PlzNavigate
   // If the loader classifies this navigation as a different document navigation
   // while the browser intended the navigation to be same-document, it means
   // that a different navigation must have committed while the IPC was sent.
   // This navigation is no more same-document. The navigation is simply dropped.
   if (request.resourceRequest().isSameDocumentNavigation())
     return;
 
-  startLoad(request, newLoadType, policy);
+  startLoad(request, newLoadType, policy, historyItem);
 }
 
 SubstituteData FrameLoader::defaultSubstituteDataForURL(const KURL& url) {
   if (!shouldTreatURLAsSrcdocDocument(url))
     return SubstituteData();
   String srcdoc = m_frame->deprecatedLocalOwner()->fastGetAttribute(srcdocAttr);
   DCHECK(!srcdoc.isNull());
   CString encodedSrcdoc = srcdoc.utf8();
   return SubstituteData(
       SharedBuffer::create(encodedSrcdoc.data(), encodedSrcdoc.length()),
@@ skipping 36 matching lines @@
     detachDocumentLoader(m_provisionalDocumentLoader);
 
   m_checkTimer.stop();
   m_frame->navigationScheduler().cancel();
 
   // It's possible that the above actions won't have stopped loading if load
   // completion had been blocked on parsing or if we were in the middle of
   // committing an empty document. In that case, emulate a failed navigation.
   if (!m_provisionalDocumentLoader && m_documentLoader &&
       m_frame->isLoading()) {
-    loadFailed(m_documentLoader.get(),
-               ResourceError::cancelledError(m_documentLoader->url()));
+    m_documentLoader->loadFailed(
+        ResourceError::cancelledError(m_documentLoader->url()));
   }
 
   m_inStopAllLoaders = false;
   takeObjectSnapshot();
 }
 
 void FrameLoader::didAccessInitialDocument() {
   // We only need to notify the client for the main frame.
   if (isLoadingMainFrame()) {
     // Forbid script execution to prevent re-entering V8, since this is called
@@ skipping 49 matching lines @@
   // 'abort' listeners can also detach the frame.
   if (!m_frame->client())
     return false;
   DCHECK_EQ(m_provisionalDocumentLoader, pdl);
   // No more events will be dispatched so detach the Document.
   // TODO(yoav): Should we also be nullifying domWindow's document (or
   // domWindow) since the doc is now detached?
   if (m_frame->document())
     m_frame->document()->shutdown();
   m_documentLoader = m_provisionalDocumentLoader.release();
+  if (m_documentLoader)
+    m_documentLoader->markAsCommitted();

[Nate Chapin, 2017/03/27 21:02:01]

(1) m_documentLoader can be nullptr here, which is bizarre.
(2) Due to ordering issues, there isn't a good time to mark the DocumentLoader
as committed from DocumentLoader. However, this sets the bit in the next best
place: exactly when the committing DocumentLoader transitions from
m_provisionalDocumentLoader to m_documentLoader.

   takeObjectSnapshot();
 
   return true;
 }
 
 void FrameLoader::commitProvisionalLoad() {
   DCHECK(client()->hasWebView());
 
   // Check if the destination page is allowed to access the previous page's
   // timing information.
@@ skipping 45 matching lines @@
 
 void FrameLoader::restoreScrollPositionAndViewState() {
   if (!m_frame->page() || !documentLoader())
     return;
   restoreScrollPositionAndViewStateForLoadType(documentLoader()->loadType());
 }
 
 void FrameLoader::restoreScrollPositionAndViewStateForLoadType(
     FrameLoadType loadType) {
   FrameView* view = m_frame->view();
-  if (!view || !view->layoutViewportScrollableArea() || !m_currentItem ||
+  if (!view || !view->layoutViewportScrollableArea() ||
       !m_stateMachine.committedFirstRealDocumentLoad()) {
     return;
   }
   if (!needsHistoryItemRestore(loadType))
     return;
-  if (!m_currentItem->didSaveScrollOrScaleState())
+  HistoryItem* historyItem = m_documentLoader->historyItem();
+  if (!historyItem || !historyItem->didSaveScrollOrScaleState())
     return;
 
   bool shouldRestoreScroll =
-      m_currentItem->scrollRestorationType() != ScrollRestorationManual;
-  bool shouldRestoreScale = m_currentItem->pageScaleFactor();
+      historyItem->scrollRestorationType() != ScrollRestorationManual;
+  bool shouldRestoreScale = historyItem->pageScaleFactor();
 
   // This tries to balance:
   // 1. restoring as soon as possible
   // 2. not overriding user scroll (TODO(majidvp): also respect user scale)
   // 3. detecting clamping to avoid repeatedly popping the scroll position down
   //    as the page height increases
   // 4. ignore clamp detection if we are not restoring scroll or after load
   //    completes because that may be because the page will never reach its
   //    previous height
   bool canRestoreWithoutClamping =
       view->layoutViewportScrollableArea()->clampScrollOffset(
-          m_currentItem->getScrollOffset()) == m_currentItem->getScrollOffset();
+          historyItem->getScrollOffset()) == historyItem->getScrollOffset();
   bool canRestoreWithoutAnnoyingUser =
       !documentLoader()->initialScrollState().wasScrolledByUser &&
       (canRestoreWithoutClamping || !m_frame->isLoading() ||
        !shouldRestoreScroll);
   if (!canRestoreWithoutAnnoyingUser)
     return;
 
   if (shouldRestoreScroll) {
     view->layoutViewportScrollableArea()->setScrollOffset(
-        m_currentItem->getScrollOffset(), ProgrammaticScroll);
+        historyItem->getScrollOffset(), ProgrammaticScroll);
   }
 
   // For main frame restore scale and visual viewport position
   if (m_frame->isMainFrame()) {
     ScrollOffset visualViewportOffset(
-        m_currentItem->visualViewportScrollOffset());
+        historyItem->visualViewportScrollOffset());
 
     // If the visual viewport's offset is (-1, -1) it means the history item
     // is an old version of HistoryItem so distribute the scroll between
     // the main frame and the visual viewport as best as we can.
     if (visualViewportOffset.width() == -1 &&
         visualViewportOffset.height() == -1) {
       visualViewportOffset =
-          m_currentItem->getScrollOffset() -
+          historyItem->getScrollOffset() -
           view->layoutViewportScrollableArea()->getScrollOffset();
     }
 
     VisualViewport& visualViewport = m_frame->page()->visualViewport();
     if (shouldRestoreScale && shouldRestoreScroll) {
-      visualViewport.setScaleAndLocation(m_currentItem->pageScaleFactor(),
+      visualViewport.setScaleAndLocation(historyItem->pageScaleFactor(),
                                          FloatPoint(visualViewportOffset));
     } else if (shouldRestoreScale) {
-      visualViewport.setScale(m_currentItem->pageScaleFactor());
+      visualViewport.setScale(historyItem->pageScaleFactor());
     } else if (shouldRestoreScroll) {
       visualViewport.setLocation(FloatPoint(visualViewportOffset));
     }
 
     if (ScrollingCoordinator* scrollingCoordinator =
             m_frame->page()->scrollingCoordinator())
       scrollingCoordinator->frameViewRootLayerDidChange(view);
   }
 
   documentLoader()->initialScrollState().didRestoreFromHistory = true;
@@ skipping 13 matching lines @@
   if (parent && parent->isLocalFrame())
     toLocalFrame(parent)->loader().scheduleCheckCompleted();
   if (m_progressTracker) {
     m_progressTracker->dispose();
     m_progressTracker.clear();
   }
 
   TRACE_EVENT_OBJECT_DELETED_WITH_ID("loading", "FrameLoader", this);
 }
 
-void FrameLoader::loadFailed(DocumentLoader* loader,
-                             const ResourceError& error) {
-  if (!error.isCancellation() && m_frame->owner()) {
-    // FIXME: For now, fallback content doesn't work cross process.
-    if (m_frame->owner()->isLocal())
-      m_frame->deprecatedLocalOwner()->renderFallbackContent();
-  }
-
-  HistoryCommitType historyCommitType =
-      loadTypeToCommitType(loader->loadType());
-  if (loader == m_provisionalDocumentLoader) {
-    if (!m_provisionalDocumentLoader->didStart())
-      probe::frameClearedScheduledClientNavigation(m_frame);
-    m_provisionalDocumentLoader->setSentDidFinishLoad();
-    client()->dispatchDidFailProvisionalLoad(error, historyCommitType);
-    if (loader != m_provisionalDocumentLoader)
-      return;
-    detachDocumentLoader(m_provisionalDocumentLoader);
-  } else {
-    DCHECK_EQ(loader, m_documentLoader);
-    if (m_frame->document()->parser())
-      m_frame->document()->parser()->stopParsing();
-    if (!m_documentLoader->sentDidFinishLoad()) {
-      m_documentLoader->setSentDidFinishLoad();
-      client()->dispatchDidFailLoad(error, historyCommitType);
-    }
-  }
-  checkCompleted();
+void FrameLoader::detachProvisionalDocumentLoader(DocumentLoader* loader) {

[Nate Chapin, 2017/03/27 21:02:01]

I don't like having this, but a DocumentLoader needs a way to self-detach from
loadFailed(), and this is the only interaction it needs with FrameLoader
(besides the very general checkCompleted() call).

+  DCHECK_EQ(loader, m_provisionalDocumentLoader);
+  detachDocumentLoader(m_provisionalDocumentLoader);
 }
 
 bool FrameLoader::shouldPerformFragmentNavigation(bool isFormSubmission,
                                                   const String& httpMethod,
                                                   FrameLoadType loadType,
                                                   const KURL& url) {
   // We don't do this if we are submitting a form with method other than "GET",
   // explicitly reloading, currently displaying a frameset, or if the URL does
   // not have a fragment.
   return equalIgnoringCase(httpMethod, HTTPNames::GET) &&
@@ skipping 25 matching lines @@
         ->view()
         ->setSafeToPropagateScrollToParent(false);
   }
 
   // If scroll position is restored from history fragment or scroll
   // restoration type is manual, then we should not override it unless this
   // is a same document reload.
   bool shouldScrollToFragment =
       (loadStartType == NavigationWithinSameDocument &&
        !isBackForwardLoadType(frameLoadType)) ||
-      (documentLoader() &&

[yhirano, 2017/03/29 09:38:13]

Can you tell me why this can be removed safely?

[Nate Chapin, 2017/03/29 18:23:06]

The FrameView null-check at the top of processFragment should be triggered if
documentLoader() is null, and neither of the calls above should be able to
trigger detach.

-       !documentLoader()->initialScrollState().didRestoreFromHistory &&
-       !(m_currentItem &&
-         m_currentItem->scrollRestorationType() == ScrollRestorationManual));
+      (!documentLoader()->initialScrollState().didRestoreFromHistory &&
+       !(documentLoader()->historyItem() &&
+         documentLoader()->historyItem()->scrollRestorationType() ==
+             ScrollRestorationManual));
 
   view->processUrlFragment(url, shouldScrollToFragment
                                     ? FrameView::UrlFragmentScroll
                                     : FrameView::UrlFragmentDontScroll);
 
   if (boundaryFrame && boundaryFrame->isLocalFrame())
     toLocalFrame(boundaryFrame)->view()->setSafeToPropagateScrollToParent(true);
 }
 
 bool FrameLoader::shouldClose(bool isReload) {
@@ skipping 135 matching lines @@
   return shouldContinueForNavigationPolicy(
       resourceRequest, frameLoadRequest.substituteData(), nullptr,
       frameLoadRequest.shouldCheckMainWorldContentSecurityPolicy(),
       navigationType, navigationPolicy, type,
       frameLoadRequest.clientRedirect() == ClientRedirectPolicy::ClientRedirect,
       frameLoadRequest.form());
 }
 
 void FrameLoader::startLoad(FrameLoadRequest& frameLoadRequest,
                             FrameLoadType type,
-                            NavigationPolicy navigationPolicy) {
+                            NavigationPolicy navigationPolicy,
+                            HistoryItem* historyItem) {
   DCHECK(client()->hasWebView());
   ResourceRequest& resourceRequest = frameLoadRequest.resourceRequest();
   NavigationType navigationType = determineNavigationType(
       type, resourceRequest.httpBody() || frameLoadRequest.form(),
       frameLoadRequest.triggeringEvent());
   resourceRequest.setRequestContext(
       determineRequestContextFromNavigationType(navigationType));
   resourceRequest.setFrameType(m_frame->isMainFrame()
                                    ? WebURLRequest::FrameTypeTopLevel
                                    : WebURLRequest::FrameTypeNested);
@@ skipping 40 matching lines @@
       navigationPolicy == NavigationPolicyHandledByClient) {
     m_frame->navigationScheduler().cancel();
     m_checkTimer.stop();
   }
 
   if (frameLoadRequest.form())
     client()->dispatchWillSubmitForm(frameLoadRequest.form());
 
   m_provisionalDocumentLoader->appendRedirect(
       m_provisionalDocumentLoader->getRequest().url());
+
+  if (isBackForwardLoadType(type)) {
+    DCHECK(historyItem);
+    m_provisionalDocumentLoader->setItemForHistoryNavigation(historyItem);
+  }
+
   // TODO(ananta):
   // We should get rid of the dependency on the DocumentLoader in consumers of
   // the didStartProvisionalLoad() notification.
   client()->dispatchDidStartProvisionalLoad(m_provisionalDocumentLoader,
                                             resourceRequest);
   DCHECK(m_provisionalDocumentLoader);
 
   if (navigationPolicy == NavigationPolicyCurrentTab) {
     m_provisionalDocumentLoader->startLoadingMainResource();
     // This should happen after the request is sent, so that the state
@@ skipping 13 matching lines @@
   takeObjectSnapshot();
 }
 
 void FrameLoader::applyUserAgent(ResourceRequest& request) {
   String userAgent = this->userAgent();
   DCHECK(!userAgent.isNull());
   request.setHTTPUserAgent(AtomicString(userAgent));
 }
 
 bool FrameLoader::shouldTreatURLAsSameAsCurrent(const KURL& url) const {
-  return m_currentItem && url == m_currentItem->url();
+  return m_documentLoader->historyItem() &&
+         url == m_documentLoader->historyItem()->url();
 }
 
 bool FrameLoader::shouldTreatURLAsSrcdocDocument(const KURL& url) const {
   if (!url.isAboutSrcdocURL())
     return false;
   HTMLFrameOwnerElement* ownerElement = m_frame->deprecatedLocalOwner();
   if (!isHTMLIFrameElement(ownerElement))
     return false;
   return ownerElement->fastHasAttribute(srcdocAttr);
 }
@@ skipping 172 matching lines @@
     FrameLoadType loadType,
     NavigationType navigationType) {
   DocumentLoader* loader = client()->createDocumentLoader(
       m_frame, request, frameLoadRequest.substituteData().isValid()
                             ? frameLoadRequest.substituteData()
                             : defaultSubstituteDataForURL(request.url()),
       frameLoadRequest.clientRedirect());
 
   loader->setLoadType(loadType);
   loader->setNavigationType(navigationType);
-  loader->setReplacesCurrentHistoryItem(loadType ==
-                                        FrameLoadTypeReplaceCurrentItem);
+  bool replaceCurrentItem = loadType == FrameLoadTypeReplaceCurrentItem &&

[Nate Chapin, 2017/03/27 21:02:01]

The browser process DCHECKS when it received a blank navigation in a brand new
window.open()ed window, if the navigation is marked as replacing it's current
entry. This hack gives the browser process what it expects, but I don't
understand the relevant change (https://codereview.chromium.org/1272453002) well
enough to be sure whether that invariant can be safely reworked or removed.

[kinuko, 2017/03/30 05:04:59]

Could we have some of this note as a code comment?  It'd be hard to reason about
otherwise.

[Nate Chapin, 2017/03/30 20:13:56]

Added an explanation/TODO.

+                            (!opener() || !request.url().isEmpty());
+  loader->setReplacesCurrentHistoryItem(replaceCurrentItem);
   return loader;
 }
 
 }  // namespace blink