Don't create pending entries when a navigation is initiated by the page.

chrome/browser/tab_contents/render_view_host_manager_unittest.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/browser_url_handler.h"
 #include "chrome/browser/chrome_thread.h"
 #include "chrome/browser/renderer_host/site_instance.h"
 #include "chrome/browser/renderer_host/test/test_render_view_host.h"
 #include "chrome/browser/tab_contents/navigation_controller.h"
 #include "chrome/browser/tab_contents/navigation_entry.h"
 #include "chrome/browser/tab_contents/render_view_host_manager.h"
 #include "chrome/browser/tab_contents/test_tab_contents.h"
 #include "chrome/common/render_messages.h"
+#include "chrome/common/render_messages_params.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/test_notification_tracker.h"
 #include "chrome/test/testing_profile.h"
 #include "ipc/ipc_message.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 class RenderViewHostManagerTest : public RenderViewHostTestHarness {
  public:
   void NavigateActiveAndCommit(const GURL& url) {
     // Note: we navigate the active RenderViewHost because previous navigations
@@ skipping 264 matching lines @@
   // Rewrite so it looks like chrome://about/memory
   bool reverse_on_redirect = false;
   BrowserURLHandler::RewriteURLIfNecessary(
       &about_url, profile_.get(), &reverse_on_redirect);
   NavigationEntry about_entry(NULL /* instance */, -1 /* page_id */, about_url,
                               GURL() /* referrer */, string16() /* title */,
                               PageTransition::TYPED);
 
   EXPECT_TRUE(ShouldSwapProcesses(&manager, &ntp_entry, &about_entry));
 }
+
+// Tests that we don't end up in an inconsistent state if a page does a back and
+// then reload. http://crbug.com/51680
+TEST_F(RenderViewHostManagerTest, PageDoesBackAndReload) {
+  GURL url1("http://www.google.com/");
+  GURL url2("http://www.evil-site.com/");
+
+  // Navigate to a safe site, then an evil site.
+  contents()->NavigateAndCommit(url1);
+  RenderViewHost* host1 = contents()->render_view_host();
+  contents()->NavigateAndCommit(url2);
+  RenderViewHost* host2 = contents()->render_view_host();
+  // We should have got a new RVH for the evil site.
+  EXPECT_NE(host1, host2);
+
+  // Casts the TabContents to a RenderViewHostDelegate::BrowserIntegration so we
+  // can call GoToEntryAtOffset which is private.
+  RenderViewHostDelegate::BrowserIntegration* rvh_delegate =
+      static_cast<RenderViewHostDelegate::BrowserIntegration*>(contents());
+
+  // Now let's simulate the evil page calling history.back().
+  rvh_delegate->GoToEntryAtOffset(-1);
+  // The pending RVH should be the one for the Google.
+  EXPECT_EQ(host1, contents()->render_manager()->pending_render_view_host());
+
+  // Before that RVH has committed, the evil page reloads itself.
+  ViewHostMsg_FrameNavigate_Params params;
+  params.page_id = 1;
+  params.url = url2;
+  params.transition = PageTransition::CLIENT_REDIRECT;
+  params.should_update_history = false;
+  params.gesture = NavigationGestureAuto;
+  params.was_within_same_page = false;
+  params.is_post = false;
+  contents()->TestDidNavigate(host2, params);
+
+  // That should have cancelled the pending RVH, and the evil RVH should be the
+  // current one.
+  EXPECT_TRUE(contents()->render_manager()->pending_render_view_host() == NULL);
+  EXPECT_EQ(host2, contents()->render_manager()->current_host());
+
+  // Also we should not have a pending navigation entry.
+  NavigationEntry* entry = contents()->controller().GetActiveEntry();
+  ASSERT_TRUE(entry != NULL);
+  EXPECT_EQ(url2, entry->url());
+}