Use WebHistoryItem.frameSequenceNumber() to find frames for history navigations

content/renderer/history_entry.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 26 matching lines @@
 
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
 
 using blink::WebFrame;
 using blink::WebHistoryItem;
 
 namespace content {
 
+// Frame routing ids are not safe to serialize, so instead create a mapping
+// from routing ids to frame sequence numbers. The sequence numbers can be
+// benignly serialized with limited risk of collision in a different process.
+// FrameMap is a singleton per-process.
+typedef base::hash_map<uint64_t, uint64_t> FrameMap;
+static FrameMap& GetFrameMap() {
+  CR_DEFINE_STATIC_LOCAL(FrameMap, routing_ids_to_internal_frame_ids, ());
+  return routing_ids_to_internal_frame_ids;
+}
+
 HistoryEntry::HistoryNode* HistoryEntry::HistoryNode::AddChild(
     const WebHistoryItem& item,
     int64_t frame_id) {
   children_->push_back(new HistoryNode(entry_, item, frame_id));
   return children_->back();
 }
 
 HistoryEntry::HistoryNode* HistoryEntry::HistoryNode::AddChild() {
   return AddChild(WebHistoryItem(), kInvalidFrameRoutingID);
 }
@@ skipping 32 matching lines @@
       new_history_node->children_->push_back(new_child_node);
     }
   }
   return new_history_node;
 }
 
 void HistoryEntry::HistoryNode::set_item(const WebHistoryItem& item) {
   // The previous HistoryItem might not have had a target set, or it might be
   // different than the current one.
   entry_->unique_names_to_items_[item.target().utf8()] = this;
+  entry_->frames_to_items_[item.frameSequenceNumber()] = this;
   item_ = item;
 }
 
 HistoryEntry::HistoryNode::HistoryNode(HistoryEntry* entry,
                                        const WebHistoryItem& item,
                                        int64_t frame_id)
     : entry_(entry), item_(item) {
-  if (frame_id != kInvalidFrameRoutingID)
-    entry_->frames_to_items_[frame_id] = this;
-  if (!item.isNull())
-    entry_->unique_names_to_items_[item.target().utf8()] = this;
+  if (frame_id != kInvalidFrameRoutingID) {
+    // Each history item is given a frame sequence number on creation.
+    // If we've already mapped this frame id to a sequence number, standardize
+    // this item to that sequence number. Otherwise, map the frame id to this
+    // item's existing sequence number.
+    if (GetFrameMap()[frame_id] == 0)
+        GetFrameMap()[frame_id] = item_.frameSequenceNumber();
+    else if (!item_.isNull())
+        item_.setFrameSequenceNumber(GetFrameMap()[frame_id]);
+    entry_->frames_to_items_[GetFrameMap()[frame_id]] = this;
+  }
+
+  if (!item_.isNull())
+    entry_->unique_names_to_items_[item_.target().utf8()] = this;
   children_.reset(new ScopedVector<HistoryNode>);
 }
 
 HistoryEntry::HistoryNode::~HistoryNode() {
 }
 
 void HistoryEntry::HistoryNode::RemoveChildren() {
   // TODO(japhet): This is inefficient. Figure out a cleaner way to ensure
   // this HistoryNode isn't cached anywhere.
   std::vector<uint64_t> frames_to_remove;
   std::vector<std::string> unique_names_to_remove;
   for (size_t i = 0; i < children().size(); i++) {
     children().at(i)->RemoveChildren();
 
     HistoryEntry::FramesToItems::iterator frames_end =
         entry_->frames_to_items_.end();
     HistoryEntry::UniqueNamesToItems::iterator unique_names_end =
         entry_->unique_names_to_items_.end();
     for (HistoryEntry::FramesToItems::iterator it =
              entry_->frames_to_items_.begin();
          it != frames_end;
          ++it) {
       if (it->second == children().at(i))
-        frames_to_remove.push_back(it->first);
+        frames_to_remove.push_back(GetFrameMap()[it->first]);
     }
     for (HistoryEntry::UniqueNamesToItems::iterator it =
              entry_->unique_names_to_items_.begin();
          it != unique_names_end;
          ++it) {
       if (it->second == children().at(i))
         unique_names_to_remove.push_back(it->first);
     }
   }
   for (unsigned i = 0; i < frames_to_remove.size(); i++)
@@ skipping 23 matching lines @@
       root_->CloneAndReplace(new_entry,
                              new_item,
                              clone_children_of_target,
                              target_frame,
                              render_view->main_render_frame()));
   return new_entry;
 }
 
 HistoryEntry::HistoryNode* HistoryEntry::GetHistoryNodeForFrame(
     RenderFrameImpl* frame) {
-  if (HistoryNode* history_node = frames_to_items_[frame->GetRoutingID()])
+  if (HistoryNode* history_node =
+          frames_to_items_[GetFrameMap()[frame->GetRoutingID()]])
     return history_node;
   return unique_names_to_items_[frame->GetWebFrame()->uniqueName().utf8()];
 }
 
 WebHistoryItem HistoryEntry::GetItemForFrame(RenderFrameImpl* frame) {
   if (HistoryNode* history_node = GetHistoryNodeForFrame(frame))
     return history_node->item();
   return WebHistoryItem();
 }
 
 }  // namespace content