Fix DisownOpener and related tests.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 436 matching lines @@
     // A navigation in the original page has taken place.  Cancel the pending
     // one.
     CancelPending();
     cross_navigation_pending_ = false;
   } else {
     // No one else should be sending us DidNavigate in this state.
     DCHECK(false);
   }
 }
 
 // TODO(creis): Take in RenderFrameHost instead, since frames can have openers.

[Charlie Reis, 2014/08/22 19:41:23]

I thought about tackling this here as well, but I think I'll save that for a
second CL to keep this one focused on bug fixes.

 void RenderFrameHostManager::DidDisownOpener(RenderViewHost* render_view_host) {
-  // Notify all swapped out hosts, including the pending RVH.

[Charlie Reis, 2014/08/22 19:41:23]

Bug 1: We wanted to notify the pending RVH, but we weren't because the pending
one isn't in proxy_hosts_ anymore.

+  // Notify all RenderViewHosts but the one that notified us.  This is necessary
+  // in case a process swap has occurred while the message was in flight.
   for (RenderFrameProxyHostMap::iterator iter = proxy_hosts_.begin();
        iter != proxy_hosts_.end();
        ++iter) {
     DCHECK_NE(iter->second->GetSiteInstance(),
               current_frame_host()->GetSiteInstance());
     iter->second->GetRenderViewHost()->DisownOpener();
   }
+
+  if (render_frame_host_->render_view_host() != render_view_host)
+    render_frame_host_->render_view_host()->DisownOpener();

[Charlie Reis, 2014/08/22 19:41:23]

Bug 2: It's possible for a cross-process navigation to commit just as the
DidDisownOpener message is in flight.  We should still notify the recently
committed RFH, even though it's not swapped out anymore.

+
+  if (pending_render_frame_host_ &&
+      pending_render_frame_host_->render_view_host() != render_view_host) {
+    pending_render_frame_host_->render_view_host()->DisownOpener();
+  }
 }
 
 void RenderFrameHostManager::RendererProcessClosing(
     RenderProcessHost* render_process_host) {
   // Remove any swapped out RVHs from this process, so that we don't try to
   // swap them back in while the process is exiting.  Start by finding them,
   // since there could be more than one.
   std::list<int> ids_to_remove;
   for (RenderFrameProxyHostMap::iterator iter = proxy_hosts_.begin();
        iter != proxy_hosts_.end();
@@ skipping 568 matching lines @@
   scoped_ptr<RenderFrameHostImpl> new_render_frame_host;
   RenderFrameHostImpl* frame_to_announce = NULL;
   int routing_id = MSG_ROUTING_NONE;
 
   // We are creating a pending or swapped out RFH here.  We should never create
   // it in the same SiteInstance as our current RFH.
   CHECK_NE(render_frame_host_->GetSiteInstance(), instance);
 
   // Check if we've already created an RFH for this SiteInstance.  If so, try
   // to re-use the existing one, which has already been initialized.  We'll
-  // remove it from the list of swapped out hosts if it commits.
+  // remove it from the list of proxy hosts below if it will be active.
   RenderFrameProxyHost* proxy = GetRenderFrameProxyHost(instance);
 
   if (proxy) {
     routing_id = proxy->GetRenderViewHost()->GetRoutingID();
     // Delete the existing RenderFrameProxyHost, but reuse the RenderFrameHost.
     // Prevent the process from exiting while we're trying to use it.
     if (!swapped_out) {
       new_render_frame_host = proxy->PassFrameHostOwnership();
       new_render_frame_host->GetProcess()->AddPendingView();
 
@@ skipping 583 matching lines @@
 void RenderFrameHostManager::DeleteRenderFrameProxyHost(
     SiteInstance* instance) {
   RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end()) {
     delete iter->second;
     proxy_hosts_.erase(iter);
   }
 }
 
 }  // namespace content