Drop CreateChildFrame messages when swapping out.

content/browser/frame_host/render_frame_host_manager_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/histogram_tester.h"
 #include "base/time/time.h"
 #include "content/browser/frame_host/cross_site_transferring_request.h"
@@ skipping 130 matching lines @@
   }
 
  private:
   int process_id_;
   int routing_id_;
   bool deleted_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderViewHostDeletedObserver);
 };
 
+// This observer keeps track of the last created RenderFrameHost to allow tests
+// to ensure that no RenderFrameHost objects are created when not expected.
+class RenderFrameHostCreatedObserver : public WebContentsObserver {
+ public:
+  RenderFrameHostCreatedObserver(WebContents* web_contents)
+      : WebContentsObserver(web_contents),
+        created_(false) {
+  }
+
+  virtual void RenderFrameCreated(RenderFrameHost* render_frame_host) override {
+    created_ = true;
+  }
+
+  bool created() {
+    return created_;
+  }
+
+ private:
+  bool created_;
+
+  DISALLOW_COPY_AND_ASSIGN(RenderFrameHostCreatedObserver);
+};
+
 // This observer keeps track of the last deleted RenderFrameHost to avoid
 // accessing it and causing use-after-free condition.
 class RenderFrameHostDeletedObserver : public WebContentsObserver {
  public:
   RenderFrameHostDeletedObserver(RenderFrameHost* rfh)
       : WebContentsObserver(WebContents::FromRenderFrameHost(rfh)),
         process_id_(rfh->GetProcess()->GetID()),
         routing_id_(rfh->GetRoutingID()),
         deleted_(false) {
   }
@@ skipping 10 matching lines @@
   }
 
  private:
   int process_id_;
   int routing_id_;
   bool deleted_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameHostDeletedObserver);
 };
 
-
 // This observer is used to check whether IPC messages are being filtered for
 // swapped out RenderFrameHost objects. It observes the plugin crash and favicon
 // update events, which the FilterMessagesWhileSwappedOut test simulates being
 // sent. The test is successful if the event is not observed.
 // See http://crbug.com/351815
 class PluginFaviconMessageObserver : public WebContentsObserver {
  public:
   PluginFaviconMessageObserver(WebContents* web_contents)
       : WebContentsObserver(web_contents),
         plugin_crashed_(false),
@@ skipping 368 matching lines @@
   // Also test RunJavaScriptMessage.
   ntp_process_host->sink().ClearMessages();
   FrameHostMsg_RunJavaScriptMessage js_msg(
       ntp_rfh->GetRoutingID(), msg, msg, kChromeURL,
       JAVASCRIPT_MESSAGE_TYPE_CONFIRM, &result, &unused);
   js_msg.EnableMessagePumping();
   EXPECT_TRUE(ntp_rfh->OnMessageReceived(js_msg));
   EXPECT_TRUE(ntp_process_host->sink().GetUniqueMessageMatching(IPC_REPLY_ID));
 }
 
+TEST_F(RenderFrameHostManagerTest, DropCreateChildFrameWhileSwappedOut) {

[Charlie Reis, 2014/10/15 23:54:18]

Can you add a comment here mentioning the duplicate routing ID bug number?  That
provides some motivation for why this test is important.

[nasko, 2014/10/16 17:08:36]

Done.

+  const GURL kUrl1("http://foo.com");
+  const GURL kUrl2("http://www.google.com/");
+
+  // Navigate first to one site and then cross-site.

[Charlie Reis, 2014/10/15 23:54:18]

nit: Drop "and then cross-site" since it's not done in this block.

[nasko, 2014/10/16 17:08:36]

Done.

+  NavigateActiveAndCommit(kUrl1);
+  TestRenderFrameHost* initial_rfh = contents()->GetMainFrame();
+
+  {
+    RenderFrameHostCreatedObserver observer(contents());
+    initial_rfh->OnCreateChildFrame(3, std::string());
+    EXPECT_TRUE(observer.created());
+  }
+  // Create one more frame in the same SiteInstance where initial_rfh

[Charlie Reis, 2014/10/15 23:54:18]

nit: Either add a blank line above this or remove the one on 599, depending on
whether this is all supposed to be one block or three.  (It seems odd to have
this joined with the {...} block.)

[nasko, 2014/10/16 17:08:36]

Done.

+  // exists so that it doesn't get deleted on navigation to another

[Charlie Reis, 2014/10/15 23:54:18]

nit: it -> initial_rfh

(It's a little ambiguous at the moment.)

[nasko, 2014/10/16 17:08:36]

Done.

+  // site.
+  initial_rfh->GetSiteInstance()->increment_active_frame_count();
+
+  // Navigate to a cross-site URL.
+  NavigateActiveAndCommit(kUrl2);
+  EXPECT_TRUE(initial_rfh->is_swapped_out());
+
+  TestRenderFrameHost* dest_rfh = contents()->GetMainFrame();
+  ASSERT_TRUE(dest_rfh);
+  EXPECT_NE(initial_rfh, dest_rfh);
+
+  {
+    // Since the old RFH is now swapped out, it shouldn't process any messages
+    // to create child frames.
+    RenderFrameHostCreatedObserver observer(contents());
+    initial_rfh->OnCreateChildFrame(
+        initial_rfh->GetProcess()->GetNextRoutingID(), std::string());
+    EXPECT_FALSE(observer.created());
+  }
+}
+
 TEST_F(RenderFrameHostManagerTest, WhiteListSwapCompositorFrame) {
   TestRenderFrameHost* swapped_out_rfh = CreateSwappedOutRenderFrameHost();
   TestRenderWidgetHostView* swapped_out_rwhv =
       static_cast<TestRenderWidgetHostView*>(
           swapped_out_rfh->GetRenderViewHost()->GetView());
   EXPECT_FALSE(swapped_out_rwhv->did_swap_compositor_frame());
 
   MockRenderProcessHost* process_host =
       static_cast<MockRenderProcessHost*>(swapped_out_rfh->GetProcess());
   process_host->sink().ClearMessages();
@@ skipping 1155 matching lines @@
    pending_rfh->GetSiteInstance()->increment_active_frame_count();
 
     contents()->GetMainFrame()->OnMessageReceived(
         FrameHostMsg_BeforeUnload_ACK(0, false, now, now));
     EXPECT_FALSE(contents()->cross_navigation_pending());
     EXPECT_FALSE(rfh_deleted_observer.deleted());
   }
 }
 
 }  // namespace content