PlzNavigate: Speculatively spawns a renderer process for navigations.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 51 matching lines @@
       render_widget_delegate_(render_widget_delegate),
       interstitial_page_(NULL),
       weak_factory_(this) {
   DCHECK(frame_tree_node_);
 }
 
 RenderFrameHostManager::~RenderFrameHostManager() {
   if (pending_render_frame_host_)
     CancelPending();
 
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    CleanUpSpeculativeRenderFrameHost();
+  }
+
   // We should always have a current RenderFrameHost except in some tests.
   SetRenderFrameHost(scoped_ptr<RenderFrameHostImpl>());
 
   // Delete any swapped out RenderFrameHosts.
   STLDeleteValues(&proxy_hosts_);
 }
 
 void RenderFrameHostManager::Init(BrowserContext* browser_context,
                                   SiteInstance* site_instance,
                                   int view_routing_id,
@@ skipping 218 matching lines @@
       // is ok to do nothing here.
       if (pending_render_frame_host_ &&
           pending_render_frame_host_->are_navigations_suspended()) {
         pending_render_frame_host_->SetNavigationsSuspended(false,
                                                             proceed_time);
       }
     } else {
       // Current page says to cancel.
       CancelPending();
       cross_navigation_pending_ = false;
+      if (CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kEnableBrowserSideNavigation)) {
+        CleanUpSpeculativeRenderFrameHost();
+      }
     }
   } else {
     // Non-cross site transition means closing the entire tab.
     bool proceed_to_fire_unload;
     delegate_->BeforeUnloadFiredFromRenderManager(proceed, proceed_time,
                                                   &proceed_to_fire_unload);
 
     if (proceed_to_fire_unload) {
       // If we're about to close the tab and there's a pending RFH, cancel it.
       // Otherwise, if the navigation in the pending RFH completes before the
       // close in the current RFH, we'll lose the tab close.
       if (pending_render_frame_host_) {
         CancelPending();
         cross_navigation_pending_ = false;
+        if (CommandLine::ForCurrentProcess()->HasSwitch(
+                switches::kEnableBrowserSideNavigation)) {
+          CleanUpSpeculativeRenderFrameHost();
+        }
       }
 
       // This is not a cross-site navigation, the tab is being closed.
       render_frame_host_->render_view_host()->ClosePage();
     }
   }
 }
 
 void RenderFrameHostManager::OnCrossSiteResponse(
     RenderFrameHostImpl* pending_render_frame_host,
@@ skipping 78 matching lines @@
 
   response_started_id_.reset();
 }
 
 void RenderFrameHostManager::ClearNavigationTransitionData() {
   render_frame_host_->ClearPendingTransitionRequestData();
 }
 
 void RenderFrameHostManager::DidNavigateFrame(
     RenderFrameHostImpl* render_frame_host) {
+  DCHECK(render_frame_host);
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    if (speculative_render_frame_host_.get() == render_frame_host) {
+      CommitPending(true);
+      return;
+    }
+    CleanUpSpeculativeRenderFrameHost();
+  }
+
   if (!cross_navigation_pending_) {
     DCHECK(!pending_render_frame_host_);
 
     // We should only hear this from our current renderer.
     DCHECK_EQ(render_frame_host_, render_frame_host);
 
     // Even when there is no pending RVH, there may be a pending Web UI.
     if (pending_web_ui())
-      CommitPending();
+      CommitPending(false);
     return;
   }
 
   if (render_frame_host == pending_render_frame_host_) {
     // The pending cross-site navigation completed, so show the renderer.
-    CommitPending();
+    CommitPending(false);
     cross_navigation_pending_ = false;
   } else if (render_frame_host == render_frame_host_) {
     // A navigation in the original page has taken place.  Cancel the pending
     // one.
     CancelPending();
     cross_navigation_pending_ = false;
   } else {
     // No one else should be sending us DidNavigate in this state.
     DCHECK(false);
   }
 }
 
+void RenderFrameHostManager::CancelNavigation() {
+  CleanUpSpeculativeRenderFrameHost();
+}
+
 void RenderFrameHostManager::DidDisownOpener(
     RenderFrameHost* render_frame_host) {
   // Notify all RenderFrameHosts but the one that notified us. This is necessary
   // in case a process swap has occurred while the message was in flight.
   for (RenderFrameProxyHostMap::iterator iter = proxy_hosts_.begin();
        iter != proxy_hosts_.end();
        ++iter) {
     DCHECK_NE(iter->second->GetSiteInstance(),
               current_frame_host()->GetSiteInstance());
     iter->second->DisownOpener();
@@ skipping 93 matching lines @@
     // We shouldn't get here for subframes, since we only swap subframes when
     // --site-per-process is used.
     DCHECK(is_main_frame);
 
     // The old RenderFrameHost will stay alive inside the proxy so that existing
     // JavaScript window references to it stay valid.
     proxy->TakeFrameHostOwnership(old_render_frame_host.Pass());
   }
 }
 
+void RenderFrameHostManager::RecycleRenderFrameHost(
+    scoped_ptr<RenderFrameHostImpl> render_frame_host) {
+  // TODO(carlosk): this code is very similar to what can be found in
+  // SwapOutOldFrame and we should see that these are unified at some point.
+
+  // If the SiteInstance for the pending RFH is being used by others, don't
+  // delete the RFH, just swap it out and it can be reused at a later point.
+  SiteInstanceImpl* site_instance = render_frame_host->GetSiteInstance();
+  if (site_instance->HasSite() && site_instance->active_frame_count() > 1) {
+    // Any currently suspended navigations are no longer needed.
+    render_frame_host->CancelSuspendedNavigations();
+
+    RenderFrameProxyHost* proxy =
+        new RenderFrameProxyHost(site_instance, frame_tree_node_);
+    proxy_hosts_[site_instance->GetId()] = proxy;
+    render_frame_host->SwapOut(proxy);
+    if (frame_tree_node_->IsMainFrame())
+      proxy->TakeFrameHostOwnership(render_frame_host.Pass());
+  } else {
+    // We won't be coming back, so delete this one.
+    render_frame_host.reset();
+  }
+}
+
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
   // |render_frame_host| will be deleted when its SwapOut ACK is received, or
   // when the timer times out, or when the RFHM itself is deleted (whichever
   // comes first).
   pending_delete_hosts_.push_back(
       linked_ptr<RenderFrameHostImpl>(render_frame_host.release()));
 }
 
 bool RenderFrameHostManager::IsPendingDeletion(
@@ skipping 15 matching lines @@
       return true;
     }
   }
   return false;
 }
 
 void RenderFrameHostManager::ResetProxyHosts() {
   STLDeleteValues(&proxy_hosts_);
 }
 
+void RenderFrameHostManager::BeginNavigation(
+    const FrameHostMsg_BeginNavigation_Params& params,
+    const CommonNavigationParams& common_params) {
+  CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableBrowserSideNavigation));
+  // If there is an ongoing navigation, just clean it up.

[nasko, 2014/11/10 17:35:31]

Semantically, we should be cancelling an existing navigation, which might or
might not be doing the cleanup. I'd suggest calling CancelNavigation and having
that method do the proper thing, which it already does : ).

[carlosk, 2014/11/13 14:40:25]

Done.

+  CleanUpSpeculativeRenderFrameHost();
+
+  SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
+  // TODO(carlosk): Replace the default values by the right ones.
+  scoped_refptr<SiteInstanceImpl> new_instance =
+      static_cast<SiteInstanceImpl*>(GetSiteInstanceForNavigation(
+          common_params.url, NULL, common_params.transition, false, false,
+          true));
+
+  if (new_instance.get() != current_instance) {
+    // Navigating to a new SiteInstance -> speculatively create a new RFH
+
+    // TODO(carlosk): what the TRACE_EVENT_INSTANT2 for New SiteInstance found
+    // in UpdateStateForNavigate be copied here?
+
+    bool success = CreateSpeculativeRenderFrameHost(
+        common_params.url, current_instance, new_instance.get());
+    if (!success) {

[nasko, 2014/11/10 17:35:31]

nit: no need for {} when you have one line if statement.

[carlosk, 2014/11/13 14:40:25]

Done.

+      return;
+    }
+  } else {
+    // Navigating to the same SiteInstance -> make sure the current RFH is alive
+
+    // TODO(carlosk): do I need to AddPendingView() in this case as well???

[nasko, 2014/11/10 17:35:31]

You shouldn't need to. This accounts for browser-side accounting and we aren't
recreating anything on the browser side for this RFH. The code that follows will
ensure that the renderer side object is properly created and alive.

[carlosk, 2014/11/13 14:40:25]

Acknowledged.

+    DCHECK(render_frame_host_->GetSiteInstance() == new_instance);
+    if (!render_frame_host_->render_view_host()->IsRenderViewLive()) {
+      // Recreate the opener chain.
+      int opener_route_id = delegate_->CreateOpenerRenderViewsForRenderManager(
+          render_frame_host_->GetSiteInstance());
+      if (!InitRenderView(render_frame_host_->render_view_host(),
+                          opener_route_id, MSG_ROUTING_NONE,
+                          frame_tree_node_->IsMainFrame())) {
+        return;
+      }
+    }
+  }
+  DCHECK(new_instance->GetProcess()->HasConnection());
+  DCHECK(new_instance->GetProcess()->GetBrowserContext());
+}
+
+bool RenderFrameHostManager::CreateSpeculativeRenderFrameHost(

[clamy, 2014/11/12 13:01:13]

As mentioned offline, it would be good if this was shared with CreateRenderFrame
instead of being copied.

[carlosk, 2014/11/13 14:40:25]

I'll be working on this next.

+    const GURL& url, SiteInstance* old_instance, SiteInstance* new_instance) {

[nasko, 2014/11/10 17:35:31]

nit: params each on its own line

[carlosk, 2014/11/13 14:40:25]

Done.

+  CHECK(new_instance);
+  CHECK_NE(old_instance, new_instance);
+
+  // TODO(carlosk): should also try to reuse the current web_ui
+  // (ShouldReuseWebUI)?
+  scoped_ptr<WebUIImpl> new_web_ui(delegate_->CreateWebUIForRenderManager(url));
+  // TODO(carlosk): confirm this next section copied from SetPendingWebUI
+  // is in fact needed... I need access to the respective navigation entry
+  // though.
+  // If we have assigned (zero or more) bindings to this NavigationEntry in the
+  // past, make sure we're not granting it different bindings than it had
+  // before.  If so, note it and don't give it any bindings, to avoid a
+  // potential privilege escalation.
+  // if (new_web_ui &&
+  //     bindings != NavigationEntryImpl::kInvalidBindings &&
+  //     new_web_ui->GetBindings() != bindings) {
+  //   RecordAction(
+  //       base::UserMetricsAction("ProcessSwapBindingsMismatch_RVHM"));
+  //   new_web_ui.reset();
+  // }
+
+  scoped_ptr<RenderFrameHostImpl> new_render_frame_host;
+
+  // Check if we've already created an RFH for this SiteInstance.  If so, try
+  // to re-use the existing one, which has already been initialized.  We'll
+  // remove it from the list of proxy hosts below if it will be active.
+  RenderFrameProxyHost* proxy = GetRenderFrameProxyHost(new_instance);
+  if (proxy && proxy->render_frame_host()) {
+    // Delete the existing RenderFrameProxyHost, but reuse the RenderFrameHost.
+    // Prevent the process from exiting while we're trying to use it.
+    new_render_frame_host = proxy->PassFrameHostOwnership();
+    new_render_frame_host->GetProcess()->AddPendingView();
+
+    proxy_hosts_.erase(new_instance->GetId());
+    delete proxy;
+
+    // When a new render view is created by the renderer, the new WebContents
+    // gets a RenderViewHost in the SiteInstance of its opener WebContents.
+    // If not used in the first navigation, this RVH is swapped out and is not
+    // granted bindings, so we may need to grant them when swapping it in.
+    if (new_web_ui && !new_render_frame_host->GetProcess()->IsIsolatedGuest()) {
+      int required_bindings = new_web_ui->GetBindings();
+      RenderViewHost* rvh = new_render_frame_host->render_view_host();
+      if ((rvh->GetEnabledBindings() & required_bindings) !=
+          required_bindings) {
+        rvh->AllowBindings(required_bindings);
+      }
+    }
+  } else {
+    // Create a new RenderFrameHost if we don't find an existing one.
+    new_render_frame_host =
+        CreateRenderFrameHost(new_instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE,
+                              false, delegate_->IsHidden());
+    DCHECK(new_render_frame_host);
+    RenderViewHostImpl* rvh = new_render_frame_host->render_view_host();
+
+    // Prevent the process from exiting while we're trying to navigate in it.
+    // Otherwise, if the new RFH is swapped out already, store it.
+    new_render_frame_host->GetProcess()->AddPendingView();
+
+    // Ensure that we have created RFHs for the new RFH's opener chain if
+    // we are staying in the same BrowsingInstance. This allows the new RFH
+    // to send cross-process script calls to its opener(s).
+    int opener_route_id = MSG_ROUTING_NONE;
+    if (new_instance->IsRelatedSiteInstance(old_instance)) {
+      opener_route_id =
+          delegate_->CreateOpenerRenderViewsForRenderManager(new_instance);
+      if (CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kSitePerProcess)) {
+        // Ensure that the frame tree has RenderFrameProxyHosts for the new
+        // SiteInstance in all nodes except the current one.
+        frame_tree_node_->frame_tree()->CreateProxiesForSiteInstance(
+            frame_tree_node_, new_instance);
+      }
+    }
+
+    bool success = InitRenderView(rvh, opener_route_id, MSG_ROUTING_NONE,
+                                  frame_tree_node_->IsMainFrame());
+    if (success) {
+      if (frame_tree_node_->IsMainFrame()) {
+        // Don't show the main frame's view until we know it will be used.
+        rvh->GetView()->Hide();
+      } else {
+        // Init the RFH, so a RenderFrame is created in the renderer.
+        success = InitRenderFrame(new_render_frame_host.get());
+      }
+    }
+    if (!success) {
+      return false;
+    }
+    // TODO(carlosk): Should this notification call be made this early on in the
+    // navigation or only later?

[nasko, 2014/11/10 17:35:31]

This should probably be called here. Longer term it will be nice to ensure
RenderFrameCreated is a bit more meaningful, but it is outside of the scope of
this work for now.

[carlosk, 2014/11/13 14:40:25]

Acknowledged.

+    render_frame_delegate_->RenderFrameCreated(new_render_frame_host.get());
+  }
+
+  DCHECK(new_render_frame_host->GetSiteInstance() == new_instance);
+  speculative_render_frame_host_.reset(new_render_frame_host.release());
+  speculative_web_ui_.reset(new_web_ui.release());
+  return true;
+}
+
 // PlzNavigate
 RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
       const GURL& url,
       ui::PageTransition transition) {
   CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kEnableBrowserSideNavigation));
   // TODO(clamy): When we handle renderer initiated navigations, make sure not
   // to use a different process for subframes if --site-per-process is not
   // enabled.
 
@@ skipping 143 matching lines @@
           controller.GetBrowserContext(), current_entry->GetURL()) ==
        WebUIControllerFactoryRegistry::GetInstance()->GetWebUIType(
           controller.GetBrowserContext(), new_url));
 }
 
 SiteInstance* RenderFrameHostManager::GetSiteInstanceForNavigation(
     const GURL& dest_url,
     SiteInstance* dest_instance,
     ui::PageTransition dest_transition,
     bool dest_is_restore,
-    bool dest_is_view_source_mode) {
+    bool dest_is_view_source_mode,
+    bool create_unbounded_site_instance) {
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
   SiteInstance* new_instance = current_instance;
 
   // We do not currently swap processes for navigations in webview tag guests.
   if (current_instance->GetSiteURL().SchemeIs(kGuestScheme))
     return current_instance;
 
   // Determine if we need a new BrowsingInstance for this entry.  If true, this
   // implies that it will get a new SiteInstance (and likely process), and that
   // other tabs in the current BrowsingInstance will be unable to script it.
@@ skipping 11 matching lines @@
   bool current_is_view_source_mode = current_entry ?
       current_entry->IsViewSourceMode() : dest_is_view_source_mode;
   bool force_swap = ShouldSwapBrowsingInstancesForNavigation(
       current_effective_url,
       current_is_view_source_mode,
       dest_instance,
       SiteInstanceImpl::GetEffectiveURL(browser_context, dest_url),
       dest_is_view_source_mode);
   if (ShouldTransitionCrossSite() || force_swap) {
     new_instance = GetSiteInstanceForURL(
-        dest_url,
-        dest_instance,
-        dest_transition,
-        dest_is_restore,
-        dest_is_view_source_mode,
-        current_instance,
-        force_swap);
+        dest_url, dest_instance, dest_transition, dest_is_restore,
+        dest_is_view_source_mode, current_instance, force_swap,
+        create_unbounded_site_instance);
   }
 
   // If force_swap is true, we must use a different SiteInstance.  If we didn't,
   // we would have two RenderFrameHosts in the same SiteInstance and the same
   // frame, resulting in page_id conflicts for their NavigationEntries.
   if (force_swap)
     CHECK_NE(new_instance, current_instance);
   return new_instance;
 }
 
 SiteInstance* RenderFrameHostManager::GetSiteInstanceForURL(
     const GURL& dest_url,
     SiteInstance* dest_instance,
     ui::PageTransition dest_transition,
     bool dest_is_restore,
     bool dest_is_view_source_mode,
     SiteInstance* current_instance,
-    bool force_browsing_instance_swap) {
+    bool force_browsing_instance_swap,
+    bool create_unbounded_site_instance) {
   NavigationControllerImpl& controller =
       delegate_->GetControllerForRenderManager();
   BrowserContext* browser_context = controller.GetBrowserContext();
 
   // If the entry has an instance already we should use it.
   if (dest_instance) {
     // If we are forcing a swap, this should be in a different BrowsingInstance.
     if (force_browsing_instance_swap) {
       CHECK(!dest_instance->IsRelatedSiteInstance(
                 render_frame_host_->GetSiteInstance()));
     }
     return dest_instance;
   }
 
+  SiteInstanceImpl* current_site_instance =
+      static_cast<SiteInstanceImpl*>(current_instance);
+
   // If a swap is required, we need to force the SiteInstance AND
   // BrowsingInstance to be different ones, using CreateForURL.
-  if (force_browsing_instance_swap)
-    return SiteInstance::CreateForURL(browser_context, dest_url);
+  if (force_browsing_instance_swap) {
+    return CreateSiteInstanceForURL(browser_context, dest_url,
+                                    create_unbounded_site_instance,
+                                    current_site_instance);
+  }
 
   // (UGLY) HEURISTIC, process-per-site only:
   //
   // If this navigation is generated, then it probably corresponds to a search
   // query.  Given that search results typically lead to users navigating to
   // other sites, we don't really want to use the search engine hostname to
   // determine the site instance for this navigation.
   //
   // NOTE: This can be removed once we have a way to transition between
   //       RenderViews in response to a link click.
   //
   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kProcessPerSite) &&
       ui::PageTransitionCoreTypeIs(
           dest_transition, ui::PAGE_TRANSITION_GENERATED)) {
     return current_instance;
   }
 
-  SiteInstanceImpl* current_site_instance =
-      static_cast<SiteInstanceImpl*>(current_instance);
-
   // If we haven't used our SiteInstance (and thus RVH) yet, then we can use it
   // for this entry.  We won't commit the SiteInstance to this site until the
   // navigation commits (in DidNavigate), unless the navigation entry was
   // restored or it's a Web UI as described below.
   if (!current_site_instance->HasSite()) {
     // If we've already created a SiteInstance for our destination, we don't
     // want to use this unused SiteInstance; use the existing one.  (We don't
     // do this check if the current_instance has a site, because for now, we
     // want to compare against the current URL and not the SiteInstance's site.
     // In this case, there is no current URL, so comparing against the site is
     // ok.  See additional comments below.)
     //
     // Also, if the URL should use process-per-site mode and there is an
     // existing process for the site, we should use it.  We can call
     // GetRelatedSiteInstance() for this, which will eagerly set the site and
     // thus use the correct process.
     bool use_process_per_site =
         RenderProcessHost::ShouldUseProcessPerSite(browser_context, dest_url) &&
         RenderProcessHostImpl::GetProcessHostForSite(browser_context, dest_url);
     if (current_site_instance->HasRelatedSiteInstance(dest_url) ||
         use_process_per_site) {
-      return current_site_instance->GetRelatedSiteInstance(dest_url);
+      return GetRelatedSiteInstanceForURL(current_site_instance, dest_url,
+                                          create_unbounded_site_instance);
     }
 
     // For extensions, Web UI URLs (such as the new tab page), and apps we do
     // not want to use the current_instance if it has no site, since it will
     // have a RenderProcessHost of PRIV_NORMAL.  Create a new SiteInstance for
     // this URL instead (with the correct process type).
-    if (current_site_instance->HasWrongProcessForURL(dest_url))
-      return current_site_instance->GetRelatedSiteInstance(dest_url);
+    if (current_site_instance->HasWrongProcessForURL(dest_url)) {
+      return GetRelatedSiteInstanceForURL(current_site_instance, dest_url,
+                                          create_unbounded_site_instance);
+    }
 
     // View-source URLs must use a new SiteInstance and BrowsingInstance.
     // TODO(nasko): This is the same condition as later in the function. This
     // should be taken into account when refactoring this method as part of
     // http://crbug.com/123007.
-    if (dest_is_view_source_mode)
-      return SiteInstance::CreateForURL(browser_context, dest_url);
+    if (dest_is_view_source_mode) {
+      return CreateSiteInstanceForURL(browser_context, dest_url,
+                                      create_unbounded_site_instance,
+                                      current_site_instance);
+    }
 
     // If we are navigating from a blank SiteInstance to a WebUI, make sure we
     // create a new SiteInstance.
     if (WebUIControllerFactoryRegistry::GetInstance()->UseWebUIForURL(
             browser_context, dest_url)) {
-        return SiteInstance::CreateForURL(browser_context, dest_url);
+      return CreateSiteInstanceForURL(browser_context, dest_url,
+                                      create_unbounded_site_instance,
+                                      current_site_instance);
     }
 
     // Normally the "site" on the SiteInstance is set lazily when the load
     // actually commits. This is to support better process sharing in case
     // the site redirects to some other site: we want to use the destination
     // site in the site instance.
     //
     // In the case of session restore, as it loads all the pages immediately
     // we need to set the site first, otherwise after a restore none of the
     // pages would share renderers in process-per-site.
@@ skipping 29 matching lines @@
   }
 
   // View-source URLs must use a new SiteInstance and BrowsingInstance.
   // We don't need a swap when going from view-source to a debug URL like
   // chrome://crash, however.
   // TODO(creis): Refactor this method so this duplicated code isn't needed.
   // See http://crbug.com/123007.
   if (current_entry &&
       current_entry->IsViewSourceMode() != dest_is_view_source_mode &&
       !IsRendererDebugURL(dest_url)) {
-    return SiteInstance::CreateForURL(browser_context, dest_url);
+    return CreateSiteInstanceForURL(browser_context, dest_url,
+                                    create_unbounded_site_instance,
+                                    current_site_instance);
   }
 
   // Use the current SiteInstance for same site navigations, as long as the
   // process type is correct.  (The URL may have been installed as an app since
   // the last time we visited it.)
   const GURL& current_url =
       GetCurrentURLForSiteInstance(current_instance, current_entry);
   if (SiteInstance::IsSameWebSite(browser_context, current_url, dest_url) &&
       !current_site_instance->HasWrongProcessForURL(dest_url)) {
     return current_instance;
   }
 
   // Start the new renderer in a new SiteInstance, but in the current
   // BrowsingInstance.  It is important to immediately give this new
   // SiteInstance to a RenderViewHost (if it is different than our current
   // SiteInstance), so that it is ref counted.  This will happen in
   // CreateRenderView.
+  return GetRelatedSiteInstanceForURL(current_site_instance, dest_url,
+                                      create_unbounded_site_instance);
+}
+
+SiteInstance* RenderFrameHostManager::CreateSiteInstanceForURL(
+    BrowserContext* browser_context,
+    const GURL& dest_url,
+    bool create_unbounded_site_instance,
+    SiteInstanceImpl* current_instance) {
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    if (create_unbounded_site_instance) {
+      return SiteInstance::Create(browser_context);
+    }
+    if (speculative_render_frame_host_) {

[nasko, 2014/11/10 17:35:31]

Why would this condition be hit? If there is a speculative RFH, this means we
have already passed the Create* methods and are in the middle of navigation. If
this is a new navigation, we should've cancelled the existing one.

[carlosk, 2014/11/13 14:40:26]

This method is called twice during a navigation with PlzNavigate enabled. The
1st time, due to the call do BeginNavigation, create_unbounded_site_instance is
true and so a new, site-unbound SiteInstance is created (if the URL being
navigated to triggers that). In that case a speculative RFH would be created
using this SiteInstance.

The 2nd time, create_unbounded_site_instance is false. In that case if a
speculative RFH was created int he 1st call its SiteInstance will be returned if
the other checks that follow are successful.

The reason why this goes down here is to check that the SiteInstance for the
speculatively created RFH still matches the final URL. If it doesn't a new
SiteInstance will be returned what will finally cause the speculative RFH to be
trashed.

+      SiteInstanceImpl* sii = speculative_render_frame_host_->GetSiteInstance();
+      if (!sii->HasSite() && !sii->IsRelatedSiteInstance(current_instance)) {
+        return sii;
+      }
+    }
+  }
+
+  return SiteInstance::CreateForURL(browser_context, dest_url);
+}
+
+SiteInstance* RenderFrameHostManager::GetRelatedSiteInstanceForURL(
+    SiteInstanceImpl* current_instance,
+    const GURL& dest_url,
+    bool create_unbounded_site_instance) {
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    if (!current_instance->HasRelatedSiteInstance(dest_url)) {
+      if (create_unbounded_site_instance) {
+        return current_instance->GetRelatedEmptySiteInstance();
+      }
+      if (speculative_render_frame_host_) {
+        SiteInstanceImpl* sii =
+            speculative_render_frame_host_->GetSiteInstance();
+        if (!sii->HasSite() && sii->IsRelatedSiteInstance(current_instance)) {
+          return sii;
+        }
+      }
+    }
+  }
+
   return current_instance->GetRelatedSiteInstance(dest_url);
 }
 
 const GURL& RenderFrameHostManager::GetCurrentURLForSiteInstance(
     SiteInstance* current_instance, NavigationEntry* current_entry) {
   // If this is a subframe that is potentially out of process from its parent,
   // don't consider using current_entry's url for SiteInstance selection, since
   // current_entry's url is for the main frame and may be in a different site
   // than this frame.
   // TODO(creis): Remove this when we can check the FrameNavigationEntry's url.
@@ skipping 215 matching lines @@
     render_view_host->AllowBindings(pending_web_ui()->GetBindings());
   } else {
     // Ensure that we don't create an unprivileged RenderView in a WebUI-enabled
     // process unless it's swapped out.
     if (render_view_host->is_active()) {
       CHECK(!ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
                 render_view_host->GetProcess()->GetID()));
     }
   }
 
-  return delegate_->CreateRenderViewForRenderManager(render_view_host,
-                                                     opener_route_id,
-                                                     proxy_routing_id,
-                                                     for_main_frame_navigation);
+  return delegate_->CreateRenderViewForRenderManager(
+      render_view_host, opener_route_id, proxy_routing_id,
+      for_main_frame_navigation);
 }
 
 bool RenderFrameHostManager::InitRenderFrame(
     RenderFrameHostImpl* render_frame_host) {
   if (render_frame_host->IsRenderFrameLive())
     return true;
 
   int parent_routing_id = MSG_ROUTING_NONE;
   int proxy_routing_id = MSG_ROUTING_NONE;
   if (frame_tree_node_->parent()) {
@@ skipping 25 matching lines @@
     return render_frame_host_->GetRoutingID();
 
   RenderFrameProxyHostMap::iterator iter =
       proxy_hosts_.find(site_instance->GetId());
   if (iter != proxy_hosts_.end())
     return iter->second->GetRoutingID();
 
   return MSG_ROUTING_NONE;
 }
 
-void RenderFrameHostManager::CommitPending() {
+void RenderFrameHostManager::CommitPending(bool use_speculative_rfh) {
   TRACE_EVENT1("navigation", "RenderFrameHostManager::CommitPending",
                "FrameTreeNode id", frame_tree_node_->frame_tree_node_id());
+  // If use_speculative_rfh then kEnableBrowserSideNavigation must be enabled.
+  DCHECK(!use_speculative_rfh ||

[nasko, 2014/11/10 17:35:31]

nit: CHECK

[carlosk, 2014/11/13 14:40:26]

Done.

+         CommandLine::ForCurrentProcess()->HasSwitch(
+             switches::kEnableBrowserSideNavigation));
+
   // First check whether we're going to want to focus the location bar after
   // this commit.  We do this now because the navigation hasn't formally
   // committed yet, so if we've already cleared |pending_web_ui_| the call chain
   // this triggers won't be able to figure out what's going on.
   bool will_focus_location_bar = delegate_->FocusLocationBarByDefault();
 
-  // Next commit the Web UI, if any. Either replace |web_ui_| with
-  // |pending_web_ui_|, or clear |web_ui_| if there is no pending WebUI, or
-  // leave |web_ui_| as is if reusing it.
-  DCHECK(!(pending_web_ui_.get() && pending_and_current_web_ui_.get()));
-  if (pending_web_ui_) {
-    web_ui_.reset(pending_web_ui_.release());
-  } else if (!pending_and_current_web_ui_.get()) {
-    web_ui_.reset();
+  if (!use_speculative_rfh) {
+    DCHECK(!speculative_web_ui_);
+    // Next commit the Web UI, if any. Either replace |web_ui_| with
+    // |pending_web_ui_|, or clear |web_ui_| if there is no pending WebUI, or
+    // leave |web_ui_| as is if reusing it.
+    DCHECK(!(pending_web_ui_.get() && pending_and_current_web_ui_.get()));
+    if (pending_web_ui_) {
+      web_ui_.reset(pending_web_ui_.release());
+    } else if (!pending_and_current_web_ui_.get()) {
+      web_ui_.reset();
+    } else {
+      DCHECK_EQ(pending_and_current_web_ui_.get(), web_ui_.get());
+      pending_and_current_web_ui_.reset();
+    }
   } else {
-    DCHECK_EQ(pending_and_current_web_ui_.get(), web_ui_.get());
-    pending_and_current_web_ui_.reset();
+    web_ui_.reset(speculative_web_ui_.release());
   }
 
   // It's possible for the pending_render_frame_host_ to be NULL when we aren't
   // crossing process boundaries. If so, we just needed to handle the Web UI
   // committing above and we're done.
-  if (!pending_render_frame_host_) {
+  if (!pending_render_frame_host_ && !use_speculative_rfh) {
     if (will_focus_location_bar)
       delegate_->SetFocusToLocationBar(false);
     return;
   }
 
   // Remember if the page was focused so we can focus the new renderer in
   // that case.
   bool focus_render_view = !will_focus_location_bar &&
       render_frame_host_->render_view_host()->GetView() &&
       render_frame_host_->render_view_host()->GetView()->HasFocus();
 
   bool is_main_frame = frame_tree_node_->IsMainFrame();
 
-  // Swap in the pending frame and make it active. Also ensure the FrameTree
-  // stays in sync.
-  scoped_ptr<RenderFrameHostImpl> old_render_frame_host =
-      SetRenderFrameHost(pending_render_frame_host_.Pass());
+  scoped_ptr<RenderFrameHostImpl> old_render_frame_host;
+  if (!use_speculative_rfh) {
+    DCHECK(!speculative_render_frame_host_);
+    // Swap in the pending frame and make it active. Also ensure the FrameTree
+    // stays in sync.
+    old_render_frame_host =
+        SetRenderFrameHost(pending_render_frame_host_.Pass());
+  } else {
+    DCHECK(speculative_render_frame_host_);
+    old_render_frame_host =
+        SetRenderFrameHost(speculative_render_frame_host_.Pass());
+  }
+
   if (is_main_frame)
     render_frame_host_->render_view_host()->AttachToFrameTree();
 
   // The process will no longer try to exit, so we can decrement the count.
   render_frame_host_->GetProcess()->RemovePendingView();
 
   // Show the new view (or a sad tab) if necessary.
   bool new_rfh_has_view = !!render_frame_host_->render_view_host()->GetView();
   if (!delegate_->IsHidden() && new_rfh_has_view) {
     // In most cases, we need to show the new view.
@@ skipping 106 matching lines @@
   // If we are currently navigating cross-process, we want to get back to normal
   // and then navigate as usual.
   if (cross_navigation_pending_) {
     if (pending_render_frame_host_)
       CancelPending();
     cross_navigation_pending_ = false;
   }
 
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
   scoped_refptr<SiteInstance> new_instance = GetSiteInstanceForNavigation(
-      url, instance, transition, is_restore, is_view_source_mode);
+      url, instance, transition, is_restore, is_view_source_mode, false);
+
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation) &&
+      speculative_render_frame_host_) {
+    if (speculative_render_frame_host_->GetSiteInstance() == new_instance) {

[clamy, 2014/11/12 13:01:13]

nit: no need for braces.

[carlosk, 2014/11/13 14:40:26]

Done.

+      return speculative_render_frame_host_.get();
+    }
+    CleanUpSpeculativeRenderFrameHost();

[nasko, 2014/11/10 17:35:31]

All of the sprinkled calls for CleanUpSpeculativeRenderFrameHost match closely
with CancelPending calls.

[carlosk, 2014/11/13 14:40:25]

In this case that's not true: if the SiteInstance of the speculative RFH doesn't
match the one for the final URL we don't want to cancel the navigation. We want
to trash the speculative data and create a new RFH to fulfill the navigation.

+  }
 
   const NavigationEntry* current_entry =
       delegate_->GetLastCommittedNavigationEntryForRenderManager();
 
   if (new_instance.get() != current_instance) {
     TRACE_EVENT_INSTANT2(
         "navigation",
         "RenderFrameHostManager::UpdateStateForNavigate:New SiteInstance",
         TRACE_EVENT_SCOPE_THREAD,
         "current_instance id", current_instance->GetId(),
@@ skipping 16 matching lines @@
     }
 
     // Check if our current RFH is live before we set up a transition.
     if (!render_frame_host_->IsRenderFrameLive()) {
       if (!cross_navigation_pending_) {
         // The current RFH is not live.  There's no reason to sit around with a
         // sad tab or a newly created RFH while we wait for the pending RFH to
         // navigate.  Just switch to the pending RFH now and go back to non
         // cross-navigating (Note that we don't care about on{before}unload
         // handlers if the current RFH isn't live.)
-        CommitPending();
+        CommitPending(false);
         return render_frame_host_.get();
       } else {
         NOTREACHED();
         return render_frame_host_.get();
       }
     }
     // Otherwise, it's safe to treat this as a pending cross-site transition.
 
     // We now have a pending RFH.
     DCHECK(!cross_navigation_pending_);
@@ skipping 84 matching lines @@
   scoped_ptr<RenderFrameHostImpl> pending_render_frame_host =
       pending_render_frame_host_.Pass();
 
   RenderViewDevToolsAgentHost::OnCancelPendingNavigation(
       pending_render_frame_host->render_view_host(),
       render_frame_host_->render_view_host());
 
   // We no longer need to prevent the process from exiting.
   pending_render_frame_host->GetProcess()->RemovePendingView();
 
-  // If the SiteInstance for the pending RFH is being used by others, don't
-  // delete the RFH, just swap it out and it can be reused at a later point.
-  SiteInstanceImpl* site_instance =
-      pending_render_frame_host->GetSiteInstance();
-  if (site_instance->active_frame_count() > 1) {
-    // Any currently suspended navigations are no longer needed.
-    pending_render_frame_host->CancelSuspendedNavigations();
-
-    RenderFrameProxyHost* proxy =
-        new RenderFrameProxyHost(site_instance, frame_tree_node_);
-    proxy_hosts_[site_instance->GetId()] = proxy;
-    pending_render_frame_host->SwapOut(proxy);
-    if (frame_tree_node_->IsMainFrame())
-      proxy->TakeFrameHostOwnership(pending_render_frame_host.Pass());
-  } else {
-    // We won't be coming back, so delete this one.
-    pending_render_frame_host.reset();
-  }
+  RecycleRenderFrameHost(pending_render_frame_host.Pass());
 
   pending_web_ui_.reset();
   pending_and_current_web_ui_.reset();
 }
 
+void RenderFrameHostManager::CleanUpSpeculativeRenderFrameHost() {
+  CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableBrowserSideNavigation));
+  if (speculative_render_frame_host_) {
+    speculative_render_frame_host_->GetProcess()->RemovePendingView();
+    RecycleRenderFrameHost(speculative_render_frame_host_.Pass());
+  }
+  if (speculative_web_ui_) {

[clamy, 2014/11/12 13:01:13]

nit: no need for braces.

[carlosk, 2014/11/13 14:40:26]

Done.

+    speculative_web_ui_.reset();
+  }
+}
+
 scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::SetRenderFrameHost(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
   // Swap the two.
   scoped_ptr<RenderFrameHostImpl> old_render_frame_host =
       render_frame_host_.Pass();
   render_frame_host_ = render_frame_host.Pass();
 
   if (frame_tree_node_->IsMainFrame()) {
     // Update the count of top-level frames using this SiteInstance.  All
     // subframes are in the same BrowsingInstance as the main frame, so we only
@@ skipping 59 matching lines @@
 void RenderFrameHostManager::DeleteRenderFrameProxyHost(
     SiteInstance* instance) {
   RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end()) {
     delete iter->second;
     proxy_hosts_.erase(iter);
   }
 }
 
 }  // namespace content