PlzNavigate: Speculatively spawns a renderer process for navigations.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 51 matching lines @@
       render_widget_delegate_(render_widget_delegate),
       interstitial_page_(NULL),
       weak_factory_(this) {
   DCHECK(frame_tree_node_);
 }
 
 RenderFrameHostManager::~RenderFrameHostManager() {
   if (pending_render_frame_host_)
     CancelPending();
 
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    CleanUpSpeculativeRenderFrameHost();
+  }
+
   // We should always have a current RenderFrameHost except in some tests.
   SetRenderFrameHost(scoped_ptr<RenderFrameHostImpl>());
 
   // Delete any swapped out RenderFrameHosts.
   STLDeleteValues(&proxy_hosts_);
 }
 
 void RenderFrameHostManager::Init(BrowserContext* browser_context,
                                   SiteInstance* site_instance,
                                   int view_routing_id,
@@ skipping 218 matching lines @@
       // is ok to do nothing here.
       if (pending_render_frame_host_ &&
           pending_render_frame_host_->are_navigations_suspended()) {
         pending_render_frame_host_->SetNavigationsSuspended(false,
                                                             proceed_time);
       }
     } else {
       // Current page says to cancel.
       CancelPending();
       cross_navigation_pending_ = false;
+      if (CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kEnableBrowserSideNavigation)) {
+        CleanUpSpeculativeRenderFrameHost();
+      }
     }
   } else {
     // Non-cross site transition means closing the entire tab.
     bool proceed_to_fire_unload;
     delegate_->BeforeUnloadFiredFromRenderManager(proceed, proceed_time,
                                                   &proceed_to_fire_unload);
 
     if (proceed_to_fire_unload) {
       // If we're about to close the tab and there's a pending RFH, cancel it.
       // Otherwise, if the navigation in the pending RFH completes before the
       // close in the current RFH, we'll lose the tab close.
       if (pending_render_frame_host_) {
         CancelPending();
         cross_navigation_pending_ = false;
+        if (CommandLine::ForCurrentProcess()->HasSwitch(
+                switches::kEnableBrowserSideNavigation)) {
+          CleanUpSpeculativeRenderFrameHost();
+        }
       }
 
       // This is not a cross-site navigation, the tab is being closed.
       render_frame_host_->render_view_host()->ClosePage();
     }
   }
 }
 
 void RenderFrameHostManager::OnCrossSiteResponse(
     RenderFrameHostImpl* pending_render_frame_host,
@@ skipping 78 matching lines @@
 
   response_started_id_.reset();
 }
 
 void RenderFrameHostManager::ClearNavigationTransitionData() {
   render_frame_host_->ClearPendingTransitionRequestData();
 }
 
 void RenderFrameHostManager::DidNavigateFrame(
     RenderFrameHostImpl* render_frame_host) {
+  DCHECK(render_frame_host);
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    if (speculative_render_frame_host_.get() == render_frame_host) {
+      CommitPending(true);
+      return;
+    }
+    CleanUpSpeculativeRenderFrameHost();
+  }
+
   if (!cross_navigation_pending_) {
     DCHECK(!pending_render_frame_host_);
 
     // We should only hear this from our current renderer.
     DCHECK_EQ(render_frame_host_, render_frame_host);
 
     // Even when there is no pending RVH, there may be a pending Web UI.
     if (pending_web_ui())
-      CommitPending();
+      CommitPending(false);
     return;
   }
 
   if (render_frame_host == pending_render_frame_host_) {
     // The pending cross-site navigation completed, so show the renderer.
-    CommitPending();
+    CommitPending(false);
     cross_navigation_pending_ = false;
   } else if (render_frame_host == render_frame_host_) {
     // A navigation in the original page has taken place.  Cancel the pending
     // one.
     CancelPending();
     cross_navigation_pending_ = false;
   } else {
     // No one else should be sending us DidNavigate in this state.
     DCHECK(false);
   }
 }
 
+void RenderFrameHostManager::CancelNavigation() {
+  CleanUpSpeculativeRenderFrameHost();
+}
+
 void RenderFrameHostManager::DidDisownOpener(
     RenderFrameHost* render_frame_host) {
   // Notify all RenderFrameHosts but the one that notified us. This is necessary
   // in case a process swap has occurred while the message was in flight.
   for (RenderFrameProxyHostMap::iterator iter = proxy_hosts_.begin();
        iter != proxy_hosts_.end();
        ++iter) {
     DCHECK_NE(iter->second->GetSiteInstance(),
               current_frame_host()->GetSiteInstance());
     iter->second->DisownOpener();
@@ skipping 93 matching lines @@
     // We shouldn't get here for subframes, since we only swap subframes when
     // --site-per-process is used.
     DCHECK(is_main_frame);
 
     // The old RenderFrameHost will stay alive inside the proxy so that existing
     // JavaScript window references to it stay valid.
     proxy->TakeFrameHostOwnership(old_render_frame_host.Pass());
   }
 }
 
+void RenderFrameHostManager::RecycleRenderFrameHost(
+    scoped_ptr<RenderFrameHostImpl> render_frame_host) {
+  // TODO(carlosk): this code is very similar to what can be found in
+  // SwapOutOldFrame and we should see that these are unified at some point.
+
+  // If the SiteInstance for the pending RFH is being used by others, don't
+  // delete the RFH, just swap it out and it can be reused at a later point.
+  SiteInstanceImpl* site_instance = render_frame_host->GetSiteInstance();
+  if (site_instance->HasSite() && site_instance->active_frame_count() > 1) {
+    // Any currently suspended navigations are no longer needed.
+    render_frame_host->CancelSuspendedNavigations();
+
+    RenderFrameProxyHost* proxy =
+        new RenderFrameProxyHost(site_instance, frame_tree_node_);
+    proxy_hosts_[site_instance->GetId()] = proxy;
+    render_frame_host->SwapOut(proxy);
+    if (frame_tree_node_->IsMainFrame())
+      proxy->TakeFrameHostOwnership(render_frame_host.Pass());
+  } else {
+    // We won't be coming back, so delete this one.
+    render_frame_host.reset();
+  }
+}
+
 void RenderFrameHostManager::MoveToPendingDeleteHosts(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
   // |render_frame_host| will be deleted when its SwapOut ACK is received, or
   // when the timer times out, or when the RFHM itself is deleted (whichever
   // comes first).
   pending_delete_hosts_.push_back(
       linked_ptr<RenderFrameHostImpl>(render_frame_host.release()));
 }
 
 bool RenderFrameHostManager::IsPendingDeletion(
@@ skipping 15 matching lines @@
       return true;
     }
   }
   return false;
 }
 
 void RenderFrameHostManager::ResetProxyHosts() {
   STLDeleteValues(&proxy_hosts_);
 }
 
+void RenderFrameHostManager::BeginNavigation(
+    const FrameHostMsg_BeginNavigation_Params& params,
+    const CommonNavigationParams& common_params) {
+  CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableBrowserSideNavigation));
+  // If there is an ongoing navigation, just clean it up.

[clamy, 2014/11/14 10:11:09]

nit: s/just clean it up/cancel it

[carlosk, 2014/11/14 17:43:37]

Done.

+  CancelNavigation();
+
+  SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
+  // TODO(carlosk): Replace the default values by the right ones.
+  scoped_refptr<SiteInstanceImpl> new_instance =
+      static_cast<SiteInstanceImpl*>(GetSiteInstanceForNavigation(
+          common_params.url, NULL, common_params.transition, false, false,
+          true));
+
+  if (new_instance.get() != current_instance) {
+    // Navigating to a new SiteInstance -> speculatively create a new RFH
+
+    // TODO(carlosk): what the TRACE_EVENT_INSTANT2 for New SiteInstance found
+    // in UpdateStateForNavigate be copied here?
+
+    bool success = CreateSpeculativeRenderFrameHost(
+        common_params.url, current_instance, new_instance.get());
+    if (!success)
+      return;
+  } else {
+    // Navigating to the same SiteInstance -> make sure the current RFH is alive
+    DCHECK(render_frame_host_->GetSiteInstance() == new_instance);
+    if (!render_frame_host_->render_view_host()->IsRenderViewLive()) {
+      // Recreate the opener chain.
+      int opener_route_id = delegate_->CreateOpenerRenderViewsForRenderManager(
+          render_frame_host_->GetSiteInstance());
+      if (!InitRenderView(render_frame_host_->render_view_host(),
+                          opener_route_id, MSG_ROUTING_NONE,
+                          frame_tree_node_->IsMainFrame())) {
+        return;
+      }
+    }
+  }
+  DCHECK(new_instance->GetProcess()->HasConnection());
+  DCHECK(new_instance->GetProcess()->GetBrowserContext());
+}
+
+bool RenderFrameHostManager::CreateSpeculativeRenderFrameHost(
+    const GURL& url,
+    SiteInstance* old_instance,
+    SiteInstance* new_instance) {
+  CHECK(new_instance);
+  CHECK_NE(old_instance, new_instance);
+
+  // TODO(carlosk): should also try to reuse the current web_ui
+  // (ShouldReuseWebUI)?
+  scoped_ptr<WebUIImpl> new_web_ui(delegate_->CreateWebUIForRenderManager(url));
+  // TODO(carlosk): confirm this next section copied from SetPendingWebUI
+  // is in fact needed... I need access to the respective navigation entry
+  // though.
+  // If we have assigned (zero or more) bindings to this NavigationEntry in the
+  // past, make sure we're not granting it different bindings than it had
+  // before.  If so, note it and don't give it any bindings, to avoid a
+  // potential privilege escalation.
+  // if (new_web_ui &&
+  //     bindings != NavigationEntryImpl::kInvalidBindings &&
+  //     new_web_ui->GetBindings() != bindings) {
+  //   RecordAction(
+  //       base::UserMetricsAction("ProcessSwapBindingsMismatch_RVHM"));
+  //   new_web_ui.reset();
+  // }
+
+  scoped_ptr<RenderFrameHostImpl> new_render_frame_host;
+
+  // Check if we've already created an RFH for this SiteInstance.  If so, try
+  // to re-use the existing one, which has already been initialized.  We'll
+  // remove it from the list of proxy hosts below if it will be active.
+  RenderFrameProxyHost* proxy = GetRenderFrameProxyHost(new_instance);
+  if (proxy && proxy->render_frame_host()) {
+    // Delete the existing RenderFrameProxyHost, but reuse the RenderFrameHost.
+    // Prevent the process from exiting while we're trying to use it.
+    new_render_frame_host = proxy->PassFrameHostOwnership();
+    new_render_frame_host->GetProcess()->AddPendingView();
+
+    proxy_hosts_.erase(new_instance->GetId());
+    delete proxy;
+
+    // When a new render view is created by the renderer, the new WebContents
+    // gets a RenderViewHost in the SiteInstance of its opener WebContents.
+    // If not used in the first navigation, this RVH is swapped out and is not
+    // granted bindings, so we may need to grant them when swapping it in.
+    if (new_web_ui && !new_render_frame_host->GetProcess()->IsIsolatedGuest()) {
+      int required_bindings = new_web_ui->GetBindings();
+      RenderViewHost* rvh = new_render_frame_host->render_view_host();
+      if ((rvh->GetEnabledBindings() & required_bindings) !=
+          required_bindings) {
+        rvh->AllowBindings(required_bindings);
+      }
+    }
+  } else {
+    // Create a new RenderFrameHost if we don't find an existing one.
+    new_render_frame_host =
+        CreateRenderFrameHost(new_instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE,
+                              false, delegate_->IsHidden());
+    DCHECK(new_render_frame_host);
+    RenderViewHostImpl* rvh = new_render_frame_host->render_view_host();
+
+    // Prevent the process from exiting while we're trying to navigate in it.
+    // Otherwise, if the new RFH is swapped out already, store it.
+    new_render_frame_host->GetProcess()->AddPendingView();
+
+    // Ensure that we have created RFHs for the new RFH's opener chain if
+    // we are staying in the same BrowsingInstance. This allows the new RFH
+    // to send cross-process script calls to its opener(s).
+    int opener_route_id = MSG_ROUTING_NONE;
+    if (new_instance->IsRelatedSiteInstance(old_instance)) {
+      opener_route_id =
+          delegate_->CreateOpenerRenderViewsForRenderManager(new_instance);
+      if (CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kSitePerProcess)) {
+        // Ensure that the frame tree has RenderFrameProxyHosts for the new
+        // SiteInstance in all nodes except the current one.
+        frame_tree_node_->frame_tree()->CreateProxiesForSiteInstance(
+            frame_tree_node_, new_instance);
+      }
+    }
+
+    bool success = InitRenderView(rvh, opener_route_id, MSG_ROUTING_NONE,
+                                  frame_tree_node_->IsMainFrame());
+    if (success) {
+      if (frame_tree_node_->IsMainFrame()) {
+        // Don't show the main frame's view until we know it will be used.
+        rvh->GetView()->Hide();
+      } else {
+        // Init the RFH, so a RenderFrame is created in the renderer.
+        success = InitRenderFrame(new_render_frame_host.get());
+      }
+    }
+    if (!success)
+      return false;
+
+    render_frame_delegate_->RenderFrameCreated(new_render_frame_host.get());
+  }
+
+  DCHECK(new_render_frame_host->GetSiteInstance() == new_instance);
+  speculative_render_frame_host_.reset(new_render_frame_host.release());
+  speculative_web_ui_.reset(new_web_ui.release());
+  return true;
+}
+
 // PlzNavigate
 RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
       const GURL& url,
       ui::PageTransition transition) {
   CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kEnableBrowserSideNavigation));
   // TODO(clamy): When we handle renderer initiated navigations, make sure not
   // to use a different process for subframes if --site-per-process is not
   // enabled.
 
@@ skipping 143 matching lines @@
           controller.GetBrowserContext(), current_entry->GetURL()) ==
        WebUIControllerFactoryRegistry::GetInstance()->GetWebUIType(
           controller.GetBrowserContext(), new_url));
 }
 
 SiteInstance* RenderFrameHostManager::GetSiteInstanceForNavigation(
     const GURL& dest_url,
     SiteInstance* dest_instance,
     ui::PageTransition dest_transition,
     bool dest_is_restore,
-    bool dest_is_view_source_mode) {
+    bool dest_is_view_source_mode,
+    bool create_unbounded_site_instance) {
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
   SiteInstance* new_instance = current_instance;
 
   // We do not currently swap processes for navigations in webview tag guests.
   if (current_instance->GetSiteURL().SchemeIs(kGuestScheme))
     return current_instance;
 
   // Determine if we need a new BrowsingInstance for this entry.  If true, this
   // implies that it will get a new SiteInstance (and likely process), and that
   // other tabs in the current BrowsingInstance will be unable to script it.
@@ skipping 11 matching lines @@
   bool current_is_view_source_mode = current_entry ?
       current_entry->IsViewSourceMode() : dest_is_view_source_mode;
   bool force_swap = ShouldSwapBrowsingInstancesForNavigation(
       current_effective_url,
       current_is_view_source_mode,
       dest_instance,
       SiteInstanceImpl::GetEffectiveURL(browser_context, dest_url),
       dest_is_view_source_mode);
   if (ShouldTransitionCrossSite() || force_swap) {
     new_instance = GetSiteInstanceForURL(
-        dest_url,
-        dest_instance,
-        dest_transition,
-        dest_is_restore,
-        dest_is_view_source_mode,
-        current_instance,
-        force_swap);
+        dest_url, dest_instance, dest_transition, dest_is_restore,
+        dest_is_view_source_mode, current_instance, force_swap,
+        create_unbounded_site_instance);
   }
 
   // If force_swap is true, we must use a different SiteInstance.  If we didn't,
   // we would have two RenderFrameHosts in the same SiteInstance and the same
   // frame, resulting in page_id conflicts for their NavigationEntries.
   if (force_swap)
     CHECK_NE(new_instance, current_instance);
   return new_instance;
 }
 
 SiteInstance* RenderFrameHostManager::GetSiteInstanceForURL(
     const GURL& dest_url,
     SiteInstance* dest_instance,
     ui::PageTransition dest_transition,
     bool dest_is_restore,
     bool dest_is_view_source_mode,
     SiteInstance* current_instance,
-    bool force_browsing_instance_swap) {
+    bool force_browsing_instance_swap,
+    bool create_unbounded_site_instance) {
   NavigationControllerImpl& controller =
       delegate_->GetControllerForRenderManager();
   BrowserContext* browser_context = controller.GetBrowserContext();
 
   // If the entry has an instance already we should use it.
   if (dest_instance) {
     // If we are forcing a swap, this should be in a different BrowsingInstance.
     if (force_browsing_instance_swap) {
       CHECK(!dest_instance->IsRelatedSiteInstance(
                 render_frame_host_->GetSiteInstance()));
     }
     return dest_instance;
   }
 
+  SiteInstanceImpl* current_site_instance =
+      static_cast<SiteInstanceImpl*>(current_instance);
+
   // If a swap is required, we need to force the SiteInstance AND
   // BrowsingInstance to be different ones, using CreateForURL.
-  if (force_browsing_instance_swap)
-    return SiteInstance::CreateForURL(browser_context, dest_url);
+  if (force_browsing_instance_swap) {
+    return CreateSiteInstanceForURL(browser_context, dest_url,
+                                    create_unbounded_site_instance,
+                                    current_site_instance);
+  }
 
   // (UGLY) HEURISTIC, process-per-site only:
   //
   // If this navigation is generated, then it probably corresponds to a search
   // query.  Given that search results typically lead to users navigating to
   // other sites, we don't really want to use the search engine hostname to
   // determine the site instance for this navigation.
   //
   // NOTE: This can be removed once we have a way to transition between
   //       RenderViews in response to a link click.
   //
   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kProcessPerSite) &&
       ui::PageTransitionCoreTypeIs(
           dest_transition, ui::PAGE_TRANSITION_GENERATED)) {
     return current_instance;
   }
 
-  SiteInstanceImpl* current_site_instance =
-      static_cast<SiteInstanceImpl*>(current_instance);
-
   // If we haven't used our SiteInstance (and thus RVH) yet, then we can use it
   // for this entry.  We won't commit the SiteInstance to this site until the
   // navigation commits (in DidNavigate), unless the navigation entry was
   // restored or it's a Web UI as described below.
   if (!current_site_instance->HasSite()) {
     // If we've already created a SiteInstance for our destination, we don't
     // want to use this unused SiteInstance; use the existing one.  (We don't
     // do this check if the current_instance has a site, because for now, we
     // want to compare against the current URL and not the SiteInstance's site.
     // In this case, there is no current URL, so comparing against the site is
     // ok.  See additional comments below.)
     //
     // Also, if the URL should use process-per-site mode and there is an
     // existing process for the site, we should use it.  We can call
     // GetRelatedSiteInstance() for this, which will eagerly set the site and
     // thus use the correct process.
     bool use_process_per_site =
         RenderProcessHost::ShouldUseProcessPerSite(browser_context, dest_url) &&
         RenderProcessHostImpl::GetProcessHostForSite(browser_context, dest_url);
     if (current_site_instance->HasRelatedSiteInstance(dest_url) ||
         use_process_per_site) {
-      return current_site_instance->GetRelatedSiteInstance(dest_url);
+      return GetRelatedSiteInstanceForURL(current_site_instance, dest_url,
+                                          create_unbounded_site_instance);
     }
 
     // For extensions, Web UI URLs (such as the new tab page), and apps we do
     // not want to use the current_instance if it has no site, since it will
     // have a RenderProcessHost of PRIV_NORMAL.  Create a new SiteInstance for
     // this URL instead (with the correct process type).
-    if (current_site_instance->HasWrongProcessForURL(dest_url))
-      return current_site_instance->GetRelatedSiteInstance(dest_url);
+    if (current_site_instance->HasWrongProcessForURL(dest_url)) {
+      return GetRelatedSiteInstanceForURL(current_site_instance, dest_url,
+                                          create_unbounded_site_instance);
+    }
 
     // View-source URLs must use a new SiteInstance and BrowsingInstance.
     // TODO(nasko): This is the same condition as later in the function. This
     // should be taken into account when refactoring this method as part of
     // http://crbug.com/123007.
-    if (dest_is_view_source_mode)
-      return SiteInstance::CreateForURL(browser_context, dest_url);
+    if (dest_is_view_source_mode) {
+      return CreateSiteInstanceForURL(browser_context, dest_url,
+                                      create_unbounded_site_instance,
+                                      current_site_instance);
+    }
 
     // If we are navigating from a blank SiteInstance to a WebUI, make sure we
     // create a new SiteInstance.
     if (WebUIControllerFactoryRegistry::GetInstance()->UseWebUIForURL(
             browser_context, dest_url)) {
-        return SiteInstance::CreateForURL(browser_context, dest_url);
+      return CreateSiteInstanceForURL(browser_context, dest_url,
+                                      create_unbounded_site_instance,
+                                      current_site_instance);
     }
 
     // Normally the "site" on the SiteInstance is set lazily when the load
     // actually commits. This is to support better process sharing in case
     // the site redirects to some other site: we want to use the destination
     // site in the site instance.
     //
     // In the case of session restore, as it loads all the pages immediately
     // we need to set the site first, otherwise after a restore none of the
     // pages would share renderers in process-per-site.
@@ skipping 29 matching lines @@
   }
 
   // View-source URLs must use a new SiteInstance and BrowsingInstance.
   // We don't need a swap when going from view-source to a debug URL like
   // chrome://crash, however.
   // TODO(creis): Refactor this method so this duplicated code isn't needed.
   // See http://crbug.com/123007.
   if (current_entry &&
       current_entry->IsViewSourceMode() != dest_is_view_source_mode &&
       !IsRendererDebugURL(dest_url)) {
-    return SiteInstance::CreateForURL(browser_context, dest_url);
+    return CreateSiteInstanceForURL(browser_context, dest_url,
+                                    create_unbounded_site_instance,
+                                    current_site_instance);
   }
 
   // Use the current SiteInstance for same site navigations, as long as the
   // process type is correct.  (The URL may have been installed as an app since
   // the last time we visited it.)
   const GURL& current_url =
       GetCurrentURLForSiteInstance(current_instance, current_entry);
   if (SiteInstance::IsSameWebSite(browser_context, current_url, dest_url) &&
       !current_site_instance->HasWrongProcessForURL(dest_url)) {
     return current_instance;
   }
 
   // Start the new renderer in a new SiteInstance, but in the current
   // BrowsingInstance.  It is important to immediately give this new
   // SiteInstance to a RenderViewHost (if it is different than our current
   // SiteInstance), so that it is ref counted.  This will happen in
   // CreateRenderView.
+  return GetRelatedSiteInstanceForURL(current_site_instance, dest_url,
+                                      create_unbounded_site_instance);
+}
+
+SiteInstance* RenderFrameHostManager::CreateSiteInstanceForURL(
+    BrowserContext* browser_context,
+    const GURL& dest_url,
+    bool create_unbounded_site_instance,
+    SiteInstanceImpl* current_instance) {
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    if (create_unbounded_site_instance) {
+      return SiteInstance::Create(browser_context);
+    }
+    if (speculative_render_frame_host_) {
+      SiteInstanceImpl* sii = speculative_render_frame_host_->GetSiteInstance();
+      if (!sii->HasSite() && !sii->IsRelatedSiteInstance(current_instance)) {
+        return sii;
+      }
+    }
+  }
+
+  return SiteInstance::CreateForURL(browser_context, dest_url);
+}
+
+SiteInstance* RenderFrameHostManager::GetRelatedSiteInstanceForURL(
+    SiteInstanceImpl* current_instance,
+    const GURL& dest_url,
+    bool create_unbounded_site_instance) {
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    if (!current_instance->HasRelatedSiteInstance(dest_url)) {
+      if (create_unbounded_site_instance) {
+        return current_instance->GetRelatedEmptySiteInstance();
+      }
+      if (speculative_render_frame_host_) {
+        SiteInstanceImpl* sii =
+            speculative_render_frame_host_->GetSiteInstance();
+        if (!sii->HasSite() && sii->IsRelatedSiteInstance(current_instance)) {
+          return sii;
+        }
+      }
+    }
+  }
+
   return current_instance->GetRelatedSiteInstance(dest_url);
 }
 
 const GURL& RenderFrameHostManager::GetCurrentURLForSiteInstance(
     SiteInstance* current_instance, NavigationEntry* current_entry) {
   // If this is a subframe that is potentially out of process from its parent,
   // don't consider using current_entry's url for SiteInstance selection, since
   // current_entry's url is for the main frame and may be in a different site
   // than this frame.
   // TODO(creis): Remove this when we can check the FrameNavigationEntry's url.
@@ skipping 215 matching lines @@
     render_view_host->AllowBindings(pending_web_ui()->GetBindings());
   } else {
     // Ensure that we don't create an unprivileged RenderView in a WebUI-enabled
     // process unless it's swapped out.
     if (render_view_host->is_active()) {
       CHECK(!ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
                 render_view_host->GetProcess()->GetID()));
     }
   }
 
-  return delegate_->CreateRenderViewForRenderManager(render_view_host,
-                                                     opener_route_id,
-                                                     proxy_routing_id,
-                                                     for_main_frame_navigation);
+  return delegate_->CreateRenderViewForRenderManager(
+      render_view_host, opener_route_id, proxy_routing_id,
+      for_main_frame_navigation);
 }
 
 bool RenderFrameHostManager::InitRenderFrame(
     RenderFrameHostImpl* render_frame_host) {
   if (render_frame_host->IsRenderFrameLive())
     return true;
 
   int parent_routing_id = MSG_ROUTING_NONE;
   int proxy_routing_id = MSG_ROUTING_NONE;
   if (frame_tree_node_->parent()) {
@@ skipping 25 matching lines @@
     return render_frame_host_->GetRoutingID();
 
   RenderFrameProxyHostMap::iterator iter =
       proxy_hosts_.find(site_instance->GetId());
   if (iter != proxy_hosts_.end())
     return iter->second->GetRoutingID();
 
   return MSG_ROUTING_NONE;
 }
 
-void RenderFrameHostManager::CommitPending() {
+void RenderFrameHostManager::CommitPending(bool use_speculative_rfh) {
   TRACE_EVENT1("navigation", "RenderFrameHostManager::CommitPending",
                "FrameTreeNode id", frame_tree_node_->frame_tree_node_id());
+  // If use_speculative_rfh then kEnableBrowserSideNavigation must be enabled.
+  CHECK(!use_speculative_rfh ||
+        CommandLine::ForCurrentProcess()->HasSwitch(
+            switches::kEnableBrowserSideNavigation));
+
   // First check whether we're going to want to focus the location bar after
   // this commit.  We do this now because the navigation hasn't formally
   // committed yet, so if we've already cleared |pending_web_ui_| the call chain
   // this triggers won't be able to figure out what's going on.
   bool will_focus_location_bar = delegate_->FocusLocationBarByDefault();
 
-  // Next commit the Web UI, if any. Either replace |web_ui_| with
-  // |pending_web_ui_|, or clear |web_ui_| if there is no pending WebUI, or
-  // leave |web_ui_| as is if reusing it.
-  DCHECK(!(pending_web_ui_.get() && pending_and_current_web_ui_.get()));
-  if (pending_web_ui_) {
-    web_ui_.reset(pending_web_ui_.release());
-  } else if (!pending_and_current_web_ui_.get()) {
-    web_ui_.reset();
+  if (!use_speculative_rfh) {
+    DCHECK(!speculative_web_ui_);
+    // Next commit the Web UI, if any. Either replace |web_ui_| with
+    // |pending_web_ui_|, or clear |web_ui_| if there is no pending WebUI, or
+    // leave |web_ui_| as is if reusing it.
+    DCHECK(!(pending_web_ui_.get() && pending_and_current_web_ui_.get()));
+    if (pending_web_ui_) {
+      web_ui_.reset(pending_web_ui_.release());
+    } else if (!pending_and_current_web_ui_.get()) {
+      web_ui_.reset();
+    } else {
+      DCHECK_EQ(pending_and_current_web_ui_.get(), web_ui_.get());
+      pending_and_current_web_ui_.reset();
+    }
   } else {
-    DCHECK_EQ(pending_and_current_web_ui_.get(), web_ui_.get());
-    pending_and_current_web_ui_.reset();
+    web_ui_.reset(speculative_web_ui_.release());
   }
 
   // It's possible for the pending_render_frame_host_ to be NULL when we aren't
   // crossing process boundaries. If so, we just needed to handle the Web UI
   // committing above and we're done.
-  if (!pending_render_frame_host_) {
+  if (!pending_render_frame_host_ && !use_speculative_rfh) {
     if (will_focus_location_bar)
       delegate_->SetFocusToLocationBar(false);
     return;
   }
 
   // Remember if the page was focused so we can focus the new renderer in
   // that case.
   bool focus_render_view = !will_focus_location_bar &&
       render_frame_host_->render_view_host()->GetView() &&
       render_frame_host_->render_view_host()->GetView()->HasFocus();
 
   bool is_main_frame = frame_tree_node_->IsMainFrame();
 
-  // Swap in the pending frame and make it active. Also ensure the FrameTree
-  // stays in sync.
-  scoped_ptr<RenderFrameHostImpl> old_render_frame_host =
-      SetRenderFrameHost(pending_render_frame_host_.Pass());
+  scoped_ptr<RenderFrameHostImpl> old_render_frame_host;
+  if (!use_speculative_rfh) {
+    DCHECK(!speculative_render_frame_host_);
+    // Swap in the pending frame and make it active. Also ensure the FrameTree
+    // stays in sync.
+    old_render_frame_host =
+        SetRenderFrameHost(pending_render_frame_host_.Pass());
+  } else {
+    DCHECK(speculative_render_frame_host_);
+    old_render_frame_host =
+        SetRenderFrameHost(speculative_render_frame_host_.Pass());
+  }
+
   if (is_main_frame)
     render_frame_host_->render_view_host()->AttachToFrameTree();
 
   // The process will no longer try to exit, so we can decrement the count.
   render_frame_host_->GetProcess()->RemovePendingView();
 
   // Show the new view (or a sad tab) if necessary.
   bool new_rfh_has_view = !!render_frame_host_->render_view_host()->GetView();
   if (!delegate_->IsHidden() && new_rfh_has_view) {
     // In most cases, we need to show the new view.
@@ skipping 106 matching lines @@
   // If we are currently navigating cross-process, we want to get back to normal
   // and then navigate as usual.
   if (cross_navigation_pending_) {
     if (pending_render_frame_host_)
       CancelPending();
     cross_navigation_pending_ = false;
   }
 
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
   scoped_refptr<SiteInstance> new_instance = GetSiteInstanceForNavigation(
-      url, instance, transition, is_restore, is_view_source_mode);
+      url, instance, transition, is_restore, is_view_source_mode, false);
+
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation) &&
+      speculative_render_frame_host_) {
+    if (speculative_render_frame_host_->GetSiteInstance() == new_instance)
+      return speculative_render_frame_host_.get();
+    CleanUpSpeculativeRenderFrameHost();
+  }
 
   const NavigationEntry* current_entry =
       delegate_->GetLastCommittedNavigationEntryForRenderManager();
 
   if (new_instance.get() != current_instance) {
     TRACE_EVENT_INSTANT2(
         "navigation",
         "RenderFrameHostManager::UpdateStateForNavigate:New SiteInstance",
         TRACE_EVENT_SCOPE_THREAD,
         "current_instance id", current_instance->GetId(),
@@ skipping 16 matching lines @@
     }
 
     // Check if our current RFH is live before we set up a transition.
     if (!render_frame_host_->IsRenderFrameLive()) {
       if (!cross_navigation_pending_) {
         // The current RFH is not live.  There's no reason to sit around with a
         // sad tab or a newly created RFH while we wait for the pending RFH to
         // navigate.  Just switch to the pending RFH now and go back to non
         // cross-navigating (Note that we don't care about on{before}unload
         // handlers if the current RFH isn't live.)
-        CommitPending();
+        CommitPending(false);
         return render_frame_host_.get();
       } else {
         NOTREACHED();
         return render_frame_host_.get();
       }
     }
     // Otherwise, it's safe to treat this as a pending cross-site transition.
 
     // We now have a pending RFH.
     DCHECK(!cross_navigation_pending_);
@@ skipping 84 matching lines @@
   scoped_ptr<RenderFrameHostImpl> pending_render_frame_host =
       pending_render_frame_host_.Pass();
 
   RenderViewDevToolsAgentHost::OnCancelPendingNavigation(
       pending_render_frame_host->render_view_host(),
       render_frame_host_->render_view_host());
 
   // We no longer need to prevent the process from exiting.
   pending_render_frame_host->GetProcess()->RemovePendingView();
 
-  // If the SiteInstance for the pending RFH is being used by others, don't
-  // delete the RFH, just swap it out and it can be reused at a later point.
-  SiteInstanceImpl* site_instance =
-      pending_render_frame_host->GetSiteInstance();
-  if (site_instance->active_frame_count() > 1) {
-    // Any currently suspended navigations are no longer needed.
-    pending_render_frame_host->CancelSuspendedNavigations();
-
-    RenderFrameProxyHost* proxy =
-        new RenderFrameProxyHost(site_instance, frame_tree_node_);
-    proxy_hosts_[site_instance->GetId()] = proxy;
-    pending_render_frame_host->SwapOut(proxy);
-    if (frame_tree_node_->IsMainFrame())
-      proxy->TakeFrameHostOwnership(pending_render_frame_host.Pass());
-  } else {
-    // We won't be coming back, so delete this one.
-    pending_render_frame_host.reset();
-  }
+  RecycleRenderFrameHost(pending_render_frame_host.Pass());
 
   pending_web_ui_.reset();
   pending_and_current_web_ui_.reset();
 }
 
+void RenderFrameHostManager::CleanUpSpeculativeRenderFrameHost() {
+  CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableBrowserSideNavigation));
+  if (speculative_render_frame_host_) {
+    speculative_render_frame_host_->GetProcess()->RemovePendingView();
+    RecycleRenderFrameHost(speculative_render_frame_host_.Pass());
+  }
+  if (speculative_web_ui_)
+    speculative_web_ui_.reset();
+}
+
 scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::SetRenderFrameHost(
     scoped_ptr<RenderFrameHostImpl> render_frame_host) {
   // Swap the two.
   scoped_ptr<RenderFrameHostImpl> old_render_frame_host =
       render_frame_host_.Pass();
   render_frame_host_ = render_frame_host.Pass();
 
   if (frame_tree_node_->IsMainFrame()) {
     // Update the count of top-level frames using this SiteInstance.  All
     // subframes are in the same BrowsingInstance as the main frame, so we only
@@ skipping 59 matching lines @@
 void RenderFrameHostManager::DeleteRenderFrameProxyHost(
     SiteInstance* instance) {
   RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end()) {
     delete iter->second;
     proxy_hosts_.erase(iter);
   }
 }
 
 }  // namespace content