OOPIF: Data URLs are now rendered in the renderer that initiated the navigation.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 143 matching lines @@
   }
   return new_web_ui.Pass();
 }
 
 RenderFrameHostImpl* RenderFrameHostManager::Navigate(
     const NavigationEntryImpl& entry) {
   TRACE_EVENT1("navigation", "RenderFrameHostManager:Navigate",
                "FrameTreeNode id", frame_tree_node_->frame_tree_node_id());
   // Create a pending RenderFrameHost to use for the navigation.
   RenderFrameHostImpl* dest_render_frame_host = UpdateStateForNavigate(
-      entry.GetURL(),
-      entry.site_instance(),
+      entry.GetURL(), entry.source_site_instance(), entry.site_instance(),
       entry.GetTransitionType(),
       entry.restore_type() != NavigationEntryImpl::RESTORE_NONE,
-      entry.IsViewSourceMode(),
-      entry.transferred_global_request_id(),
+      entry.IsViewSourceMode(), entry.transferred_global_request_id(),
       entry.bindings());
   if (!dest_render_frame_host)
     return NULL;  // We weren't able to create a pending render frame host.
 
   // If the current render_frame_host_ isn't live, we should create it so
   // that we don't show a sad tab while the dest_render_frame_host fetches
   // its first page.  (Bug 1145340)
   if (dest_render_frame_host != render_frame_host_ &&
       !render_frame_host_->IsRenderFrameLive()) {
     // Note: we don't call InitRenderView here because we are navigating away
@@ skipping 191 matching lines @@
   // the redirect chain.
   CHECK(transfer_url_chain.size());
   GURL transfer_url = transfer_url_chain.back();
   std::vector<GURL> rest_of_chain = transfer_url_chain;
   rest_of_chain.pop_back();
 
   // We don't know whether the original request had |user_action| set to true.
   // However, since we force the navigation to be in the current tab, it
   // doesn't matter.
   pending_render_frame_host->frame_tree_node()->navigator()->RequestTransferURL(
-      pending_render_frame_host,
-      transfer_url,
-      rest_of_chain,
-      referrer,
-      page_transition,
-      CURRENT_TAB,
-      global_request_id,
-      should_replace_current_entry,
-      true);
+      pending_render_frame_host, transfer_url, nullptr, rest_of_chain, referrer,

[Charlie Reis, 2014/12/06 00:18:50]

Darn.  We don't have the source SiteInstance at this point in time (after server
redirects).  It might still be on the pending entry but that's not guaranteed.

The good news is, that won't break our current use case, since a server redirect
can't go to about:blank, at least in a way that allows you to script the
resulting page.

I suppose nullptr is ok in this case, requiring us to document that it may be
null when we don't know it.  I still think it's worth setting it in the common
case.

[lfg, 2014/12/08 20:45:33]

Done.

+      page_transition, CURRENT_TAB, global_request_id,
+      should_replace_current_entry, true);
 
   // The transferring request was only needed during the RequestTransferURL
   // call, so it is safe to clear at this point.
   cross_site_transferring_request_.reset();
 }
 
 void RenderFrameHostManager::OnDeferredAfterResponseStarted(
     const GlobalRequestID& global_request_id,
     RenderFrameHostImpl* pending_render_frame_host) {
   DCHECK(!response_started_id_.get());
@@ skipping 224 matching lines @@
       ui::PageTransition transition) {
   CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kEnableBrowserSideNavigation));
   // TODO(clamy): When we handle renderer initiated navigations, make sure not
   // to use a different process for subframes if --site-per-process is not
   // enabled.
 
   // Pick the right RenderFrameHost to commit the navigation.
   // TODO(clamy): Replace the default values by the right ones.
   RenderFrameHostImpl* render_frame_host = UpdateStateForNavigate(
-      url, NULL, transition, false, false, GlobalRequestID(),
+      url, nullptr, nullptr, transition, false, false, GlobalRequestID(),
       NavigationEntryImpl::kInvalidBindings);
 
   // If the renderer that needs to navigate is not live (it was just created or
   // it crashed), initialize it.
   if (!render_frame_host->render_view_host()->IsRenderViewLive()) {
     // Recreate the opener chain.
     int opener_route_id = delegate_->CreateOpenerRenderViewsForRenderManager(
         render_frame_host->GetSiteInstance());
     if (!InitRenderView(render_frame_host->render_view_host(),
                         opener_route_id,
                         MSG_ROUTING_NONE,
                         frame_tree_node_->IsMainFrame())) {
-      return NULL;
+      return nullptr;
     }
   }
   return render_frame_host;
 }
 
 void RenderFrameHostManager::Observe(
     int type,
     const NotificationSource& source,
     const NotificationDetails& details) {
   switch (type) {
@@ skipping 113 matching lines @@
       delegate_->GetControllerForRenderManager();
   return current_entry && web_ui_.get() &&
       (WebUIControllerFactoryRegistry::GetInstance()->GetWebUIType(
           controller.GetBrowserContext(), current_entry->GetURL()) ==
        WebUIControllerFactoryRegistry::GetInstance()->GetWebUIType(
           controller.GetBrowserContext(), new_url));
 }
 
 SiteInstance* RenderFrameHostManager::GetSiteInstanceForNavigation(
     const GURL& dest_url,
+    SiteInstance* source_instance,
     SiteInstance* dest_instance,
     ui::PageTransition dest_transition,
     bool dest_is_restore,
     bool dest_is_view_source_mode) {
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
   SiteInstance* new_instance = current_instance;
 
   // We do not currently swap processes for navigations in webview tag guests.
   if (current_instance->GetSiteURL().SchemeIs(kGuestScheme))
     return current_instance;
@@ skipping 15 matching lines @@
   bool current_is_view_source_mode = current_entry ?
       current_entry->IsViewSourceMode() : dest_is_view_source_mode;
   bool force_swap = ShouldSwapBrowsingInstancesForNavigation(
       current_effective_url,
       current_is_view_source_mode,
       dest_instance,
       SiteInstanceImpl::GetEffectiveURL(browser_context, dest_url),
       dest_is_view_source_mode);
   if (ShouldTransitionCrossSite() || force_swap) {
     new_instance = GetSiteInstanceForURL(
-        dest_url,
-        dest_instance,
-        dest_transition,
-        dest_is_restore,
-        dest_is_view_source_mode,
-        current_instance,
+        dest_url, source_instance, dest_instance, dest_transition,
+        dest_is_restore, dest_is_view_source_mode, current_instance,
         force_swap);
   }
 
   // If force_swap is true, we must use a different SiteInstance.  If we didn't,
   // we would have two RenderFrameHosts in the same SiteInstance and the same
   // frame, resulting in page_id conflicts for their NavigationEntries.
   if (force_swap)
     CHECK_NE(new_instance, current_instance);
   return new_instance;
 }
 
 SiteInstance* RenderFrameHostManager::GetSiteInstanceForURL(
     const GURL& dest_url,
+    SiteInstance* source_instance,
     SiteInstance* dest_instance,
     ui::PageTransition dest_transition,
     bool dest_is_restore,
     bool dest_is_view_source_mode,
     SiteInstance* current_instance,
     bool force_browsing_instance_swap) {
   NavigationControllerImpl& controller =
       delegate_->GetControllerForRenderManager();
   BrowserContext* browser_context = controller.GetBrowserContext();
 
@@ skipping 126 matching lines @@
     return SiteInstance::CreateForURL(browser_context, dest_url);
   }
 
   // Use the current SiteInstance for same site navigations, as long as the
   // process type is correct.  (The URL may have been installed as an app since
   // the last time we visited it.)
   const GURL& current_url =
       GetCurrentURLForSiteInstance(current_instance, current_entry);
   if (SiteInstance::IsSameWebSite(browser_context, current_url, dest_url) &&
       !current_site_instance->HasWrongProcessForURL(dest_url)) {
-    return current_instance;
+    return source_instance ? source_instance : current_instance;

[Charlie Reis, 2014/12/06 00:18:50]

Ooh, this is wrong, and if we don't have any tests that would catch it, we
should add one.

Suppose a window on site A is telling another window to go from B1 to B2.  This
logic would load B2 in A's SiteInstance.

We only want to use source_site_instance if the dest_url is about:blank or a
data URL, right?  Oh, and I guess we should test iframe srcdoc as well.  I don't
know that feature as well, but I think it behaves similarly to data URLs.

[lfg, 2014/12/08 20:45:33]

I switched to a specific case instead of using IsSameWebSite(). I looked iframe
srcdoc, and it seems to navigate to about:blank first, which causes the correct
process to be selected, however, after navigating to about:blank it doesn't
render the correct html. We should create a new bug to fix that.

   }
 
   // Start the new renderer in a new SiteInstance, but in the current
   // BrowsingInstance.  It is important to immediately give this new
   // SiteInstance to a RenderViewHost (if it is different than our current
   // SiteInstance), so that it is ref counted.  This will happen in
   // CreateRenderView.
   return current_instance->GetRelatedSiteInstance(dest_url);
 }
 
@@ skipping 438 matching lines @@
       // |rvh| to Shutdown.
       FrameTree* tree = rvh->GetDelegate()->GetFrameTree();
       tree->ForEach(base::Bind(
           &RenderFrameHostManager::ClearProxiesInSiteInstance,
           site_instance_id));
     }
   }
 }
 
 RenderFrameHostImpl* RenderFrameHostManager::UpdateStateForNavigate(
-    const GURL& url,
-    SiteInstance* instance,
-    ui::PageTransition transition,
-    bool is_restore,
-    bool is_view_source_mode,
+    const GURL& dest_url,
+    SiteInstance* source_instance,
+    SiteInstance* dest_instance,
+    ui::PageTransition dest_transition,
+    bool dest_is_restore,
+    bool dest_is_view_source_mode,
     const GlobalRequestID& transferred_request_id,
     int bindings) {
   // If we are currently navigating cross-process, we want to get back to normal
   // and then navigate as usual.
   if (cross_navigation_pending_) {
     if (pending_render_frame_host_)
       CancelPending();
     cross_navigation_pending_ = false;
   }
 
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
   scoped_refptr<SiteInstance> new_instance = GetSiteInstanceForNavigation(
-      url, instance, transition, is_restore, is_view_source_mode);
+      dest_url, source_instance, dest_instance, dest_transition,
+      dest_is_restore, dest_is_view_source_mode);
 
   const NavigationEntry* current_entry =
       delegate_->GetLastCommittedNavigationEntryForRenderManager();
 
   if (new_instance.get() != current_instance) {
     TRACE_EVENT_INSTANT2(
         "navigation",
         "RenderFrameHostManager::UpdateStateForNavigate:New SiteInstance",
         TRACE_EVENT_SCOPE_THREAD,
         "current_instance id", current_instance->GetId(),
         "new_instance id", new_instance->GetId());
 
     // New SiteInstance: create a pending RFH to navigate.
     DCHECK(!cross_navigation_pending_);
 
     // This will possibly create (set to NULL) a Web UI object for the pending
     // page. We'll use this later to give the page special access. This must
     // happen before the new renderer is created below so it will get bindings.
     // It must also happen after the above conditional call to CancelPending(),
     // otherwise CancelPending may clear the pending_web_ui_ and the page will
     // not have its bindings set appropriately.
-    SetPendingWebUI(url, bindings);
+    SetPendingWebUI(dest_url, bindings);
     CreatePendingRenderFrameHost(current_instance, new_instance.get(),
                                  frame_tree_node_->IsMainFrame());
     if (!pending_render_frame_host_.get()) {
       return NULL;
     }
 
     // Check if our current RFH is live before we set up a transition.
     if (!render_frame_host_->IsRenderFrameLive()) {
       if (!cross_navigation_pending_) {
         // The current RFH is not live.  There's no reason to sit around with a
@@ skipping 57 matching lines @@
   // Otherwise the same SiteInstance can be used.  Navigate render_frame_host_.
   DCHECK(!cross_navigation_pending_);
 
   // It's possible to swap out the current RFH and then decide to navigate in it
   // anyway (e.g., a cross-process navigation that redirects back to the
   // original site).  In that case, we have a proxy for the current RFH but
   // haven't deleted it yet.  The new navigation will swap it back in, so we can
   // delete the proxy.
   DeleteRenderFrameProxyHost(new_instance.get());
 
-  if (ShouldReuseWebUI(current_entry, url)) {
+  if (ShouldReuseWebUI(current_entry, dest_url)) {
     pending_web_ui_.reset();
     pending_and_current_web_ui_ = web_ui_->AsWeakPtr();
   } else {
-    SetPendingWebUI(url, bindings);
+    SetPendingWebUI(dest_url, bindings);
     // Make sure the new RenderViewHost has the right bindings.
     if (pending_web_ui() &&
         !render_frame_host_->GetProcess()->IsIsolatedGuest()) {
       render_frame_host_->render_view_host()->AllowBindings(
           pending_web_ui()->GetBindings());
     }
   }
 
   if (pending_web_ui() && render_frame_host_->IsRenderFrameLive()) {
     pending_web_ui()->GetController()->RenderViewReused(
         render_frame_host_->render_view_host());
   }
 
   // The renderer can exit view source mode when any error or cancellation
   // happen. We must overwrite to recover the mode.
-  if (is_view_source_mode) {
+  if (dest_is_view_source_mode) {
     render_frame_host_->render_view_host()->Send(
         new ViewMsg_EnableViewSourceMode(
             render_frame_host_->render_view_host()->GetRoutingID()));
   }
 
   return render_frame_host_.get();
 }
 
 void RenderFrameHostManager::CancelPending() {
   TRACE_EVENT1("navigation", "RenderFrameHostManager::CancelPending",
@@ skipping 86 matching lines @@
 void RenderFrameHostManager::DeleteRenderFrameProxyHost(
     SiteInstance* instance) {
   RenderFrameProxyHostMap::iterator iter = proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end()) {
     delete iter->second;
     proxy_hosts_.erase(iter);
   }
 }
 
 }  // namespace content