Avoid stale navigation requests without excessive page id knowledge in the renderer process.

content/renderer/render_view_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 
 #include "base/auto_reset.h"
@@ skipping 826 matching lines @@
   // This ensures we are in a unique origin that others cannot script.
   if (is_swapped_out_ && webview()->mainFrame()->isWebLocalFrame())
     main_render_frame_->NavigateToSwappedOutURL();
 }
 
 RenderViewImpl::~RenderViewImpl() {
   for (BitmapMap::iterator it = disambiguation_bitmaps_.begin();
        it != disambiguation_bitmaps_.end();
        ++it)
     delete it->second;
-  history_page_ids_.clear();
-
   base::debug::TraceLog::GetInstance()->RemoveProcessLabel(routing_id_);
 
   // If file chooser is still waiting for answer, dispatch empty answer.
   while (!file_chooser_completions_.empty()) {
     if (file_chooser_completions_.front()->completion) {
       file_chooser_completions_.front()->completion->didChooseFile(
           WebVector<WebString>());
     }
     file_chooser_completions_.pop_front();
   }
@@ skipping 478 matching lines @@
     IPC_MESSAGE_HANDLER(ViewMsg_MediaPlayerActionAt, OnMediaPlayerActionAt)
     IPC_MESSAGE_HANDLER(ViewMsg_PluginActionAt, OnPluginActionAt)
     IPC_MESSAGE_HANDLER(ViewMsg_SetActive, OnSetActive)
     IPC_MESSAGE_HANDLER(ViewMsg_GetAllSavableResourceLinksForCurrentPage,
                         OnGetAllSavableResourceLinksForCurrentPage)
     IPC_MESSAGE_HANDLER(
         ViewMsg_GetSerializedHtmlDataForCurrentPageWithLocalLinks,
         OnGetSerializedHtmlDataForCurrentPageWithLocalLinks)
     IPC_MESSAGE_HANDLER(ViewMsg_ShowContextMenu, OnShowContextMenu)
     // TODO(viettrungluu): Move to a separate message filter.
-    IPC_MESSAGE_HANDLER(ViewMsg_SetHistoryLengthAndPrune,
-                        OnSetHistoryLengthAndPrune)
+    IPC_MESSAGE_HANDLER(ViewMsg_SetHistoryOffsetAndLength,
+                        OnSetHistoryOffsetAndLength)
     IPC_MESSAGE_HANDLER(ViewMsg_EnableViewSourceMode, OnEnableViewSourceMode)
     IPC_MESSAGE_HANDLER(ViewMsg_ReleaseDisambiguationPopupBitmap,
                         OnReleaseDisambiguationPopupBitmap)
     IPC_MESSAGE_HANDLER(ViewMsg_WindowSnapshotCompleted,
                         OnWindowSnapshotCompleted)
     IPC_MESSAGE_HANDLER(ViewMsg_ForceRedraw, OnForceRedraw)
     IPC_MESSAGE_HANDLER(ViewMsg_SelectWordAroundCaret, OnSelectWordAroundCaret)
 #if defined(OS_ANDROID)
     IPC_MESSAGE_HANDLER(InputMsg_ActivateNearestFindResult,
                         OnActivateNearestFindResult)
@@ skipping 22 matching lines @@
 
 void RenderViewImpl::OnSelectWordAroundCaret() {
   if (!webview())
     return;
 
   handling_input_event_ = true;
   webview()->focusedFrame()->selectWordAroundCaret();
   handling_input_event_ = false;
 }
 
-bool RenderViewImpl::IsBackForwardToStaleEntry(const PageState& state,
-                                               int pending_history_list_offset,
-                                               int32 page_id,
-                                               bool is_reload) {
-  // Make sure this isn't a back/forward to an entry we have already cropped
-  // or replaced from our history, before the browser knew about it.  If so,
-  // a new navigation has committed in the mean time, and we can ignore this.
-  bool is_back_forward = !is_reload && state.IsValid();
-
-  // Note: if the history_list_length_ is 0 for a back/forward, we must be

[Charlie Reis, 2014/12/03 23:48:07]

Oh, is this the reason you added the SetHistoryOffsetAndLengthForView call to
CreateRenderViewForRenderManager?  That would make sense.

[Avi (use Gerrit), 2014/12/04 21:15:16]

No, and I'm not sure I see what you're talking about here. My reasons were
stated as a reply there; what are you thinking here?

[Charlie Reis, 2014/12/04 23:13:58]

Your other reply said:
'So either we set a flag in the RenderView that says "we were just initialized
and we know that these history list values are bogus so don't worry about the
check" or we do this, to actually set up the values. I chose the latter but am
not attached to it.'

The former approach you describe is the history_list_length_ <= 0 check below. 
(history_list_length_ == -1 means the values are bogus so don't worry about the
check.)

[Avi (use Gerrit), 2014/12/05 22:16:39]

Oh.... right! Yes, got it.

-  // restoring from a previous session.  We'll update our state in OnNavigate.
-  if (!is_back_forward || history_list_length_ <= 0)
-    return false;
-
-  DCHECK_EQ(static_cast<int>(history_page_ids_.size()), history_list_length_);
-
-  // Check for whether the forward history has been cropped due to a recent
-  // navigation the browser didn't know about.
-  if (pending_history_list_offset >= history_list_length_)
-    return true;
-
-  // Check for whether this entry has been replaced with a new one.
-  int expected_page_id =
-      history_page_ids_[pending_history_list_offset];
-  if (expected_page_id > 0 && page_id != expected_page_id) {
-    if (page_id < expected_page_id)
-      return true;
-
-    // Otherwise we've removed an earlier entry and should have shifted all
-    // entries left.  For now, it's ok to lazily update the list.
-    // TODO(creis): Notify all live renderers when we remove entries from
-    // the front of the list, so that we don't hit this case.
-    history_page_ids_[pending_history_list_offset] = page_id;
-  }
-
-  return false;
-}
-
 void RenderViewImpl::OnCopyImageAt(int x, int y) {
   webview()->copyImageAt(WebPoint(x, y));
 }
 
 void RenderViewImpl::OnSaveImageAt(int x, int y) {
   webview()->saveImageAt(WebPoint(x, y));
 }
 
 void RenderViewImpl::OnUpdateTargetURLAck() {
   // Check if there is a targeturl waiting to be sent.
@@ skipping 34 matching lines @@
     has_scrolled_focused_editable_node_into_rect_ = true;
     webview()->scrollFocusedNodeIntoRect(rect);
   }
 }
 
 void RenderViewImpl::OnSetEditCommandsForNextKeyEvent(
     const EditCommands& edit_commands) {
   edit_commands_ = edit_commands;
 }
 
-void RenderViewImpl::OnSetHistoryLengthAndPrune(int history_length,
-                                                int32 minimum_page_id) {
+void RenderViewImpl::OnSetHistoryOffsetAndLength(int history_offset,
+                                                 int history_length) {
+  DCHECK_GE(history_offset, -1);
   DCHECK_GE(history_length, 0);
-  DCHECK(history_list_offset_ == history_list_length_ - 1);
-  DCHECK_GE(minimum_page_id, -1);
 
-  // Generate the new list.
-  std::vector<int32> new_history_page_ids(history_length, -1);
-  for (size_t i = 0; i < history_page_ids_.size(); ++i) {
-    if (minimum_page_id >= 0 && history_page_ids_[i] < minimum_page_id)
-      continue;
-    new_history_page_ids.push_back(history_page_ids_[i]);
-  }
-  new_history_page_ids.swap(history_page_ids_);
-
-  // Update indexes.
-  history_list_length_ = history_page_ids_.size();
-  history_list_offset_ = history_list_length_ - 1;
+  history_list_offset_ = history_offset;
+  history_list_length_ = history_length;
 }
 
-
 void RenderViewImpl::OnSetInitialFocus(bool reverse) {
   if (!webview())
     return;
   webview()->setInitialFocus(reverse);
 }
 
 #if defined(OS_MACOSX)
 void RenderViewImpl::OnSetInLiveResize(bool in_live_resize) {
   if (!webview())
     return;
@@ skipping 2682 matching lines @@
     std::vector<gfx::Size> sizes;
     ConvertToFaviconSizes(icon_urls[i].sizes(), &sizes);
     if (!url.isEmpty())
       urls.push_back(
           FaviconURL(url, ToFaviconType(icon_urls[i].iconType()), sizes));
   }
   SendUpdateFaviconURL(urls);
 }
 
 }  // namespace content