content/browser/web_contents/render_view_host_manager_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/strings/utf_string_conversions.h"
   6 #include "content/browser/renderer_host/test_render_view_host.h"
   7 #include "content/browser/site_instance_impl.h"
   8 #include "content/browser/web_contents/navigation_controller_impl.h"
   9 #include "content/browser/web_contents/navigation_entry_impl.h"
  10 #include "content/browser/web_contents/render_view_host_manager.h"
  11 #include "content/browser/webui/web_ui_controller_factory_registry.h"
  12 #include "content/common/view_messages.h"
  13 #include "content/public/browser/notification_details.h"
  14 #include "content/public/browser/notification_service.h"
  15 #include "content/public/browser/notification_source.h"
  16 #include "content/public/browser/notification_types.h"
  17 #include "content/public/browser/render_process_host.h"
  18 #include "content/public/browser/render_view_host_observer.h"
  19 #include "content/public/browser/render_widget_host_iterator.h"
  20 #include "content/public/browser/web_ui_controller.h"
  21 #include "content/public/common/bindings_policy.h"
  22 #include "content/public/common/javascript_message_type.h"
  23 #include "content/public/common/page_transition_types.h"
  24 #include "content/public/common/url_constants.h"
  25 #include "content/public/common/url_utils.h"
  26 #include "content/public/test/mock_render_process_host.h"
  27 #include "content/public/test/test_notification_tracker.h"
  28 #include "content/test/test_content_browser_client.h"
  29 #include "content/test/test_content_client.h"
  30 #include "content/test/test_web_contents.h"
  31 #include "testing/gtest/include/gtest/gtest.h"
  32
  33 namespace content {
  34 namespace {
  35
  36 class RenderViewHostManagerTestWebUIControllerFactory
  37     : public WebUIControllerFactory {
  38  public:
  39   RenderViewHostManagerTestWebUIControllerFactory()
  40     : should_create_webui_(false) {
  41   }
  42   virtual ~RenderViewHostManagerTestWebUIControllerFactory() {}
  43
  44   void set_should_create_webui(bool should_create_webui) {
  45     should_create_webui_ = should_create_webui;
  46   }
  47
  48   // WebUIFactory implementation.
  49   virtual WebUIController* CreateWebUIControllerForURL(
  50       WebUI* web_ui, const GURL& url) const OVERRIDE {
  51     if (!(should_create_webui_ && HasWebUIScheme(url)))
  52       return NULL;
  53     return new WebUIController(web_ui);
  54   }
  55
  56    virtual WebUI::TypeID GetWebUIType(BrowserContext* browser_context,
  57       const GURL& url) const OVERRIDE {
  58     return WebUI::kNoWebUI;
  59   }
  60
  61   virtual bool UseWebUIForURL(BrowserContext* browser_context,
  62                               const GURL& url) const OVERRIDE {
  63     return HasWebUIScheme(url);
  64   }
  65
  66   virtual bool UseWebUIBindingsForURL(BrowserContext* browser_context,
  67                                       const GURL& url) const OVERRIDE {
  68     return HasWebUIScheme(url);
  69   }
  70
  71  private:
  72   bool should_create_webui_;
  73
  74   DISALLOW_COPY_AND_ASSIGN(RenderViewHostManagerTestWebUIControllerFactory);
  75 };
  76
  77 }  // namespace
  78
  79 class RenderViewHostManagerTest
  80     : public RenderViewHostImplTestHarness {
  81  public:
  82   virtual void SetUp() OVERRIDE {
  83     RenderViewHostImplTestHarness::SetUp();
  84     WebUIControllerFactory::RegisterFactory(&factory_);
  85   }
  86
  87   virtual void TearDown() OVERRIDE {
  88     RenderViewHostImplTestHarness::TearDown();
  89     WebUIControllerFactory::UnregisterFactoryForTesting(&factory_);
  90   }
  91
  92   void set_should_create_webui(bool should_create_webui) {
  93     factory_.set_should_create_webui(should_create_webui);
  94   }
  95
  96   void NavigateActiveAndCommit(const GURL& url) {
  97     // Note: we navigate the active RenderViewHost because previous navigations
  98     // won't have committed yet, so NavigateAndCommit does the wrong thing
  99     // for us.
 100     controller().LoadURL(url, Referrer(), PAGE_TRANSITION_LINK, std::string());
 101     TestRenderViewHost* old_rvh = test_rvh();
 102
 103     // Simulate the ShouldClose_ACK that is received from the current renderer
 104     // for a cross-site navigation.
 105     if (old_rvh != active_rvh())
 106       old_rvh->SendShouldCloseACK(true);
 107
 108     // Commit the navigation with a new page ID.
 109     int32 max_page_id = contents()->GetMaxPageIDForSiteInstance(
 110         active_rvh()->GetSiteInstance());
 111
 112     // Simulate the SwapOut_ACK that fires if you commit a cross-site
 113     // navigation.
 114     if (old_rvh != active_rvh())
 115       old_rvh->OnSwappedOut(false);
 116
 117     active_test_rvh()->SendNavigate(max_page_id + 1, url);
 118   }
 119
 120   bool ShouldSwapProcesses(RenderViewHostManager* manager,
 121                            const NavigationEntryImpl* cur_entry,
 122                            const NavigationEntryImpl* new_entry) const {
 123     return manager->ShouldSwapProcessesForNavigation(cur_entry, new_entry);
 124   }
 125
 126   // Creates a test RenderViewHost that's swapped out.
 127   TestRenderViewHost* CreateSwappedOutRenderViewHost() {
 128     const GURL kChromeURL("chrome://foo");
 129     const GURL kDestUrl("http://www.google.com/");
 130
 131     // Navigate our first tab to a chrome url and then to the destination.
 132     NavigateActiveAndCommit(kChromeURL);
 133     TestRenderViewHost* ntp_rvh = static_cast<TestRenderViewHost*>(
 134         contents()->GetRenderManagerForTesting()->current_host());
 135
 136     // Navigate to a cross-site URL.
 137     contents()->GetController().LoadURL(
 138         kDestUrl, Referrer(), PAGE_TRANSITION_LINK, std::string());
 139     EXPECT_TRUE(contents()->cross_navigation_pending());
 140
 141     // Manually increase the number of active views in the
 142     // SiteInstance that ntp_rvh belongs to, to prevent it from being
 143     // destroyed when it gets swapped out.
 144     static_cast<SiteInstanceImpl*>(ntp_rvh->GetSiteInstance())->
 145         increment_active_view_count();
 146
 147     TestRenderViewHost* dest_rvh = static_cast<TestRenderViewHost*>(
 148         contents()->GetRenderManagerForTesting()->pending_render_view_host());
 149     CHECK(dest_rvh);
 150     EXPECT_NE(ntp_rvh, dest_rvh);
 151
 152     // BeforeUnload finishes.
 153     ntp_rvh->SendShouldCloseACK(true);
 154
 155     // Assume SwapOutACK times out, so the dest_rvh proceeds and commits.
 156     dest_rvh->SendNavigate(101, kDestUrl);
 157
 158     EXPECT_TRUE(ntp_rvh->is_swapped_out());
 159     return ntp_rvh;
 160   }
 161
 162  private:
 163   RenderViewHostManagerTestWebUIControllerFactory factory_;
 164 };
 165
 166 // Tests that when you navigate from a chrome:// url to another page, and
 167 // then do that same thing in another tab, that the two resulting pages have
 168 // different SiteInstances, BrowsingInstances, and RenderProcessHosts. This is
 169 // a regression test for bug 9364.
 170 TEST_F(RenderViewHostManagerTest, NewTabPageProcesses) {
 171   set_should_create_webui(true);
 172   const GURL kChromeUrl("chrome://foo");
 173   const GURL kDestUrl("http://www.google.com/");
 174
 175   // Navigate our first tab to the chrome url and then to the destination,
 176   // ensuring we grant bindings to the chrome URL.
 177   NavigateActiveAndCommit(kChromeUrl);
 178   EXPECT_TRUE(active_rvh()->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
 179   NavigateActiveAndCommit(kDestUrl);
 180
 181   // Make a second tab.
 182   scoped_ptr<TestWebContents> contents2(
 183       TestWebContents::Create(browser_context(), NULL));
 184
 185   // Load the two URLs in the second tab. Note that the first navigation creates
 186   // a RVH that's not pending (since there is no cross-site transition), so
 187   // we use the committed one.
 188   contents2->GetController().LoadURL(
 189       kChromeUrl, Referrer(), PAGE_TRANSITION_LINK, std::string());
 190   TestRenderViewHost* ntp_rvh2 = static_cast<TestRenderViewHost*>(
 191       contents2->GetRenderManagerForTesting()->current_host());
 192   EXPECT_FALSE(contents2->cross_navigation_pending());
 193   ntp_rvh2->SendNavigate(100, kChromeUrl);
 194
 195   // The second one is the opposite, creating a cross-site transition and
 196   // requiring a beforeunload ack.
 197   contents2->GetController().LoadURL(
 198       kDestUrl, Referrer(), PAGE_TRANSITION_LINK, std::string());
 199   EXPECT_TRUE(contents2->cross_navigation_pending());
 200   TestRenderViewHost* dest_rvh2 = static_cast<TestRenderViewHost*>(
 201       contents2->GetRenderManagerForTesting()->pending_render_view_host());
 202   ASSERT_TRUE(dest_rvh2);
 203
 204   ntp_rvh2->SendShouldCloseACK(true);
 205   ntp_rvh2->OnSwappedOut(false);
 206   dest_rvh2->SendNavigate(101, kDestUrl);
 207
 208   // The two RVH's should be different in every way.
 209   EXPECT_NE(active_rvh()->GetProcess(), dest_rvh2->GetProcess());
 210   EXPECT_NE(active_rvh()->GetSiteInstance(), dest_rvh2->GetSiteInstance());
 211   EXPECT_FALSE(active_rvh()->GetSiteInstance()->IsRelatedSiteInstance(
 212                    dest_rvh2->GetSiteInstance()));
 213
 214   // Navigate both to the new tab page, and verify that they share a
 215   // RenderProcessHost (not a SiteInstance).
 216   NavigateActiveAndCommit(kChromeUrl);
 217
 218   contents2->GetController().LoadURL(
 219       kChromeUrl, Referrer(), PAGE_TRANSITION_LINK, std::string());
 220   dest_rvh2->SendShouldCloseACK(true);
 221   dest_rvh2->OnSwappedOut(false);
 222   static_cast<TestRenderViewHost*>(contents2->GetRenderManagerForTesting()->
 223      pending_render_view_host())->SendNavigate(102, kChromeUrl);
 224
 225   EXPECT_NE(active_rvh()->GetSiteInstance(),
 226             contents2->GetRenderViewHost()->GetSiteInstance());
 227   EXPECT_EQ(active_rvh()->GetSiteInstance()->GetProcess(),
 228             contents2->GetRenderViewHost()->GetSiteInstance()->GetProcess());
 229 }
 230
 231 // Ensure that the browser ignores most IPC messages that arrive from a
 232 // RenderViewHost that has been swapped out.  We do not want to take
 233 // action on requests from a non-active renderer.  The main exception is
 234 // for synchronous messages, which cannot be ignored without leaving the
 235 // renderer in a stuck state.  See http://crbug.com/93427.
 236 TEST_F(RenderViewHostManagerTest, FilterMessagesWhileSwappedOut) {
 237   const GURL kChromeURL("chrome://foo");
 238   const GURL kDestUrl("http://www.google.com/");
 239
 240   // Navigate our first tab to a chrome url and then to the destination.
 241   NavigateActiveAndCommit(kChromeURL);
 242   TestRenderViewHost* ntp_rvh = static_cast<TestRenderViewHost*>(
 243       contents()->GetRenderManagerForTesting()->current_host());
 244
 245   // Send an update title message and make sure it works.
 246   const string16 ntp_title = ASCIIToUTF16("NTP Title");
 247   WebKit::WebTextDirection direction = WebKit::WebTextDirectionLeftToRight;
 248   EXPECT_TRUE(ntp_rvh->OnMessageReceived(
 249       ViewHostMsg_UpdateTitle(rvh()->GetRoutingID(), 0, ntp_title, direction)));
 250   EXPECT_EQ(ntp_title, contents()->GetTitle());
 251
 252   // Navigate to a cross-site URL.
 253   contents()->GetController().LoadURL(
 254       kDestUrl, Referrer(), PAGE_TRANSITION_LINK, std::string());
 255   EXPECT_TRUE(contents()->cross_navigation_pending());
 256   TestRenderViewHost* dest_rvh = static_cast<TestRenderViewHost*>(
 257       contents()->GetRenderManagerForTesting()->pending_render_view_host());
 258   ASSERT_TRUE(dest_rvh);
 259   EXPECT_NE(ntp_rvh, dest_rvh);
 260
 261   // Create one more view in the same SiteInstance where dest_rvh2
 262   // exists so that it doesn't get deleted on navigation to another
 263   // site.
 264   static_cast<SiteInstanceImpl*>(ntp_rvh->GetSiteInstance())->
 265       increment_active_view_count();
 266
 267   // BeforeUnload finishes.
 268   ntp_rvh->SendShouldCloseACK(true);
 269
 270   // Assume SwapOutACK times out, so the dest_rvh proceeds and commits.
 271   dest_rvh->SendNavigate(101, kDestUrl);
 272
 273   // The new RVH should be able to update its title.
 274   const string16 dest_title = ASCIIToUTF16("Google");
 275   EXPECT_TRUE(dest_rvh->OnMessageReceived(
 276       ViewHostMsg_UpdateTitle(rvh()->GetRoutingID(), 101, dest_title,
 277                               direction)));
 278   EXPECT_EQ(dest_title, contents()->GetTitle());
 279
 280   // The old renderer, being slow, now updates the title. It should be filtered
 281   // out and not take effect.
 282   EXPECT_TRUE(ntp_rvh->is_swapped_out());
 283   EXPECT_TRUE(ntp_rvh->OnMessageReceived(
 284       ViewHostMsg_UpdateTitle(rvh()->GetRoutingID(), 0, ntp_title, direction)));
 285   EXPECT_EQ(dest_title, contents()->GetTitle());
 286
 287   // We cannot filter out synchronous IPC messages, because the renderer would
 288   // be left waiting for a reply.  We pick RunBeforeUnloadConfirm as an example
 289   // that can run easily within a unit test, and that needs to receive a reply
 290   // without showing an actual dialog.
 291   MockRenderProcessHost* ntp_process_host =
 292       static_cast<MockRenderProcessHost*>(ntp_rvh->GetProcess());
 293   ntp_process_host->sink().ClearMessages();
 294   const string16 msg = ASCIIToUTF16("Message");
 295   bool result = false;
 296   string16 unused;
 297   ViewHostMsg_RunBeforeUnloadConfirm before_unload_msg(
 298       rvh()->GetRoutingID(), kChromeURL, msg, false, &result, &unused);
 299   // Enable pumping for check in BrowserMessageFilter::CheckCanDispatchOnUI.
 300   before_unload_msg.EnableMessagePumping();
 301   EXPECT_TRUE(ntp_rvh->OnMessageReceived(before_unload_msg));
 302   EXPECT_TRUE(ntp_process_host->sink().GetUniqueMessageMatching(IPC_REPLY_ID));
 303
 304   // Also test RunJavaScriptMessage.
 305   ntp_process_host->sink().ClearMessages();
 306   ViewHostMsg_RunJavaScriptMessage js_msg(
 307       rvh()->GetRoutingID(), msg, msg, kChromeURL,
 308       JAVASCRIPT_MESSAGE_TYPE_CONFIRM, &result, &unused);
 309   js_msg.EnableMessagePumping();
 310   EXPECT_TRUE(ntp_rvh->OnMessageReceived(js_msg));
 311   EXPECT_TRUE(ntp_process_host->sink().GetUniqueMessageMatching(IPC_REPLY_ID));
 312 }
 313
 314 TEST_F(RenderViewHostManagerTest, WhiteListSwapCompositorFrame) {
 315   TestRenderViewHost* swapped_out_rvh = CreateSwappedOutRenderViewHost();
 316   TestRenderWidgetHostView* swapped_out_rwhv =
 317       static_cast<TestRenderWidgetHostView*>(swapped_out_rvh->GetView());
 318   EXPECT_FALSE(swapped_out_rwhv->did_swap_compositor_frame());
 319
 320   MockRenderProcessHost* process_host =
 321       static_cast<MockRenderProcessHost*>(swapped_out_rvh->GetProcess());
 322   process_host->sink().ClearMessages();
 323
 324   cc::CompositorFrame frame;
 325   ViewHostMsg_SwapCompositorFrame msg(rvh()->GetRoutingID(), 0, frame);
 326
 327   EXPECT_TRUE(swapped_out_rvh->OnMessageReceived(msg));
 328   EXPECT_TRUE(swapped_out_rwhv->did_swap_compositor_frame());
 329 }
 330
 331 TEST_F(RenderViewHostManagerTest, WhiteListDidActivateAcceleratedCompositing) {
 332   TestRenderViewHost* swapped_out_rvh = CreateSwappedOutRenderViewHost();
 333
 334   MockRenderProcessHost* process_host =
 335       static_cast<MockRenderProcessHost*>(swapped_out_rvh->GetProcess());
 336   process_host->sink().ClearMessages();
 337   ViewHostMsg_DidActivateAcceleratedCompositing msg(
 338       rvh()->GetRoutingID(), true);
 339   EXPECT_TRUE(swapped_out_rvh->OnMessageReceived(msg));
 340   EXPECT_TRUE(swapped_out_rvh->is_accelerated_compositing_active());
 341 }
 342
 343 // Test if RenderViewHost::GetRenderWidgetHosts() only returns active
 344 // widgets.
 345 TEST_F(RenderViewHostManagerTest, GetRenderWidgetHostsReturnsActiveViews) {
 346   TestRenderViewHost* swapped_out_rvh = CreateSwappedOutRenderViewHost();
 347   EXPECT_TRUE(swapped_out_rvh->is_swapped_out());
 348
 349   scoped_ptr<RenderWidgetHostIterator> widgets(
 350       RenderWidgetHost::GetRenderWidgetHosts());
 351   // We know that there is the only one active widget. Another view is
 352   // now swapped out, so the swapped out view is not included in the
 353   // list.
 354   RenderWidgetHost* widget = widgets->GetNextHost();
 355   EXPECT_FALSE(widgets->GetNextHost());
 356   RenderViewHost* rvh = RenderViewHost::From(widget);
 357   EXPECT_FALSE(static_cast<RenderViewHostImpl*>(rvh)->is_swapped_out());
 358 }
 359
 360 // Test if RenderViewHost::GetRenderWidgetHosts() returns a subset of
 361 // RenderViewHostImpl::GetAllRenderWidgetHosts().
 362 // RenderViewHost::GetRenderWidgetHosts() returns only active widgets, but
 363 // RenderViewHostImpl::GetAllRenderWidgetHosts() returns everything
 364 // including swapped out ones.
 365 TEST_F(RenderViewHostManagerTest,
 366        GetRenderWidgetHostsWithinGetAllRenderWidgetHosts) {
 367   TestRenderViewHost* swapped_out_rvh = CreateSwappedOutRenderViewHost();
 368   EXPECT_TRUE(swapped_out_rvh->is_swapped_out());
 369
 370   scoped_ptr<RenderWidgetHostIterator> widgets(
 371       RenderWidgetHost::GetRenderWidgetHosts());
 372
 373   while (RenderWidgetHost* w = widgets->GetNextHost()) {
 374     bool found = false;
 375     scoped_ptr<RenderWidgetHostIterator> all_widgets(
 376         RenderWidgetHostImpl::GetAllRenderWidgetHosts());
 377     while (RenderWidgetHost* widget = all_widgets->GetNextHost()) {
 378       if (w == widget) {
 379         found = true;
 380         break;
 381       }
 382     }
 383     EXPECT_TRUE(found);
 384   }
 385 }
 386
 387 // Test if SiteInstanceImpl::active_view_count() is correctly updated
 388 // as views in a SiteInstance get swapped out and in.
 389 TEST_F(RenderViewHostManagerTest, ActiveViewCountWhileSwappingInandOut) {
 390   const GURL kUrl1("http://www.google.com/");
 391   const GURL kUrl2("http://www.chromium.org/");
 392
 393   // Navigate to an initial URL.
 394   contents()->NavigateAndCommit(kUrl1);
 395   TestRenderViewHost* rvh1 = test_rvh();
 396
 397   SiteInstanceImpl* instance1 =
 398       static_cast<SiteInstanceImpl*>(rvh1->GetSiteInstance());
 399   EXPECT_EQ(instance1->active_view_count(), 1U);
 400
 401   // Create 2 new tabs and simulate them being the opener chain for the main
 402   // tab.  They should be in the same SiteInstance.
 403   scoped_ptr<TestWebContents> opener1(
 404       TestWebContents::Create(browser_context(), instance1));
 405   contents()->SetOpener(opener1.get());
 406
 407   scoped_ptr<TestWebContents> opener2(
 408       TestWebContents::Create(browser_context(), instance1));
 409   opener1->SetOpener(opener2.get());
 410
 411   EXPECT_EQ(instance1->active_view_count(), 3U);
 412
 413   // Navigate to a cross-site URL (different SiteInstance but same
 414   // BrowsingInstance).
 415   contents()->NavigateAndCommit(kUrl2);
 416   TestRenderViewHost* rvh2 = test_rvh();
 417   SiteInstanceImpl* instance2 =
 418       static_cast<SiteInstanceImpl*>(rvh2->GetSiteInstance());
 419
 420   // rvh2 is on chromium.org which is different from google.com on
 421   // which other tabs are.
 422   EXPECT_EQ(instance2->active_view_count(), 1U);
 423
 424   // There are two active views on google.com now.
 425   EXPECT_EQ(instance1->active_view_count(), 2U);
 426
 427   // Navigate to the original origin (google.com).
 428   contents()->NavigateAndCommit(kUrl1);
 429
 430   EXPECT_EQ(instance1->active_view_count(), 3U);
 431 }
 432
 433 // This deletes a WebContents when the given RVH is deleted. This is
 434 // only for testing whether deleting an RVH does not cause any UaF in
 435 // other parts of the system. For now, this class is only used for the
 436 // next test cases to detect the bug mentioned at
 437 // http://crbug.com/259859.
 438 class RenderViewHostDestroyer : public content::RenderViewHostObserver {
 439  public:
 440   RenderViewHostDestroyer(RenderViewHost* render_view_host,
 441                           WebContents* web_contents)
 442       : content::RenderViewHostObserver(render_view_host),
 443         web_contents_(web_contents) {}
 444
 445   virtual void RenderViewHostDestroyed(RenderViewHost* render_view_host)
 446       OVERRIDE {
 447     delete web_contents_;
 448   }
 449
 450  private:
 451   WebContents* web_contents_;
 452   DISALLOW_COPY_AND_ASSIGN(RenderViewHostDestroyer);
 453 };
 454
 455 // Test if ShutdownRenderViewHostsInSiteInstance() does not touch any
 456 // RenderWidget that has been freed while deleting a RenderViewHost in
 457 // a previous iteration. This is a regression test for
 458 // http://crbug.com/259859.
 459 TEST_F(RenderViewHostManagerTest,
 460        DetectUseAfterFreeInShutdownRenderViewHostsInSiteInstance) {
 461   const GURL kChromeURL("chrome://newtab");
 462   const GURL kUrl1("http://www.google.com");
 463   const GURL kUrl2("http://www.chromium.org");
 464
 465   // Navigate our first tab to a chrome url and then to the destination.
 466   NavigateActiveAndCommit(kChromeURL);
 467   TestRenderViewHost* ntp_rvh = static_cast<TestRenderViewHost*>(
 468       contents()->GetRenderManagerForTesting()->current_host());
 469
 470   // Create one more tab and navigate to kUrl1.  web_contents is not
 471   // wrapped as scoped_ptr since it intentionally deleted by destroyer
 472   // below as part of this test.
 473   TestWebContents* web_contents =
 474       TestWebContents::Create(browser_context(), ntp_rvh->GetSiteInstance());
 475   web_contents->NavigateAndCommit(kUrl1);
 476   RenderViewHostDestroyer destroyer(ntp_rvh, web_contents);
 477
 478   // This causes the first tab to navigate to kUrl2, which destroys
 479   // the ntp_rvh in ShutdownRenderViewHostsInSiteInstance(). When
 480   // ntp_rvh is destroyed, it also destroys the RVHs in web_contents
 481   // too. This can test whether
 482   // SiteInstanceImpl::ShutdownRenderViewHostsInSiteInstance() can
 483   // touch any object freed in this way or not while iterating through
 484   // all widgets.
 485   contents()->NavigateAndCommit(kUrl2);
 486 }
 487
 488 // When there is an error with the specified page, renderer exits view-source
 489 // mode. See WebFrameImpl::DidFail(). We check by this test that
 490 // EnableViewSourceMode message is sent on every navigation regardless
 491 // RenderView is being newly created or reused.
 492 TEST_F(RenderViewHostManagerTest, AlwaysSendEnableViewSourceMode) {
 493   const GURL kChromeUrl("chrome://foo");
 494   const GURL kUrl("view-source:http://foo");
 495
 496   // We have to navigate to some page at first since without this, the first
 497   // navigation will reuse the SiteInstance created by Init(), and the second
 498   // one will create a new SiteInstance. Because current_instance and
 499   // new_instance will be different, a new RenderViewHost will be created for
 500   // the second navigation. We have to avoid this in order to exercise the
 501   // target code patch.
 502   NavigateActiveAndCommit(kChromeUrl);
 503
 504   // Navigate.
 505   controller().LoadURL(
 506       kUrl, Referrer(), PAGE_TRANSITION_TYPED, std::string());
 507   // Simulate response from RenderView for FirePageBeforeUnload.
 508   base::TimeTicks now = base::TimeTicks::Now();
 509   test_rvh()->OnMessageReceived(ViewHostMsg_ShouldClose_ACK(
 510       rvh()->GetRoutingID(), true, now, now));
 511   ASSERT_TRUE(pending_rvh());  // New pending RenderViewHost will be created.
 512   RenderViewHost* last_rvh = pending_rvh();
 513   int32 new_id = contents()->GetMaxPageIDForSiteInstance(
 514       active_rvh()->GetSiteInstance()) + 1;
 515   pending_test_rvh()->SendNavigate(new_id, kUrl);
 516   EXPECT_EQ(controller().GetLastCommittedEntryIndex(), 1);
 517   ASSERT_TRUE(controller().GetLastCommittedEntry());
 518   EXPECT_TRUE(kUrl == controller().GetLastCommittedEntry()->GetURL());
 519   EXPECT_FALSE(controller().GetPendingEntry());
 520   // Because we're using TestWebContents and TestRenderViewHost in this
 521   // unittest, no one calls WebContentsImpl::RenderViewCreated(). So, we see no
 522   // EnableViewSourceMode message, here.
 523
 524   // Clear queued messages before load.
 525   process()->sink().ClearMessages();
 526   // Navigate, again.
 527   controller().LoadURL(
 528       kUrl, Referrer(), PAGE_TRANSITION_TYPED, std::string());
 529   // The same RenderViewHost should be reused.
 530   EXPECT_FALSE(pending_rvh());
 531   EXPECT_TRUE(last_rvh == rvh());
 532   test_rvh()->SendNavigate(new_id, kUrl);  // The same page_id returned.
 533   EXPECT_EQ(controller().GetLastCommittedEntryIndex(), 1);
 534   EXPECT_FALSE(controller().GetPendingEntry());
 535   // New message should be sent out to make sure to enter view-source mode.
 536   EXPECT_TRUE(process()->sink().GetUniqueMessageMatching(
 537       ViewMsg_EnableViewSourceMode::ID));
 538 }
 539
 540 // Tests the Init function by checking the initial RenderViewHost.
 541 TEST_F(RenderViewHostManagerTest, Init) {
 542   // Using TestBrowserContext.
 543   SiteInstanceImpl* instance =
 544       static_cast<SiteInstanceImpl*>(SiteInstance::Create(browser_context()));
 545   EXPECT_FALSE(instance->HasSite());
 546
 547   scoped_ptr<TestWebContents> web_contents(
 548       TestWebContents::Create(browser_context(), instance));
 549   RenderViewHostManager manager(web_contents.get(), web_contents.get(),
 550                                 web_contents.get());
 551
 552   manager.Init(browser_context(), instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE);
 553
 554   RenderViewHost* host = manager.current_host();
 555   ASSERT_TRUE(host);
 556   EXPECT_EQ(instance, host->GetSiteInstance());
 557   EXPECT_EQ(web_contents.get(), host->GetDelegate());
 558   EXPECT_TRUE(manager.GetRenderWidgetHostView());
 559   EXPECT_FALSE(manager.pending_render_view_host());
 560 }
 561
 562 // Tests the Navigate function. We navigate three sites consecutively and check
 563 // how the pending/committed RenderViewHost are modified.
 564 TEST_F(RenderViewHostManagerTest, Navigate) {
 565   TestNotificationTracker notifications;
 566
 567   SiteInstance* instance = SiteInstance::Create(browser_context());
 568
 569   scoped_ptr<TestWebContents> web_contents(
 570       TestWebContents::Create(browser_context(), instance));
 571   notifications.ListenFor(
 572       NOTIFICATION_RENDER_VIEW_HOST_CHANGED,
 573       Source<NavigationController>(&web_contents->GetController()));
 574
 575   // Create.
 576   RenderViewHostManager manager(web_contents.get(), web_contents.get(),
 577                                 web_contents.get());
 578
 579   manager.Init(browser_context(), instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE);
 580
 581   RenderViewHost* host;
 582
 583   // 1) The first navigation. --------------------------
 584   const GURL kUrl1("http://www.google.com/");
 585   NavigationEntryImpl entry1(
 586       NULL /* instance */, -1 /* page_id */, kUrl1, Referrer(),
 587       string16() /* title */, PAGE_TRANSITION_TYPED,
 588       false /* is_renderer_init */);
 589   host = manager.Navigate(entry1);
 590
 591   // The RenderViewHost created in Init will be reused.
 592   EXPECT_TRUE(host == manager.current_host());
 593   EXPECT_FALSE(manager.pending_render_view_host());
 594
 595   // Commit.
 596   manager.DidNavigateMainFrame(host);
 597   // Commit to SiteInstance should be delayed until RenderView commit.
 598   EXPECT_TRUE(host == manager.current_host());
 599   ASSERT_TRUE(host);
 600   EXPECT_FALSE(static_cast<SiteInstanceImpl*>(host->GetSiteInstance())->
 601       HasSite());
 602   static_cast<SiteInstanceImpl*>(host->GetSiteInstance())->SetSite(kUrl1);
 603
 604   // 2) Navigate to next site. -------------------------
 605   const GURL kUrl2("http://www.google.com/foo");
 606   NavigationEntryImpl entry2(
 607       NULL /* instance */, -1 /* page_id */, kUrl2,
 608       Referrer(kUrl1, WebKit::WebReferrerPolicyDefault),
 609       string16() /* title */, PAGE_TRANSITION_LINK,
 610       true /* is_renderer_init */);
 611   host = manager.Navigate(entry2);
 612
 613   // The RenderViewHost created in Init will be reused.
 614   EXPECT_TRUE(host == manager.current_host());
 615   EXPECT_FALSE(manager.pending_render_view_host());
 616
 617   // Commit.
 618   manager.DidNavigateMainFrame(host);
 619   EXPECT_TRUE(host == manager.current_host());
 620   ASSERT_TRUE(host);
 621   EXPECT_TRUE(static_cast<SiteInstanceImpl*>(host->GetSiteInstance())->
 622       HasSite());
 623
 624   // 3) Cross-site navigate to next site. --------------
 625   const GURL kUrl3("http://webkit.org/");
 626   NavigationEntryImpl entry3(
 627       NULL /* instance */, -1 /* page_id */, kUrl3,
 628       Referrer(kUrl2, WebKit::WebReferrerPolicyDefault),
 629       string16() /* title */, PAGE_TRANSITION_LINK,
 630       false /* is_renderer_init */);
 631   host = manager.Navigate(entry3);
 632
 633   // A new RenderViewHost should be created.
 634   EXPECT_TRUE(manager.pending_render_view_host());
 635   ASSERT_EQ(host, manager.pending_render_view_host());
 636
 637   notifications.Reset();
 638
 639   // Commit.
 640   manager.DidNavigateMainFrame(manager.pending_render_view_host());
 641   EXPECT_TRUE(host == manager.current_host());
 642   ASSERT_TRUE(host);
 643   EXPECT_TRUE(static_cast<SiteInstanceImpl*>(host->GetSiteInstance())->
 644       HasSite());
 645   // Check the pending RenderViewHost has been committed.
 646   EXPECT_FALSE(manager.pending_render_view_host());
 647
 648   // We should observe a notification.
 649   EXPECT_TRUE(notifications.Check1AndReset(
 650       NOTIFICATION_RENDER_VIEW_HOST_CHANGED));
 651 }
 652
 653 // Tests the Navigate function. In this unit test we verify that the Navigate
 654 // function can handle a new navigation event before the previous navigation
 655 // has been committed. This is also a regression test for
 656 // http://crbug.com/104600.
 657 TEST_F(RenderViewHostManagerTest, NavigateWithEarlyReNavigation) {
 658   TestNotificationTracker notifications;
 659
 660   SiteInstance* instance = SiteInstance::Create(browser_context());
 661
 662   scoped_ptr<TestWebContents> web_contents(
 663       TestWebContents::Create(browser_context(), instance));
 664   notifications.ListenFor(
 665       NOTIFICATION_RENDER_VIEW_HOST_CHANGED,
 666       Source<NavigationController>(&web_contents->GetController()));
 667
 668   // Create.
 669   RenderViewHostManager manager(web_contents.get(), web_contents.get(),
 670                                 web_contents.get());
 671
 672   manager.Init(browser_context(), instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE);
 673
 674   // 1) The first navigation. --------------------------
 675   const GURL kUrl1("http://www.google.com/");
 676   NavigationEntryImpl entry1(NULL /* instance */, -1 /* page_id */, kUrl1,
 677                              Referrer(), string16() /* title */,
 678                              PAGE_TRANSITION_TYPED,
 679                              false /* is_renderer_init */);
 680   RenderViewHost* host = manager.Navigate(entry1);
 681
 682   // The RenderViewHost created in Init will be reused.
 683   EXPECT_TRUE(host == manager.current_host());
 684   EXPECT_FALSE(manager.pending_render_view_host());
 685
 686   // We should observe a notification.
 687   EXPECT_TRUE(notifications.Check1AndReset(
 688       NOTIFICATION_RENDER_VIEW_HOST_CHANGED));
 689   notifications.Reset();
 690
 691   // Commit.
 692   manager.DidNavigateMainFrame(host);
 693
 694   // Commit to SiteInstance should be delayed until RenderView commit.
 695   EXPECT_TRUE(host == manager.current_host());
 696   ASSERT_TRUE(host);
 697   EXPECT_FALSE(static_cast<SiteInstanceImpl*>(host->GetSiteInstance())->
 698       HasSite());
 699   static_cast<SiteInstanceImpl*>(host->GetSiteInstance())->SetSite(kUrl1);
 700
 701   // 2) Cross-site navigate to next site. -------------------------
 702   const GURL kUrl2("http://www.example.com");
 703   NavigationEntryImpl entry2(
 704       NULL /* instance */, -1 /* page_id */, kUrl2, Referrer(),
 705       string16() /* title */, PAGE_TRANSITION_TYPED,
 706       false /* is_renderer_init */);
 707   RenderViewHostImpl* host2 = static_cast<RenderViewHostImpl*>(
 708       manager.Navigate(entry2));
 709   int host2_process_id = host2->GetProcess()->GetID();
 710
 711   // A new RenderViewHost should be created.
 712   EXPECT_TRUE(manager.pending_render_view_host());
 713   ASSERT_EQ(host2, manager.pending_render_view_host());
 714   EXPECT_NE(host2, host);
 715
 716   // Check that the navigation is still suspended because the old RVH
 717   // is not swapped out, yet.
 718   EXPECT_TRUE(host2->are_navigations_suspended());
 719   MockRenderProcessHost* test_process_host2 =
 720       static_cast<MockRenderProcessHost*>(host2->GetProcess());
 721   test_process_host2->sink().ClearMessages();
 722   host2->NavigateToURL(kUrl2);
 723   EXPECT_FALSE(test_process_host2->sink().GetUniqueMessageMatching(
 724       ViewMsg_Navigate::ID));
 725
 726   // Allow closing the current Render View (precondition for swapping out
 727   // the RVH): Simulate response from RenderView for ViewMsg_ShouldClose sent by
 728   // FirePageBeforeUnload.
 729   TestRenderViewHost* test_host = static_cast<TestRenderViewHost*>(host);
 730   MockRenderProcessHost* test_process_host =
 731       static_cast<MockRenderProcessHost*>(test_host->GetProcess());
 732   EXPECT_TRUE(test_process_host->sink().GetUniqueMessageMatching(
 733       ViewMsg_ShouldClose::ID));
 734   test_host->SendShouldCloseACK(true);
 735
 736   // CrossSiteResourceHandler::StartCrossSiteTransition triggers a
 737   // call of RenderViewHostManager::SwapOutOldPage before
 738   // RenderViewHostManager::DidNavigateMainFrame is called.
 739   // The RVH is not swapped out until the commit.
 740   manager.SwapOutOldPage();
 741   EXPECT_TRUE(test_process_host->sink().GetUniqueMessageMatching(
 742       ViewMsg_SwapOut::ID));
 743   test_host->OnSwappedOut(false);
 744
 745   EXPECT_EQ(host, manager.current_host());
 746   EXPECT_FALSE(static_cast<RenderViewHostImpl*>(
 747       manager.current_host())->is_swapped_out());
 748   EXPECT_EQ(host2, manager.pending_render_view_host());
 749   // There should be still no navigation messages being sent.
 750   EXPECT_FALSE(test_process_host2->sink().GetUniqueMessageMatching(
 751       ViewMsg_Navigate::ID));
 752
 753   // 3) Cross-site navigate to next site before 2) has committed. --------------
 754   const GURL kUrl3("http://webkit.org/");
 755   NavigationEntryImpl entry3(NULL /* instance */, -1 /* page_id */, kUrl3,
 756                              Referrer(), string16() /* title */,
 757                              PAGE_TRANSITION_TYPED,
 758                              false /* is_renderer_init */);
 759   test_process_host->sink().ClearMessages();
 760   RenderViewHost* host3 = manager.Navigate(entry3);
 761
 762   // A new RenderViewHost should be created. host2 is now deleted.
 763   EXPECT_TRUE(manager.pending_render_view_host());
 764   ASSERT_EQ(host3, manager.pending_render_view_host());
 765   EXPECT_NE(host3, host);
 766   EXPECT_NE(host3->GetProcess()->GetID(), host2_process_id);
 767
 768   // Navigations in the new RVH should be suspended, which is ok because the
 769   // old RVH is not yet swapped out and can respond to a second beforeunload
 770   // request.
 771   EXPECT_TRUE(static_cast<RenderViewHostImpl*>(
 772       host3)->are_navigations_suspended());
 773   EXPECT_EQ(host, manager.current_host());
 774   EXPECT_FALSE(static_cast<RenderViewHostImpl*>(
 775       manager.current_host())->is_swapped_out());
 776
 777   // Simulate a response to the second beforeunload request.
 778   EXPECT_TRUE(test_process_host->sink().GetUniqueMessageMatching(
 779       ViewMsg_ShouldClose::ID));
 780   test_host->SendShouldCloseACK(true);
 781
 782   // CrossSiteResourceHandler::StartCrossSiteTransition triggers a
 783   // call of RenderViewHostManager::SwapOutOldPage before
 784   // RenderViewHostManager::DidNavigateMainFrame is called.
 785   // The RVH is not swapped out until the commit.
 786   manager.SwapOutOldPage();
 787   EXPECT_TRUE(test_process_host->sink().GetUniqueMessageMatching(
 788       ViewMsg_SwapOut::ID));
 789   test_host->OnSwappedOut(false);
 790
 791   // Commit.
 792   manager.DidNavigateMainFrame(host3);
 793   EXPECT_TRUE(host3 == manager.current_host());
 794   ASSERT_TRUE(host3);
 795   EXPECT_TRUE(static_cast<SiteInstanceImpl*>(host3->GetSiteInstance())->
 796       HasSite());
 797   // Check the pending RenderViewHost has been committed.
 798   EXPECT_FALSE(manager.pending_render_view_host());
 799
 800   // We should observe a notification.
 801   EXPECT_TRUE(notifications.Check1AndReset(
 802       NOTIFICATION_RENDER_VIEW_HOST_CHANGED));
 803 }
 804
 805 // Tests WebUI creation.
 806 TEST_F(RenderViewHostManagerTest, WebUI) {
 807   set_should_create_webui(true);
 808   SiteInstance* instance = SiteInstance::Create(browser_context());
 809
 810   scoped_ptr<TestWebContents> web_contents(
 811       TestWebContents::Create(browser_context(), instance));
 812   RenderViewHostManager manager(web_contents.get(), web_contents.get(),
 813                                 web_contents.get());
 814
 815   manager.Init(browser_context(), instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE);
 816   EXPECT_FALSE(manager.current_host()->IsRenderViewLive());
 817
 818   const GURL kUrl("chrome://foo");
 819   NavigationEntryImpl entry(NULL /* instance */, -1 /* page_id */, kUrl,
 820                             Referrer(), string16() /* title */,
 821                             PAGE_TRANSITION_TYPED,
 822                             false /* is_renderer_init */);
 823   RenderViewHost* host = manager.Navigate(entry);
 824
 825   // We commit the pending RenderViewHost immediately because the previous
 826   // RenderViewHost was not live.  We test a case where it is live in
 827   // WebUIInNewTab.
 828   EXPECT_TRUE(host);
 829   EXPECT_EQ(host, manager.current_host());
 830   EXPECT_FALSE(manager.pending_render_view_host());
 831
 832   // It's important that the site instance get set on the Web UI page as soon
 833   // as the navigation starts, rather than lazily after it commits, so we don't
 834   // try to re-use the SiteInstance/process for non Web UI things that may
 835   // get loaded in between.
 836   EXPECT_TRUE(static_cast<SiteInstanceImpl*>(host->GetSiteInstance())->
 837       HasSite());
 838   EXPECT_EQ(kUrl, host->GetSiteInstance()->GetSiteURL());
 839
 840   // The Web UI is committed immediately because the RenderViewHost has not been
 841   // used yet. UpdateRendererStateForNavigate() took the short cut path.
 842   EXPECT_FALSE(manager.pending_web_ui());
 843   EXPECT_TRUE(manager.web_ui());
 844
 845   // Commit.
 846   manager.DidNavigateMainFrame(host);
 847   EXPECT_TRUE(host->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
 848 }
 849
 850 // Tests that we can open a WebUI link in a new tab from a WebUI page and still
 851 // grant the correct bindings.  http://crbug.com/189101.
 852 TEST_F(RenderViewHostManagerTest, WebUIInNewTab) {
 853   set_should_create_webui(true);
 854   SiteInstance* blank_instance = SiteInstance::Create(browser_context());
 855
 856   // Create a blank tab.
 857   scoped_ptr<TestWebContents> web_contents1(
 858       TestWebContents::Create(browser_context(), blank_instance));
 859   RenderViewHostManager manager1(web_contents1.get(), web_contents1.get(),
 860                                  web_contents1.get());
 861   manager1.Init(
 862       browser_context(), blank_instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE);
 863   // Test the case that new RVH is considered live.
 864   manager1.current_host()->CreateRenderView(string16(), -1, -1);
 865
 866   // Navigate to a WebUI page.
 867   const GURL kUrl1("chrome://foo");
 868   NavigationEntryImpl entry1(NULL /* instance */, -1 /* page_id */, kUrl1,
 869                              Referrer(), string16() /* title */,
 870                              PAGE_TRANSITION_TYPED,
 871                              false /* is_renderer_init */);
 872   RenderViewHost* host1 = manager1.Navigate(entry1);
 873
 874   // We should have a pending navigation to the WebUI RenderViewHost.
 875   // It should already have bindings.
 876   EXPECT_EQ(host1, manager1.pending_render_view_host());
 877   EXPECT_NE(host1, manager1.current_host());
 878   EXPECT_TRUE(host1->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
 879
 880   // Commit and ensure we still have bindings.
 881   manager1.DidNavigateMainFrame(host1);
 882   SiteInstance* webui_instance = host1->GetSiteInstance();
 883   EXPECT_EQ(host1, manager1.current_host());
 884   EXPECT_TRUE(host1->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
 885
 886   // Now simulate clicking a link that opens in a new tab.
 887   scoped_ptr<TestWebContents> web_contents2(
 888       TestWebContents::Create(browser_context(), webui_instance));
 889   RenderViewHostManager manager2(web_contents2.get(), web_contents2.get(),
 890                                  web_contents2.get());
 891   manager2.Init(
 892       browser_context(), webui_instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE);
 893   // Make sure the new RVH is considered live.  This is usually done in
 894   // RenderWidgetHost::Init when opening a new tab from a link.
 895   manager2.current_host()->CreateRenderView(string16(), -1, -1);
 896
 897   const GURL kUrl2("chrome://foo/bar");
 898   NavigationEntryImpl entry2(NULL /* instance */, -1 /* page_id */, kUrl2,
 899                              Referrer(), string16() /* title */,
 900                              PAGE_TRANSITION_LINK,
 901                              true /* is_renderer_init */);
 902   RenderViewHost* host2 = manager2.Navigate(entry2);
 903
 904   // No cross-process transition happens because we are already in the right
 905   // SiteInstance.  We should grant bindings immediately.
 906   EXPECT_EQ(host2, manager2.current_host());
 907   EXPECT_TRUE(host2->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
 908
 909   manager2.DidNavigateMainFrame(host2);
 910 }
 911
 912 // Tests that we don't end up in an inconsistent state if a page does a back and
 913 // then reload. http://crbug.com/51680
 914 TEST_F(RenderViewHostManagerTest, PageDoesBackAndReload) {
 915   const GURL kUrl1("http://www.google.com/");
 916   const GURL kUrl2("http://www.evil-site.com/");
 917
 918   // Navigate to a safe site, then an evil site.
 919   // This will switch RenderViewHosts.  We cannot assert that the first and
 920   // second RVHs are different, though, because the first one may be promptly
 921   // deleted.
 922   contents()->NavigateAndCommit(kUrl1);
 923   contents()->NavigateAndCommit(kUrl2);
 924   RenderViewHost* evil_rvh = contents()->GetRenderViewHost();
 925
 926   // Now let's simulate the evil page calling history.back().
 927   contents()->OnGoToEntryAtOffset(-1);
 928   // We should have a new pending RVH.
 929   // Note that in this case, the navigation has not committed, so evil_rvh will
 930   // not be deleted yet.
 931   EXPECT_NE(evil_rvh, contents()->GetRenderManagerForTesting()->
 932       pending_render_view_host());
 933
 934   // Before that RVH has committed, the evil page reloads itself.
 935   ViewHostMsg_FrameNavigate_Params params;
 936   params.page_id = 1;
 937   params.url = kUrl2;
 938   params.transition = PAGE_TRANSITION_CLIENT_REDIRECT;
 939   params.should_update_history = false;
 940   params.gesture = NavigationGestureAuto;
 941   params.was_within_same_page = false;
 942   params.is_post = false;
 943   params.page_state = PageState::CreateFromURL(kUrl2);
 944   contents()->DidNavigate(evil_rvh, params);
 945
 946   // That should have cancelled the pending RVH, and the evil RVH should be the
 947   // current one.
 948   EXPECT_TRUE(contents()->GetRenderManagerForTesting()->
 949       pending_render_view_host() == NULL);
 950   EXPECT_EQ(evil_rvh, contents()->GetRenderManagerForTesting()->current_host());
 951
 952   // Also we should not have a pending navigation entry.
 953   NavigationEntry* entry = contents()->GetController().GetActiveEntry();
 954   ASSERT_TRUE(entry != NULL);
 955   EXPECT_EQ(kUrl2, entry->GetURL());
 956 }
 957
 958 // Ensure that we can go back and forward even if a SwapOut ACK isn't received.
 959 // See http://crbug.com/93427.
 960 TEST_F(RenderViewHostManagerTest, NavigateAfterMissingSwapOutACK) {
 961   const GURL kUrl1("http://www.google.com/");
 962   const GURL kUrl2("http://www.chromium.org/");
 963
 964   // Navigate to two pages.
 965   contents()->NavigateAndCommit(kUrl1);
 966   TestRenderViewHost* rvh1 = test_rvh();
 967
 968   // Keep active_view_count nonzero so that no swapped out views in
 969   // this SiteInstance get forcefully deleted.
 970   static_cast<SiteInstanceImpl*>(rvh1->GetSiteInstance())->
 971       increment_active_view_count();
 972
 973   contents()->NavigateAndCommit(kUrl2);
 974   TestRenderViewHost* rvh2 = test_rvh();
 975   static_cast<SiteInstanceImpl*>(rvh2->GetSiteInstance())->
 976       increment_active_view_count();
 977
 978   // Now go back, but suppose the SwapOut_ACK isn't received.  This shouldn't
 979   // happen, but we have seen it when going back quickly across many entries
 980   // (http://crbug.com/93427).
 981   contents()->GetController().GoBack();
 982   EXPECT_TRUE(rvh2->is_waiting_for_beforeunload_ack());
 983   contents()->ProceedWithCrossSiteNavigation();
 984   EXPECT_FALSE(rvh2->is_waiting_for_beforeunload_ack());
 985   rvh2->SwapOut();
 986   EXPECT_TRUE(rvh2->is_waiting_for_unload_ack());
 987
 988   // The back navigation commits.  We should proactively clear the
 989   // is_waiting_for_unload_ack state to be safe.
 990   const NavigationEntry* entry1 = contents()->GetController().GetPendingEntry();
 991   rvh1->SendNavigate(entry1->GetPageID(), entry1->GetURL());
 992   EXPECT_TRUE(rvh2->is_swapped_out());
 993   EXPECT_FALSE(rvh2->is_waiting_for_unload_ack());
 994
 995   // We should be able to navigate forward.
 996   contents()->GetController().GoForward();
 997   contents()->ProceedWithCrossSiteNavigation();
 998   const NavigationEntry* entry2 = contents()->GetController().GetPendingEntry();
 999   rvh2->SendNavigate(entry2->GetPageID(), entry2->GetURL());
1000   EXPECT_EQ(rvh2, rvh());
1001   EXPECT_FALSE(rvh2->is_swapped_out());
1002   EXPECT_TRUE(rvh1->is_swapped_out());
1003 }
1004
1005 // Test that we create swapped out RVHs for the opener chain when navigating an
1006 // opened tab cross-process.  This allows us to support certain cross-process
1007 // JavaScript calls (http://crbug.com/99202).
1008 TEST_F(RenderViewHostManagerTest, CreateSwappedOutOpenerRVHs) {
1009   const GURL kUrl1("http://www.google.com/");
1010   const GURL kUrl2("http://www.chromium.org/");
1011   const GURL kChromeUrl("chrome://foo");
1012
1013   // Navigate to an initial URL.
1014   contents()->NavigateAndCommit(kUrl1);
1015   RenderViewHostManager* manager = contents()->GetRenderManagerForTesting();
1016   TestRenderViewHost* rvh1 = test_rvh();
1017
1018   // Create 2 new tabs and simulate them being the opener chain for the main
1019   // tab.  They should be in the same SiteInstance.
1020   scoped_ptr<TestWebContents> opener1(
1021       TestWebContents::Create(browser_context(), rvh1->GetSiteInstance()));
1022   RenderViewHostManager* opener1_manager =
1023       opener1->GetRenderManagerForTesting();
1024   contents()->SetOpener(opener1.get());
1025
1026   scoped_ptr<TestWebContents> opener2(
1027       TestWebContents::Create(browser_context(), rvh1->GetSiteInstance()));
1028   RenderViewHostManager* opener2_manager =
1029       opener2->GetRenderManagerForTesting();
1030   opener1->SetOpener(opener2.get());
1031
1032   // Navigate to a cross-site URL (different SiteInstance but same
1033   // BrowsingInstance).
1034   contents()->NavigateAndCommit(kUrl2);
1035   TestRenderViewHost* rvh2 = test_rvh();
1036   EXPECT_NE(rvh1->GetSiteInstance(), rvh2->GetSiteInstance());
1037   EXPECT_TRUE(rvh1->GetSiteInstance()->IsRelatedSiteInstance(
1038                   rvh2->GetSiteInstance()));
1039
1040   // Ensure rvh1 is placed on swapped out list of the current tab.
1041   EXPECT_TRUE(manager->IsOnSwappedOutList(rvh1));
1042   EXPECT_EQ(rvh1,
1043             manager->GetSwappedOutRenderViewHost(rvh1->GetSiteInstance()));
1044
1045   // Ensure a swapped out RVH is created in the first opener tab.
1046   TestRenderViewHost* opener1_rvh = static_cast<TestRenderViewHost*>(
1047       opener1_manager->GetSwappedOutRenderViewHost(rvh2->GetSiteInstance()));
1048   EXPECT_TRUE(opener1_manager->IsOnSwappedOutList(opener1_rvh));
1049   EXPECT_TRUE(opener1_rvh->is_swapped_out());
1050
1051   // Ensure a swapped out RVH is created in the second opener tab.
1052   TestRenderViewHost* opener2_rvh = static_cast<TestRenderViewHost*>(
1053       opener2_manager->GetSwappedOutRenderViewHost(rvh2->GetSiteInstance()));
1054   EXPECT_TRUE(opener2_manager->IsOnSwappedOutList(opener2_rvh));
1055   EXPECT_TRUE(opener2_rvh->is_swapped_out());
1056
1057   // Navigate to a cross-BrowsingInstance URL.
1058   contents()->NavigateAndCommit(kChromeUrl);
1059   TestRenderViewHost* rvh3 = test_rvh();
1060   EXPECT_NE(rvh1->GetSiteInstance(), rvh3->GetSiteInstance());
1061   EXPECT_FALSE(rvh1->GetSiteInstance()->IsRelatedSiteInstance(
1062                    rvh3->GetSiteInstance()));
1063
1064   // No scripting is allowed across BrowsingInstances, so we should not create
1065   // swapped out RVHs for the opener chain in this case.
1066   EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
1067                    rvh3->GetSiteInstance()));
1068   EXPECT_FALSE(opener2_manager->GetSwappedOutRenderViewHost(
1069                    rvh3->GetSiteInstance()));
1070 }
1071
1072 // Test that we clean up swapped out RenderViewHosts when a process hosting
1073 // those associated RenderViews crashes. http://crbug.com/258993
1074 TEST_F(RenderViewHostManagerTest, CleanUpSwappedOutRVHOnProcessCrash) {
1075   const GURL kUrl1("http://www.google.com/");
1076
1077   // Navigate to an initial URL.
1078   contents()->NavigateAndCommit(kUrl1);
1079   TestRenderViewHost* rvh1 = test_rvh();
1080
1081   // Create a new tab as an opener for the main tab.
1082   scoped_ptr<TestWebContents> opener1(
1083       TestWebContents::Create(browser_context(), rvh1->GetSiteInstance()));
1084   RenderViewHostManager* opener1_manager =
1085       opener1->GetRenderManagerForTesting();
1086   contents()->SetOpener(opener1.get());
1087
1088   EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
1089       rvh1->GetSiteInstance()));
1090   opener1->CreateSwappedOutRenderView(rvh1->GetSiteInstance());
1091   EXPECT_TRUE(opener1_manager->GetSwappedOutRenderViewHost(
1092       rvh1->GetSiteInstance()));
1093
1094   // Fake a process crash.
1095   RenderProcessHost::RendererClosedDetails details(
1096       rvh1->GetProcess()->GetHandle(),
1097       base::TERMINATION_STATUS_PROCESS_CRASHED,
1098       0);
1099   NotificationService::current()->Notify(
1100       NOTIFICATION_RENDERER_PROCESS_CLOSED,
1101       Source<RenderProcessHost>(rvh1->GetProcess()),
1102       Details<RenderProcessHost::RendererClosedDetails>(&details));
1103   rvh1->set_render_view_created(false);
1104
1105   // Ensure that the swapped out RenderViewHost has been deleted.
1106   EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
1107       rvh1->GetSiteInstance()));
1108
1109   // Reload the initial tab. This should recreate the opener.
1110   contents()->GetController().Reload(true);
1111
1112   EXPECT_EQ(opener1_manager->current_host()->GetRoutingID(),
1113             test_rvh()->opener_route_id());
1114 }
1115
1116 // Test that RenderViewHosts created for WebUI navigations are properly
1117 // granted WebUI bindings even if an unprivileged swapped out RenderViewHost
1118 // is in the same process (http://crbug.com/79918).
1119 TEST_F(RenderViewHostManagerTest, EnableWebUIWithSwappedOutOpener) {
1120   set_should_create_webui(true);
1121   const GURL kSettingsUrl("chrome://chrome/settings");
1122   const GURL kPluginUrl("chrome://plugins");
1123
1124   // Navigate to an initial WebUI URL.
1125   contents()->NavigateAndCommit(kSettingsUrl);
1126
1127   // Ensure the RVH has WebUI bindings.
1128   TestRenderViewHost* rvh1 = test_rvh();
1129   EXPECT_TRUE(rvh1->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
1130
1131   // Create a new tab and simulate it being the opener for the main
1132   // tab.  It should be in the same SiteInstance.
1133   scoped_ptr<TestWebContents> opener1(
1134       TestWebContents::Create(browser_context(), rvh1->GetSiteInstance()));
1135   RenderViewHostManager* opener1_manager =
1136       opener1->GetRenderManagerForTesting();
1137   contents()->SetOpener(opener1.get());
1138
1139   // Navigate to a different WebUI URL (different SiteInstance, same
1140   // BrowsingInstance).
1141   contents()->NavigateAndCommit(kPluginUrl);
1142   TestRenderViewHost* rvh2 = test_rvh();
1143   EXPECT_NE(rvh1->GetSiteInstance(), rvh2->GetSiteInstance());
1144   EXPECT_TRUE(rvh1->GetSiteInstance()->IsRelatedSiteInstance(
1145                   rvh2->GetSiteInstance()));
1146
1147   // Ensure a swapped out RVH is created in the first opener tab.
1148   TestRenderViewHost* opener1_rvh = static_cast<TestRenderViewHost*>(
1149       opener1_manager->GetSwappedOutRenderViewHost(rvh2->GetSiteInstance()));
1150   EXPECT_TRUE(opener1_manager->IsOnSwappedOutList(opener1_rvh));
1151   EXPECT_TRUE(opener1_rvh->is_swapped_out());
1152
1153   // Ensure the new RVH has WebUI bindings.
1154   EXPECT_TRUE(rvh2->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
1155 }
1156
1157 // Test that we reuse the same guest SiteInstance if we navigate across sites.
1158 TEST_F(RenderViewHostManagerTest, NoSwapOnGuestNavigations) {
1159   TestNotificationTracker notifications;
1160
1161   GURL guest_url(std::string(chrome::kGuestScheme).append("://abc123"));
1162   SiteInstance* instance =
1163       SiteInstance::CreateForURL(browser_context(), guest_url);
1164   scoped_ptr<TestWebContents> web_contents(
1165       TestWebContents::Create(browser_context(), instance));
1166
1167   // Create.
1168   RenderViewHostManager manager(web_contents.get(), web_contents.get(),
1169                                 web_contents.get());
1170
1171   manager.Init(browser_context(), instance, MSG_ROUTING_NONE, MSG_ROUTING_NONE);
1172
1173   RenderViewHost* host;
1174
1175   // 1) The first navigation. --------------------------
1176   const GURL kUrl1("http://www.google.com/");
1177   NavigationEntryImpl entry1(
1178       NULL /* instance */, -1 /* page_id */, kUrl1, Referrer(),
1179       string16() /* title */, PAGE_TRANSITION_TYPED,
1180       false /* is_renderer_init */);
1181   host = manager.Navigate(entry1);
1182
1183   // The RenderViewHost created in Init will be reused.
1184   EXPECT_TRUE(host == manager.current_host());
1185   EXPECT_FALSE(manager.pending_render_view_host());
1186   EXPECT_EQ(manager.current_host()->GetSiteInstance(), instance);
1187
1188   // Commit.
1189   manager.DidNavigateMainFrame(host);
1190   // Commit to SiteInstance should be delayed until RenderView commit.
1191   EXPECT_EQ(host, manager.current_host());
1192   ASSERT_TRUE(host);
1193   EXPECT_TRUE(static_cast<SiteInstanceImpl*>(host->GetSiteInstance())->
1194       HasSite());
1195
1196   // 2) Navigate to a different domain. -------------------------
1197   // Guests stay in the same process on navigation.
1198   const GURL kUrl2("http://www.chromium.org");
1199   NavigationEntryImpl entry2(
1200       NULL /* instance */, -1 /* page_id */, kUrl2,
1201       Referrer(kUrl1, WebKit::WebReferrerPolicyDefault),
1202       string16() /* title */, PAGE_TRANSITION_LINK,
1203       true /* is_renderer_init */);
1204   host = manager.Navigate(entry2);
1205
1206   // The RenderViewHost created in Init will be reused.
1207   EXPECT_EQ(host, manager.current_host());
1208   EXPECT_FALSE(manager.pending_render_view_host());
1209
1210   // Commit.
1211   manager.DidNavigateMainFrame(host);
1212   EXPECT_EQ(host, manager.current_host());
1213   ASSERT_TRUE(host);
1214   EXPECT_EQ(static_cast<SiteInstanceImpl*>(host->GetSiteInstance()),
1215       instance);
1216 }
1217
1218 }  // namespace content