PlzNavigate: Create the speculative renderer earlier.

content/browser/security_exploit_browsertest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
 #include "content/browser/frame_host/navigator.h"
@@ skipping 55 matching lines @@
             shell->web_contents()->GetRenderViewHost()->GetRoutingID());
 
   // Now, simulate a link click coming from the renderer.
   GURL extension_url("https://bar.com/simple_page.html");
   WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents());
   wc->GetFrameTree()->root()->navigator()->RequestOpenURL(
       wc->GetFrameTree()->root()->current_frame_host(), extension_url, nullptr,
       Referrer(), CURRENT_TAB, false, true);
 
   // Since the navigation above requires a cross-process swap, there will be a
-  // pending RenderViewHost. Ensure it exists and is in a different process
-  // than the initial page.
-  RenderViewHostImpl* pending_rvh =
-      wc->GetRenderManagerForTesting()->pending_render_view_host();
-  EXPECT_TRUE(pending_rvh != NULL);
-  EXPECT_NE(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(),
-            pending_rvh->GetProcess()->GetID());
+  // speculative/pending RenderViewHost. Ensure it exists and is in a different

[clamy, 2015/06/10 12:30:27]

s/RenderViewHost/RenderFrameHost

[carlosk, 2015/06/10 13:15:06]

Done.

+  // process than the initial page.
+  RenderFrameHostImpl* next_rfh;
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableBrowserSideNavigation)) {
+    next_rfh =
+        wc->GetRenderManagerForTesting()->speculative_frame_host_for_testing();
+  } else {
+    next_rfh = wc->GetRenderManagerForTesting()->pending_frame_host();
+  }
 
-  return pending_rvh;
+  EXPECT_TRUE(next_rfh);
+  EXPECT_NE(shell->web_contents()->GetRenderProcessHost()->GetID(),
+            next_rfh->GetProcess()->GetID());
+
+  return next_rfh->render_view_host();
 }
 
 }  // namespace
 
 
 // The goal of these tests will be to "simulate" exploited renderer processes,
 // which can send arbitrary IPC messages and confuse browser process internal
 // state, leading to security bugs. We are trying to verify that the browser
 // doesn't perform any dangerous operations in such cases.
 class SecurityExploitBrowserTest : public ContentBrowserTest {
@@ skipping 213 matching lines @@
   // "evil" message doesn't arrive in the intervening period.
   ASSERT_TRUE(content::ExecuteScript(
       interstitial_page->GetMainFrame(),
       "window.domAutomationController.send(\"okay2\");"));
   ASSERT_TRUE(message_queue.WaitForMessage(&message));
   ASSERT_EQ("\"okay2\"", message);
   ASSERT_EQ("\"okay2\"", interstitial->last_command());
 }
 
 }  // namespace content