PlzNavigate: implement RequestNavigation in the no live renderer case

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/devtools/render_view_devtools_agent_host.h"
 #include "content/browser/frame_host/cross_site_transferring_request.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/interstitial_page_impl.h"
+#include "content/browser/frame_host/navigation_before_commit_info.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigation_request_info.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_factory.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/browser/webui/web_ui_impl.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/browser/web_ui_controller.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "net/base/load_flags.h"
 
 namespace content {
 
+namespace {
+
+FrameHostMsg_BeginNavigation_Params BeginNavigationFromNavigate(

[Charlie Reis, 2014/07/30 23:37:32]

// PlzNavigate

[clamy, 2014/08/05 11:52:44]

Done.

+    const FrameMsg_Navigate_Params& navigate_params) {
+  FrameHostMsg_BeginNavigation_Params begin_navigation_params;
+  begin_navigation_params.method = navigate_params.is_post ?
+      "POST" : "GET";
+  begin_navigation_params.url = navigate_params.url;
+  begin_navigation_params.referrer = navigate_params.referrer.url;
+  begin_navigation_params.referrer_policy = navigate_params.referrer.policy;
+
+  // TODO(clamy): This should be modified to take into account caching policy

[Charlie Reis, 2014/07/30 23:37:32]

Is this modeled after some existing code?  I worry about them diverging and the
TODOs growing stale, so maybe it's worth mentioning the code it's based on.

[clamy, 2014/08/05 11:52:44]

There is currently no unified code to do this on the renderer side (it is
sprinkled about everywhere in blink). One of the OKRs for this quarter is to
actually have this unified in content/common.

+  // requirements (eg for POST reloads).
+  begin_navigation_params.load_flags =
+      net::LOAD_NORMAL | net::LOAD_ENABLE_LOAD_TIMING;
+
+  // TODO(clamy): Post data from the browser should be put in the request body.
+
+  begin_navigation_params.has_user_gesture = false;
+  begin_navigation_params.transition_type = navigate_params.transition;
+  begin_navigation_params.should_replace_current_entry =
+      navigate_params.should_replace_current_entry;
+  begin_navigation_params.allow_download =
+      navigate_params.allow_download;
+  return begin_navigation_params;
+}
+
+}  // namespace
+
 RenderFrameHostManager::PendingNavigationParams::PendingNavigationParams(
     const GlobalRequestID& global_request_id,
     scoped_ptr<CrossSiteTransferringRequest> cross_site_transferring_request,
     const std::vector<GURL>& transfer_url_chain,
     Referrer referrer,
     PageTransition page_transition,
     int render_frame_id,
     bool should_replace_current_entry)
     : global_request_id(global_request_id),
       cross_site_transferring_request(cross_site_transferring_request.Pass()),
@@ skipping 118 matching lines @@
 }
 
 RenderFrameHostImpl* RenderFrameHostManager::Navigate(
     const NavigationEntryImpl& entry) {
   TRACE_EVENT0("browser", "RenderFrameHostManager:Navigate");
   // Create a pending RenderFrameHost to use for the navigation.
   RenderFrameHostImpl* dest_render_frame_host = UpdateStateForNavigate(entry);
   if (!dest_render_frame_host)
     return NULL;  // We weren't able to create a pending render frame host.
 
-  // If the current render_frame_host_ isn't live, we should create it so
-  // that we don't show a sad tab while the dest_render_frame_host fetches
-  // its first page.  (Bug 1145340)
-  if (dest_render_frame_host != render_frame_host_ &&
-      !render_frame_host_->render_view_host()->IsRenderViewLive()) {
-    // Note: we don't call InitRenderView here because we are navigating away
-    // soon anyway, and we don't have the NavigationEntry for this host.
-    delegate_->CreateRenderViewForRenderManager(
-        render_frame_host_->render_view_host(), MSG_ROUTING_NONE,
-        MSG_ROUTING_NONE, frame_tree_node_->IsMainFrame());
-  }
-
-  // If the renderer crashed, then try to create a new one to satisfy this
-  // navigation request.
-  if (!dest_render_frame_host->render_view_host()->IsRenderViewLive()) {
-    // Recreate the opener chain.
-    int opener_route_id = delegate_->CreateOpenerRenderViewsForRenderManager(
-        dest_render_frame_host->GetSiteInstance());
-    if (!InitRenderView(dest_render_frame_host->render_view_host(),
-                        opener_route_id,
-                        MSG_ROUTING_NONE,
-                        frame_tree_node_->IsMainFrame()))
-      return NULL;
-
-    // Now that we've created a new renderer, be sure to hide it if it isn't
-    // our primary one.  Otherwise, we might crash if we try to call Show()
-    // on it later.
-    if (dest_render_frame_host != render_frame_host_ &&
-        dest_render_frame_host->render_view_host()->GetView()) {
-      dest_render_frame_host->render_view_host()->GetView()->Hide();
-    } else {
-      // Notify here as we won't be calling CommitPending (which does the
-      // notify).
-      delegate_->NotifySwappedFromRenderManager(
-          NULL, render_frame_host_.get(), frame_tree_node_->IsMainFrame());
-    }
-  }
+  // Initialize the destination RFH and the current RFH if they are not live.
+  if (!InitRenderFrameHostsBeforeNavigation(dest_render_frame_host))
+    return NULL;
 
   // If entry includes the request ID of a request that is being transferred,
   // the destination render frame will take ownership, so release ownership of
   // the request.
   if (pending_nav_params_ &&
       pending_nav_params_->global_request_id ==
           entry.transferred_global_request_id()) {
     pending_nav_params_->cross_site_transferring_request->ReleaseRequest();
   }
 
   return dest_render_frame_host;
 }
 
+// PlzNavigate
+bool RenderFrameHostManager::RequestNavigation(
+    const NavigationEntryImpl& entry,
+    const FrameMsg_Navigate_Params& navigate_params) {
+  CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableBrowserSideNavigation));
+  // TODO(clamy): replace RenderViewHost::IsRenderViewLive by
+  // RenderFrameHost::IsLive.
+  if (render_frame_host_->render_view_host()->IsRenderViewLive())
+    // TODO(clamy): send a RequestNavigation IPC.
+    return true;
+
+  // The navigation request is sent directly to the IO thread.
+  OnBeginNavigation(BeginNavigationFromNavigate(navigate_params));
+  return true;
+}
+
 void RenderFrameHostManager::Stop() {
   render_frame_host_->render_view_host()->Stop();
 
   // If we are cross-navigating, we should stop the pending renderers.  This
   // will lead to a DidFailProvisionalLoad, which will properly destroy them.
   if (cross_navigation_pending_) {
     pending_render_frame_host_->render_view_host()->Send(new ViewMsg_Stop(
         pending_render_frame_host_->render_view_host()->GetRoutingID()));
   }
 }
@@ skipping 319 matching lines @@
   RFHPendingDeleteMap::iterator iter =
       pending_delete_hosts_.find(site_instance_id);
   if (iter != pending_delete_hosts_.end() && iter->second.get() == rfh)
     pending_delete_hosts_.erase(site_instance_id);
 }
 
 void RenderFrameHostManager::ResetProxyHosts() {
   STLDeleteValues(&proxy_hosts_);
 }
 
+// PlzNavigate
 void RenderFrameHostManager::OnBeginNavigation(
     const FrameHostMsg_BeginNavigation_Params& params) {
+  CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableBrowserSideNavigation));
   // TODO(clamy): Check if navigations are blocked and if so, return
   // immediately.
   NavigationRequestInfo info(params);
 
   info.first_party_for_cookies = frame_tree_node_->IsMainFrame() ?
       params.url : frame_tree_node_->frame_tree()->root()->current_url();
   info.is_main_frame = frame_tree_node_->IsMainFrame();
   info.parent_is_main_frame = !frame_tree_node_->parent() ?
       false : frame_tree_node_->parent()->IsMainFrame();
   info.is_showing = GetRenderWidgetHostView()->IsShowing();
 
+  // Create a speculative RFH for the navigation if necessary.
+  RenderFrameHostImpl* dest_render_frame_host = render_frame_host_.get();
+  SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
+  SiteInstance* new_instance = GetSiteInstanceForNavigation(
+      *NavigationEntryImpl::FromNavigationEntry(
+          frame_tree_node_->navigator()->GetController()->GetPendingEntry()));

[Charlie Reis, 2014/07/30 23:37:33]

We didn't have a dependency on GetPendingEntry before, since it was passed in. 
(Navigate could be called even when there wasn't a pending entry.)  Can we pass
it in the entry here?

[clamy, 2014/08/05 11:52:44]

We can pass it in the case where we call it from Navigate. However,
OnBeginNavigation can be called following a FrameHostMsg_BeginNavigation message
coming from the renderer, in which case we don't have access to a navigation
entry (and as of now FrameHostMsg_BeginNavigation does not give you enough
parameters to create one). I reckon that this hackish, but I thought we could go
back to this specific point after we have solved some outstanding questions
regarding the start of the navigation when a renderer is present (eg do we fold
FrameHostMsg_OpenURL into FrameHostMsg_BeginNavigation ?). Would a TODO: remove
this dependency on GetPendingEntry be ok for the present?

[Charlie Reis, 2014/08/05 23:59:51]

I don't follow this part.  Today, we already receive navigation requests from
the renderer but don't need RFHM to know about the pending entry, because
NavigatorImpl takes care of those details.
The point I was trying to make is that RenderFrameHostManager should generally
not have to interact with NavigationController.  NavigatorImpl is responsible
for making sure that both NavigationController and RenderFrameHostManager do the
right things at each stage.

There's a few places where it leaks through today (e.g., a GetLastCommittedEntry
call), but I think we should try to keep up this separation to keep the code
modular and somewhat less spaghetti-like.

+  if (current_instance != new_instance) {
+    dest_render_frame_host = CreateRenderFrameHostForNewSiteInstance(
+        current_instance, new_instance, true);
+    DCHECK(dest_render_frame_host);
+  }
+  InitRenderFrameHostsBeforeNavigation(dest_render_frame_host);
+
   navigation_request_.reset(
       new NavigationRequest(info, frame_tree_node_->frame_tree_node_id()));
   navigation_request_->BeginNavigation(params.request_body);
-  // TODO(clamy): If we have no live RenderFrameHost to handle the request (eg
-  // cross-site navigation) spawn one speculatively here and keep track of it.
+}
+
+// PlzNavigate
+void RenderFrameHostManager::CommitNavigation(
+    const NavigationBeforeCommitInfo& info) {
+  CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableBrowserSideNavigation));
+  // Update the pending NavigationEntry for commit.
+  // TODO(clamy): Check if some more state should be updated at that point.
+  NavigationEntry* entry =
+      frame_tree_node_->navigator()->GetController()->GetPendingEntry();

[Charlie Reis, 2014/07/30 23:37:32]

Again, we didn't depend on GetPendingEntry() being correct at the time of commit
in the past, since it's possible that it didn't exist (e.g., in-page navigations
that commit synchronously).  (There's one hack that looks at it in
NavigatorImpl::DidNavigate for OOPIF, but that's going away.)

There's a separate controller_->RendererDidNavigate call in
NavigatorImpl::DidNavigate for updating the entry.

[clamy, 2014/08/05 11:52:44]

In the current design, in-page navigations should still be handled on the
renderer side (it is actually one of the reasons for going through the renderer
at all in the first place). For passing the navigation entry, I guess the
NavigationEntry we have in OnBeginNavigation could be stored in the
NavigationRequest and reused there. It needs to be updated at that point to the
url we navigated to after the redirects, in order to correctly determine which
RFH to use.

We should probably end up calling controller_->RendererDidNavigate in this
function at one point, but we refrained from that for now, because we need to
look at what exactely the CommitProvisionalLoad listeners in Blink do, and if
they can handle being called after we already committed on the browser side.

[Charlie Reis, 2014/08/05 23:59:51]

(Tangent: We should be able to determine if a navigation is in-page in the
browser process and only send it to the renderer in that case.)
NavigatorImpl should be the one updating the NavigationController.

+  entry->SetURL(info.navigation_url);
+
+  // Pick the right RenderFrameHost to commit the navigation. If the current RFH
+  // is not suitable, a RFH may have been spawned speculatively to handle the
+  // navigation. If there is none, or if it is not suitable, a new RFH needs to
+  // be created.
+  SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
+  SiteInstance* speculative_instance = speculative_render_frame_host_.get() ?
+      speculative_render_frame_host_->GetSiteInstance() : NULL;
+  DCHECK(current_instance != speculative_instance);
+
+  SiteInstance* new_instance = GetSiteInstanceForNavigation(
+      *NavigationEntryImpl::FromNavigationEntry(entry));
+  RenderFrameHostImpl* rfh_to_navigate = NULL;
+  DCHECK(!pending_render_frame_host_.get());
+
+  if (current_instance == new_instance)
+    rfh_to_navigate = render_frame_host_.get();
+
+  if (speculative_instance) {
+    if (speculative_instance == new_instance) {
+      rfh_to_navigate = speculative_render_frame_host_.get();
+    } else {
+      speculative_render_frame_host_.reset();
+    }
+  }
+
+  if (!rfh_to_navigate) {
+    rfh_to_navigate = CreateRenderFrameHostForNewSiteInstance(
+        current_instance, new_instance, true);
+    DCHECK(rfh_to_navigate);
+  }
+
+  // A WebUI renderer should never display a non WebUI url.
+  frame_tree_node_->navigator()->CheckWebUIRendererDoesNotDisplayNormalURL(
+      rfh_to_navigate, info.navigation_url);
+
+  // TODO(clamy): the rfh_to_navigate should now send a commit IPC to the

[Charlie Reis, 2014/07/30 23:37:32]

I'm having trouble following the planned IPC timeline.  Is there an updated
design doc that covers the planned behavior?

[clamy, 2014/08/05 11:52:44]

Yes at
https://docs.google.com/document/d/1cSW8fpJIUnibQKU8TMwLE5VxYZPh4u4LNu_wtkok8....

+  // renderer.
+  // TODO(clamy): If the current RFH is not reused, we should ask it to run its
+  // unload handler, and possibly create a RenderFrameProxyHost for it.
+  // Otherwise we are leaking the current RFH here.
+  if (rfh_to_navigate != render_frame_host_.get())
+    SetRenderFrameHost(speculative_render_frame_host_.Pass());
+  DCHECK(!speculative_render_frame_host_.get());
+
+  navigation_request_.reset();
 }
 
 void RenderFrameHostManager::Observe(
     int type,
     const NotificationSource& source,
     const NotificationDetails& details) {
   switch (type) {
     case NOTIFICATION_RENDERER_PROCESS_CLOSED:
     case NOTIFICATION_RENDERER_PROCESS_CLOSING:
       RendererProcessClosing(
@@ skipping 293 matching lines @@
   }
 
   // Start the new renderer in a new SiteInstance, but in the current
   // BrowsingInstance.  It is important to immediately give this new
   // SiteInstance to a RenderViewHost (if it is different than our current
   // SiteInstance), so that it is ref counted.  This will happen in
   // CreateRenderView.
   return current_instance->GetRelatedSiteInstance(dest_url);
 }
 
+RenderFrameHostImpl* RenderFrameHostManager::
+CreateRenderFrameHostForNewSiteInstance(
+    SiteInstance* old_instance,
+    SiteInstance* new_instance,
+    bool is_speculative) {
+  // Ensure that we have created RFHs for the new RFH's opener chain if
+  // we are staying in the same BrowsingInstance. This allows the new RFH
+  // to send cross-process script calls to its opener(s).
+  int opener_route_id = MSG_ROUTING_NONE;
+  if (new_instance->IsRelatedSiteInstance(old_instance)) {
+    opener_route_id =
+        delegate_->CreateOpenerRenderViewsForRenderManager(new_instance);
+  }
+
+  // Create a non-swapped-out RFH with the given opener.
+  int route_id = CreateRenderFrame(new_instance, opener_route_id, false,
+                                   delegate_->IsHidden(), is_speculative);
+  if (route_id == MSG_ROUTING_NONE) {
+    if (is_speculative)
+      speculative_render_frame_host_.reset();
+    else
+      pending_render_frame_host_.reset();
+    return NULL;
+  }
+  if (is_speculative)
+    return speculative_render_frame_host_.get();
+  return pending_render_frame_host_.get();
+}
+
 scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::CreateRenderFrameHost(
     SiteInstance* site_instance,
     int view_routing_id,
     int frame_routing_id,
     bool swapped_out,
     bool hidden) {
   if (frame_routing_id == MSG_ROUTING_NONE)
     frame_routing_id = site_instance->GetProcess()->GetNextRoutingID();
 
   // Create a RVH for main frames, or find the existing one for subframes.
@@ skipping 24 matching lines @@
                                                      frame_tree_node_,
                                                      frame_routing_id,
                                                      swapped_out).release());
   return render_frame_host.Pass();
 }
 
 int RenderFrameHostManager::CreateRenderFrame(
     SiteInstance* instance,
     int opener_route_id,
     bool swapped_out,
-    bool hidden) {
+    bool hidden,
+    bool is_speculative) {
   CHECK(instance);
   DCHECK(!swapped_out || hidden); // Swapped out views should always be hidden.
+  DCHECK(!(swapped_out && is_speculative));
 
   scoped_ptr<RenderFrameHostImpl> new_render_frame_host;
   RenderFrameHostImpl* frame_to_announce = NULL;
   int routing_id = MSG_ROUTING_NONE;
 
   // We are creating a pending or swapped out RFH here.  We should never create
   // it in the same SiteInstance as our current RFH.
   CHECK_NE(render_frame_host_->GetSiteInstance(), instance);
 
   // Check if we've already created an RFH for this SiteInstance.  If so, try
@@ skipping 53 matching lines @@
       // Don't show the main frame's view until we get a DidNavigate from it.
       render_view_host->GetView()->Hide();
     } else if (!swapped_out && pending_render_frame_host_) {
       CancelPending();
     }
     routing_id = render_view_host->GetRoutingID();
     frame_to_announce = new_render_frame_host.get();
   }
 
   // Use this as our new pending RFH if it isn't swapped out.
-  if (!swapped_out)
-    pending_render_frame_host_ = new_render_frame_host.Pass();
+  if (!swapped_out) {
+    if (is_speculative)
+      speculative_render_frame_host_ = new_render_frame_host.Pass();
+    else
+      pending_render_frame_host_ = new_render_frame_host.Pass();
+  }
 
   // If a brand new RFH was created, announce it to observers.
   if (frame_to_announce)
     render_frame_delegate_->RenderFrameCreated(frame_to_announce);
 
   return routing_id;
 }
 
 bool RenderFrameHostManager::InitRenderView(RenderViewHost* render_view_host,
                                             int opener_route_id,
@@ skipping 16 matching lines @@
     if (!rvh_impl->IsSwappedOut()) {
       CHECK(!ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
                 render_view_host->GetProcess()->GetID()));
     }
   }
 
   return delegate_->CreateRenderViewForRenderManager(
       render_view_host, opener_route_id, proxy_routing_id, for_main_frame);
 }
 
+bool RenderFrameHostManager::InitRenderFrameHostsBeforeNavigation(
+    RenderFrameHostImpl* dest_render_frame_host) {
+  // If the current render_frame_host_ isn't live, we should create it so
+  // that we don't show a sad tab while the dest_render_frame_host fetches
+  // its first page.  (crbug.com/1145340)
+  if (dest_render_frame_host != render_frame_host_ &&
+      !render_frame_host_->render_view_host()->IsRenderViewLive()) {
+    // Note: we don't call InitRenderView here because we are navigating away
+    // soon anyway, and we don't have the NavigationEntry for this host.
+    delegate_->CreateRenderViewForRenderManager(
+        render_frame_host_->render_view_host(), MSG_ROUTING_NONE,
+        MSG_ROUTING_NONE, frame_tree_node_->IsMainFrame());
+  }
+
+  // If the renderer crashed, then try to create a new one to satisfy this
+  // navigation request.
+  if (!dest_render_frame_host->render_view_host()->IsRenderViewLive()) {
+    // Recreate the opener chain.
+    int opener_route_id = delegate_->CreateOpenerRenderViewsForRenderManager(
+        dest_render_frame_host->GetSiteInstance());
+    if (!InitRenderView(dest_render_frame_host->render_view_host(),
+                        opener_route_id,
+                        MSG_ROUTING_NONE,
+                        frame_tree_node_->IsMainFrame()))
+      return false;
+
+    // Now that we've created a new renderer, be sure to hide it if it isn't
+    // our primary one.  Otherwise, we might crash if we try to call Show()
+    // on it later.
+    if (dest_render_frame_host != render_frame_host_ &&
+        dest_render_frame_host->render_view_host()->GetView()) {
+      dest_render_frame_host->render_view_host()->GetView()->Hide();
+    } else {
+      // Notify here as we won't be calling CommitPending (which does the
+      // notify).
+      delegate_->NotifySwappedFromRenderManager(
+          NULL, render_frame_host_.get(), frame_tree_node_->IsMainFrame());
+    }
+  }
+  return true;
+}
+
+SiteInstance* RenderFrameHostManager::GetSiteInstanceForNavigation(
+    const NavigationEntryImpl& entry) {
+  SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
+  SiteInstance* new_instance = current_instance;
+
+  // We do not currently swap processes for navigations in webview tag guests.
+  bool is_guest_scheme = current_instance->GetSiteURL().SchemeIs(kGuestScheme);
+
+  // Determine if we need a new BrowsingInstance for this entry.  If true, this
+  // implies that it will get a new SiteInstance (and likely process), and that
+  // other tabs in the current BrowsingInstance will be unable to script it.
+  // This is used for cases that require a process swap even in the
+  // process-per-tab model, such as WebUI pages.
+  const NavigationEntry* current_entry =
+      delegate_->GetLastCommittedNavigationEntryForRenderManager();
+  bool force_swap = !is_guest_scheme &&
+      ShouldSwapBrowsingInstancesForNavigation(current_entry, &entry);
+  if (!is_guest_scheme && (ShouldTransitionCrossSite() || force_swap))
+    new_instance = GetSiteInstanceForEntry(entry, current_instance, force_swap);
+
+  // If force_swap is true, we must use a different SiteInstance.  If we didn't,
+  // we would have two RenderFrameHosts in the same SiteInstance and the same
+  // frame, resulting in page_id conflicts for their NavigationEntries.
+  if (force_swap)
+    CHECK_NE(new_instance, current_instance);
+
+  return new_instance;
+}
+
 void RenderFrameHostManager::CommitPending() {
   // First check whether we're going to want to focus the location bar after
   // this commit.  We do this now because the navigation hasn't formally
   // committed yet, so if we've already cleared |pending_web_ui_| the call chain
   // this triggers won't be able to figure out what's going on.
   bool will_focus_location_bar = delegate_->FocusLocationBarByDefault();
 
   // We expect SwapOutOldPage to have canceled any modal dialogs and told the
   // renderer to suppress any further dialogs until it is swapped out.  However,
   // crash reports indicate that it's still possible for modal dialogs to exist
@@ skipping 188 matching lines @@
   if (cross_navigation_pending_) {
     if (pending_render_frame_host_)
       CancelPending();
     cross_navigation_pending_ = false;
   }
 
   // render_frame_host_'s SiteInstance and new_instance will not be deleted
   // before the end of this method, so we don't have to worry about their ref
   // counts dropping to zero.
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
-  SiteInstance* new_instance = current_instance;
-
-  // We do not currently swap processes for navigations in webview tag guests.
-  bool is_guest_scheme = current_instance->GetSiteURL().SchemeIs(kGuestScheme);
-
-  // Determine if we need a new BrowsingInstance for this entry.  If true, this
-  // implies that it will get a new SiteInstance (and likely process), and that
-  // other tabs in the current BrowsingInstance will be unable to script it.
-  // This is used for cases that require a process swap even in the
-  // process-per-tab model, such as WebUI pages.
+  SiteInstance* new_instance = GetSiteInstanceForNavigation(entry);
   const NavigationEntry* current_entry =
       delegate_->GetLastCommittedNavigationEntryForRenderManager();
-  bool force_swap = !is_guest_scheme &&
-      ShouldSwapBrowsingInstancesForNavigation(current_entry, &entry);
-  if (!is_guest_scheme && (ShouldTransitionCrossSite() || force_swap))
-    new_instance = GetSiteInstanceForEntry(entry, current_instance, force_swap);
-
-  // If force_swap is true, we must use a different SiteInstance.  If we didn't,
-  // we would have two RenderFrameHosts in the same SiteInstance and the same
-  // frame, resulting in page_id conflicts for their NavigationEntries.
-  if (force_swap)
-    CHECK_NE(new_instance, current_instance);
 
   if (new_instance != current_instance) {
     // New SiteInstance: create a pending RFH to navigate.
     DCHECK(!cross_navigation_pending_);
 
     // This will possibly create (set to NULL) a Web UI object for the pending
     // page. We'll use this later to give the page special access. This must
     // happen before the new renderer is created below so it will get bindings.
     // It must also happen after the above conditional call to CancelPending(),
     // otherwise CancelPending may clear the pending_web_ui_ and the page will
     // not have its bindings set appropriately.
     SetPendingWebUI(entry);
 
-    // Ensure that we have created RFHs for the new RFH's opener chain if
-    // we are staying in the same BrowsingInstance. This allows the pending RFH
-    // to send cross-process script calls to its opener(s).
-    int opener_route_id = MSG_ROUTING_NONE;
-    if (new_instance->IsRelatedSiteInstance(current_instance)) {
-      opener_route_id =
-          delegate_->CreateOpenerRenderViewsForRenderManager(new_instance);
+    if (!CreateRenderFrameHostForNewSiteInstance(
+        current_instance, new_instance, false)) {
+      return NULL;
     }
 
-    // Create a non-swapped-out pending RFH with the given opener and navigate
-    // it.
-    int route_id = CreateRenderFrame(new_instance, opener_route_id, false,
-                                     delegate_->IsHidden());
-    if (route_id == MSG_ROUTING_NONE)
-      return NULL;
-
     // Check if our current RFH is live before we set up a transition.
     if (!render_frame_host_->render_view_host()->IsRenderViewLive()) {
       if (!cross_navigation_pending_) {
         // The current RFH is not live.  There's no reason to sit around with a
         // sad tab or a newly created RFH while we wait for the pending RFH to
         // navigate.  Just switch to the pending RFH now and go back to non
         // cross-navigating (Note that we don't care about on{before}unload
         // handlers if the current RFH isn't live.)
         CommitPending();
         return render_frame_host_.get();
@@ skipping 176 matching lines @@
     SiteInstance* instance) const {
   RenderFrameProxyHostMap::const_iterator iter =
       proxy_hosts_.find(instance->GetId());
   if (iter != proxy_hosts_.end())
     return iter->second;
 
   return NULL;
 }
 
 }  // namespace content