Merge 224777 "Send the referrer when opening a URL via the brows..."

> Send the referrer when opening a URL via the browser for prerender and instant
> 
> BUG=292885
> TEST=PrerenderBrowserTest.PrerenderCancelReferrer*,InstantExtendedTest.Referrer
> R=mmenke@chromium.org, samarth@chromium.org
> 
> Review URL: https://codereview.chromium.org/24252012

TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/24411002

git-svn-id: svn://svn.chromium.org/chrome/branches/1599/src@225028 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 92 insertions, 8 deletions

diff --git a/chrome/browser/prerender/prerender_browsertest.cc b/chrome/browser/prerender/prerender_browsertest.cc
index de14f6d..55c4613 100644
--- a/chrome/browser/prerender/prerender_browsertest.cc
+++ b/chrome/browser/prerender/prerender_browsertest.cc
@@ -15,6 +15,7 @@
 #include "base/values.h"
 #include "chrome/browser/browsing_data/browsing_data_helper.h"
 #include "chrome/browser/browsing_data/browsing_data_remover.h"
+#include "chrome/browser/chrome_content_browser_client.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/content_settings/host_content_settings_map.h"
 #include "chrome/browser/extensions/api/web_navigation/web_navigation_api.h"
@@ -50,6 +51,7 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
+#include "content/public/browser/site_instance.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
@@ -360,6 +362,10 @@ class TestPrerenderContents : public PrerenderContents {
     return quit_message_loop_on_destruction_;
   }
 
+  void set_quit_message_loop_on_destruction(bool quit) {
+    quit_message_loop_on_destruction_ = quit;
+  }
+
  private:
   virtual void OnRenderViewHostCreated(
       RenderViewHost* new_render_view_host) OVERRIDE {
@@ -619,6 +625,26 @@ void CreateNeverStartProtocolHandlerOnIO(const GURL& url) {
       url, never_respond_handler.Pass());
 }
 
+// A ContentBrowserClient that cancels all prerenderers on OpenURL.
+class TestContentBrowserClient : public chrome::ChromeContentBrowserClient {
+ public:
+  TestContentBrowserClient() {}
+  virtual ~TestContentBrowserClient() {}
+
+  // chrome::ChromeContentBrowserClient implementation.
+  virtual bool ShouldAllowOpenURL(content::SiteInstance* site_instance,
+                                  const GURL& url) OVERRIDE {
+    PrerenderManagerFactory::GetForProfile(
+        Profile::FromBrowserContext(site_instance->GetBrowserContext()))
+        ->CancelAllPrerenders();
+    return chrome::ChromeContentBrowserClient::ShouldAllowOpenURL(site_instance,
+                                                                  url);
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TestContentBrowserClient);
+};
+
 }  // namespace
 
 // Many of these tests are flaky. See http://crbug.com/249179
@@ -1794,6 +1820,31 @@ IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest,
   NavigateToDestURL();
 }
 
+// Checks that the referrer is set when prerendering is cancelled.
+IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest, PrerenderCancelReferrer) {
+  scoped_ptr<TestContentBrowserClient> test_content_browser_client(
+      new TestContentBrowserClient);
+  content::ContentBrowserClient* original_browser_client =
+      content::SetBrowserClientForTesting(test_content_browser_client.get());
+
+  PrerenderTestURL("files/prerender/prerender_referrer.html",
+                   FINAL_STATUS_CANCELLED,
+                   1);
+  GetPrerenderContents()->set_quit_message_loop_on_destruction(false);
+  OpenDestURLViaClick();
+
+  bool display_test_result = false;
+  WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  ASSERT_TRUE(content::ExecuteScriptAndExtractBool(
+      web_contents,
+      "window.domAutomationController.send(DidDisplayPass())",
+      &display_test_result));
+  EXPECT_TRUE(display_test_result);
+
+  content::SetBrowserClientForTesting(original_browser_client);
+}
+
 // Checks that popups on a prerendered page cause cancellation.
 IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest, PrerenderPopup) {
   PrerenderTestURL("files/prerender/prerender_popup.html",
@@ -2747,6 +2798,32 @@ IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest,
   NavigateToDestURL();
 }
 
+// Checks that the referrer policy is used when prerendering is cancelled.
+IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest, PrerenderCancelReferrerPolicy) {
+  scoped_ptr<TestContentBrowserClient> test_content_browser_client(
+      new TestContentBrowserClient);
+  content::ContentBrowserClient* original_browser_client =
+      content::SetBrowserClientForTesting(test_content_browser_client.get());
+
+  set_loader_path("files/prerender/prerender_loader_with_referrer_policy.html");
+  PrerenderTestURL("files/prerender/prerender_referrer_policy.html",
+                   FINAL_STATUS_CANCELLED,
+                   1);
+  GetPrerenderContents()->set_quit_message_loop_on_destruction(false);
+  OpenDestURLViaClick();
+
+  bool display_test_result = false;
+  WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  ASSERT_TRUE(content::ExecuteScriptAndExtractBool(
+      web_contents,
+      "window.domAutomationController.send(DidDisplayPass())",
+      &display_test_result));
+  EXPECT_TRUE(display_test_result);
+
+  content::SetBrowserClientForTesting(original_browser_client);
+}
+
 // Test interaction of the webNavigation and tabs API with prerender.
 class PrerenderBrowserTestWithExtensions : public PrerenderBrowserTest,
                                            public ExtensionApiTest {
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index 09ee4e3..5c06869 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -938,8 +938,10 @@ bool ChromeContentRendererClient::ShouldFork(WebFrame* frame,
   // If this is the Instant process, fork all navigations originating from the
   // renderer.  The destination page will then be bucketed back to this Instant
   // process if it is an Instant url, or to another process if not.
-  if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kInstantProcess))
+  if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kInstantProcess)) {
+    *send_referrer = true;
     return true;
+  }
 
   // For now, we skip the rest for POST submissions.  This is because
   // http://crbug.com/101395 is more likely to cause compatibility issues
@@ -963,8 +965,11 @@ bool ChromeContentRendererClient::ShouldFork(WebFrame* frame,
   // to swap in the prerendered page on the browser process. If the prerendered
   // page no longer exists by the time the OpenURL IPC is handled, a normal
   // navigation is attempted.
-  if (prerender_dispatcher_.get() && prerender_dispatcher_->IsPrerenderURL(url))
+  if (prerender_dispatcher_.get() &&
+      prerender_dispatcher_->IsPrerenderURL(url)) {
+    *send_referrer = true;
     return true;
+  }
 
   const ExtensionSet* extensions = extension_dispatcher_->extensions();
 
diff --git a/chrome/test/data/instant_extended.html b/chrome/test/data/instant_extended.html
index ecf5821..4dcae9c 100644
--- a/chrome/test/data/instant_extended.html
+++ b/chrome/test/data/instant_extended.html
@@ -149,6 +149,9 @@ function setUp() {
 setUp();
 
     </script>
+
+    <meta name="referrer" content="origin" />
+
   </head>
   <body>
     <h1>Instant</h1>
diff --git a/chrome/test/data/prerender/prerender_loader_with_referrer_policy.html b/chrome/test/data/prerender/prerender_loader_with_referrer_policy.html
index b0d5304..3570dc4 100644
--- a/chrome/test/data/prerender/prerender_loader_with_referrer_policy.html
+++ b/chrome/test/data/prerender/prerender_loader_with_referrer_policy.html
@@ -2,6 +2,8 @@
 <head>
 <title>Preloader</title>
 
+<script src="prerender_events_common.js"></script>
+
 <script>
   function Click() {
     var eventObject = document.createEvent('MouseEvents');
@@ -16,12 +18,9 @@
 </head>
 <body>
 <script>
-  function loader() {
-     document.write(
-         '<link rel="prerender" href="REPLACE_WITH_PRERENDER_URL"/>');
-  }
-
-  window.onload = loader;
+  document.write('<link id="theprerender" rel="prerender" href="REPLACE_WITH_PRERENDER_URL"/>');
+  prerender = document.getElementById('theprerender');
+  AddEventHandlersToLinkElement(prerender, 0);
 </script>
 <a id="toClick" href="REPLACE_WITH_DESTINATION_URL">Link to click</a>
 </body>