Merge 228012 "Abort prerenders if unused for being uncommitted."

> Abort prerenders if unused for being uncommitted.
> 
> This will avoid the problem, in most cases, where we prerender a login page,
> don't commit fast enough, and then incorrectly use it after the user has
> already logged in.
> 
> BUG=292121
> TEST=PrerenderBrowserTest.PrerenderNoCommitNoSwap
> 
> Review URL: https://codereview.chromium.org/26638004

BUG=308729
TBR=davidben@chromium.org

Review URL: https://codereview.chromium.org/29263003

git-svn-id: svn://svn.chromium.org/chrome/branches/1650/src@229424 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 13 insertions, 12 deletions

diff --git a/chrome/browser/prerender/prerender_browsertest.cc b/chrome/browser/prerender/prerender_browsertest.cc
index 86f2f94..aea8505 100644
--- a/chrome/browser/prerender/prerender_browsertest.cc
+++ b/chrome/browser/prerender/prerender_browsertest.cc
@@ -131,6 +131,7 @@ bool ShouldRenderPrerenderedPageCorrectly(FinalStatus status) {
     case FINAL_STATUS_CANCELLED:
     case FINAL_STATUS_DEVTOOLS_ATTACHED:
     case FINAL_STATUS_PAGE_BEING_CAPTURED:
+    case FINAL_STATUS_NAVIGATION_UNCOMMITTED:
       return true;
     default:
       return false;
@@ -1460,20 +1461,11 @@ IN_PROC_BROWSER_TEST_F(PrerenderBrowserTest, PrerenderNoCommitNoSwap) {
       BrowserThread::IO, FROM_HERE,
       base::Bind(&CreateNeverStartProtocolHandlerOnIO, kNoCommitUrl));
   PrerenderTestURL(kNoCommitUrl,
-                   FINAL_STATUS_CANCELLED,
+                   FINAL_STATUS_NAVIGATION_UNCOMMITTED,
                    0);
 
   // Navigate to the URL, but assume the contents won't be swapped in.
   NavigateToDestURLWithDisposition(CURRENT_TAB, false);
-
-  // Confirm that the prerendered version of the URL is not swapped in,
-  // since it never committed.
-  EXPECT_TRUE(UrlIsInPrerenderManager(kNoCommitUrl));
-
-  // Post a task to cancel all the prerenders, so that we don't wait further.
-  base::MessageLoop::current()->PostTask(
-      FROM_HERE, base::Bind(&CancelAllPrerenders, GetPrerenderManager()));
-  content::RunMessageLoop();
 }
 
 // Checks that the prerendering of a page is canceled correctly when a
diff --git a/chrome/browser/prerender/prerender_final_status.cc b/chrome/browser/prerender/prerender_final_status.cc
index 6455dcf..c84a4ae 100644
--- a/chrome/browser/prerender/prerender_final_status.cc
+++ b/chrome/browser/prerender/prerender_final_status.cc
@@ -56,6 +56,8 @@ const char* kFinalStatusNames[] = {
   "Register Protocol Handler",
   "Creating Audio Stream",
   "Page Being Captured",
+  "Bad Deferred Redirect",
+  "Navigation Uncommitted",
   "Max",
 };
 COMPILE_ASSERT(arraysize(kFinalStatusNames) == FINAL_STATUS_MAX + 1,
diff --git a/chrome/browser/prerender/prerender_final_status.h b/chrome/browser/prerender/prerender_final_status.h
index beb1421..987ed94 100644
--- a/chrome/browser/prerender/prerender_final_status.h
+++ b/chrome/browser/prerender/prerender_final_status.h
@@ -57,6 +57,8 @@ enum FinalStatus {
   FINAL_STATUS_REGISTER_PROTOCOL_HANDLER = 42,
   FINAL_STATUS_CREATING_AUDIO_STREAM = 43,
   FINAL_STATUS_PAGE_BEING_CAPTURED = 44,
+  // On trunk: FINAL_STATUS_BAD_DEFERRED_REDIRECT = 45,
+  FINAL_STATUS_NAVIGATION_UNCOMMITTED = 46,
   FINAL_STATUS_MAX,
 };
 
diff --git a/chrome/browser/prerender/prerender_manager.cc b/chrome/browser/prerender/prerender_manager.cc
index 215ee3f..3399032 100644
--- a/chrome/browser/prerender/prerender_manager.cc
+++ b/chrome/browser/prerender/prerender_manager.cc
@@ -114,7 +114,8 @@ bool NeedMatchCompleteDummyForFinalStatus(FinalStatus final_status) {
       final_status != FINAL_STATUS_CANCELLED &&
       final_status != FINAL_STATUS_DEVTOOLS_ATTACHED &&
       final_status != FINAL_STATUS_CROSS_SITE_NAVIGATION_PENDING &&
-      final_status != FINAL_STATUS_PAGE_BEING_CAPTURED;
+      final_status != FINAL_STATUS_PAGE_BEING_CAPTURED &&
+      final_status != FINAL_STATUS_NAVIGATION_UNCOMMITTED;
 }
 
 void CheckIfCookiesExistForDomainResultOnUIThread(
@@ -435,8 +436,11 @@ bool PrerenderManager::MaybeUsePrerenderedPage(WebContents* web_contents,
     // there is a pending entry, it may not commit.
     // TODO(creis): If there is a pending navigation and no last committed
     // entry, we might be able to transfer the network request instead.
-    if (!new_web_contents->GetController().CanPruneAllButVisible())
+    if (!new_web_contents->GetController().CanPruneAllButVisible()) {
+      // Abort this prerender so it is not used later. http://crbug.com/292121
+      prerender_data->contents()->Destroy(FINAL_STATUS_NAVIGATION_UNCOMMITTED);
       return false;
+    }
   }
 
   // Do not use the prerendered version if there is an opener object.
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index f748621..5f435ef 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -24566,6 +24566,7 @@ other types of suffix sets.
   <int value="40" label="OPEN_URL"/>
   <int value="41" label="WOULD_HAVE_BEEN_USED"/>
   <int value="42" label="REGISTER_PROTOCOL_HANDLER"/>
+  <int value="46" label="NAVIGATION_UNCOMMITTED"/>
 </enum>
 
 <enum name="PrerenderHoverEvent" type="int">