Part 2 of the CL to unfork our changes to FrameLoader.cpp to support the

window.history object.  I've reverted our original changes and gone with a
different approach.

The idea is to fake the HistoryItem that FrameLoader asks for synchronously,
and give it a special URL that we can intercept later and do the back/forward
navigation.

BUG=3912
Review URL: http://codereview.chromium.org/8756

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@4308 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 24 insertions, 3 deletions

diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 6912e8b..094fcfe 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -102,6 +102,8 @@ static const int kMaximumNumberOfUnacknowledgedPopups = 25;
 static const char* const kUnreachableWebDataURL =
     "chrome-resource://chromewebdata/";
 
+static const char* const kBackForwardNavigationScheme = "history";
+
 namespace {
 
 // Associated with browser-initiated navigations to hold tracking data.
@@ -1529,6 +1531,13 @@ WindowOpenDisposition RenderView::DispositionForNavigationAction(
           url.SchemeIs("view-source")) {
         OpenURL(webview, url, GURL(), disposition);
         return IGNORE_ACTION;  // Suppress the load here.
+      } else if (url.SchemeIs(kBackForwardNavigationScheme)) {
+        std::string offset_str = url.ExtractFileName();
+        int offset;
+        if (StringToInt(offset_str, &offset)) {
+          GoToEntryAtOffsetAsync(offset);
+          return IGNORE_ACTION;  // The browser process handles this one.
+        }
       }
     }
   }
@@ -2275,9 +2284,16 @@ void RenderView::OnPasswordFormsSeen(WebView* webview,
 }
 
 WebHistoryItem* RenderView::GetHistoryEntryAtOffset(int offset) {
-  // This doesn't work in the multi-process case because we don't want to
-  // hang, as it might lead to deadlocks.  Use GoToEntryAtOffsetAsync.
-  return NULL;
+  // Our history list is kept in the browser process on the UI thread.  Since
+  // we can't make a sync IPC call to that thread without risking deadlock,
+  // we use a trick: construct a fake history item of the form:
+  //   history://go/OFFSET
+  // When WebCore tells us to navigate to it, we tell the browser process to
+  // do a back/forward navigation instead.
+
+  GURL url(StringPrintf("%s://go/%d", kBackForwardNavigationScheme, offset));
+  history_navigation_item_ = WebHistoryItem::Create(url, L"", "", NULL);
+  return history_navigation_item_.get();
 }
 
 void RenderView::GoToEntryAtOffsetAsync(int offset) {
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index ddfe6d3..e468e98 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -670,6 +670,11 @@ class RenderView : public RenderWidget, public WebViewDelegate,
   // Set if we are waiting for an ack for ViewHostMsg_CreateWindow
   bool waiting_for_create_window_ack_;
 
+  // A cached WebHistoryItem used for back/forward navigations initiated by
+  // WebCore (via the window.history.go API).  We only have one such navigation
+  // pending at a time.
+  scoped_refptr<WebHistoryItem> history_navigation_item_;
+  
   DISALLOW_COPY_AND_ASSIGN(RenderView);
 };