Revert r15244. Failed tests :(

TBR=mpcomplete

Review URL: http://codereview.chromium.org/99370

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@15246 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 32 insertions, 2 deletions

diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 262997b..1236886 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -68,6 +68,7 @@
 #include "webkit/glue/webdropdata.h"
 #include "webkit/glue/weberror.h"
 #include "webkit/glue/webframe.h"
+#include "webkit/glue/webhistoryitem.h"
 #include "webkit/glue/webkit_glue.h"
 #include "webkit/glue/webpreferences.h"
 #include "webkit/glue/webplugin_delegate.h"
@@ -1552,6 +1553,13 @@ WindowOpenDisposition RenderView::DispositionForNavigationAction(
           url.SchemeIs(chrome::kViewSourceScheme)) {
         OpenURL(webview, url, GURL(), disposition);
         return IGNORE_ACTION;  // Suppress the load here.
+      } else if (url.SchemeIs(kBackForwardNavigationScheme)) {
+        std::string offset_str = url.ExtractFileName();
+        int offset;
+        if (StringToInt(offset_str, &offset)) {
+          GoToEntryAtOffset(offset);
+          return IGNORE_ACTION;  // The browser process handles this one.
+        }
       }
     }
   }
@@ -2425,7 +2433,20 @@ void RenderView::OnAutofillFormSubmitted(WebView* webview,
   Send(new ViewHostMsg_AutofillFormSubmitted(routing_id_, form));
 }
 
-void RenderView::NavigateBackForwardSoon(int offset) {
+WebHistoryItem* RenderView::GetHistoryEntryAtOffset(int offset) {
+  // Our history list is kept in the browser process on the UI thread.  Since
+  // we can't make a sync IPC call to that thread without risking deadlock,
+  // we use a trick: construct a fake history item of the form:
+  //   history://go/OFFSET
+  // When WebCore tells us to navigate to it, we tell the browser process to
+  // do a back/forward navigation instead.
+
+  GURL url(StringPrintf("%s://go/%d", kBackForwardNavigationScheme, offset));
+  history_navigation_item_ = WebHistoryItem::Create(url, L"", "", NULL);
+  return history_navigation_item_.get();
+}
+
+void RenderView::GoToEntryAtOffset(int offset) {
   history_back_list_count_ += offset;
   history_forward_list_count_ -= offset;
 
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index fa28f0c..fa88cb1 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -274,7 +274,7 @@ class RenderView : public RenderWidget,
   virtual void TakeFocus(WebView* webview, bool reverse);
   virtual void JSOutOfMemory();
 
-  virtual void NavigateBackForwardSoon(int offset);
+  virtual WebHistoryItem* GetHistoryEntryAtOffset(int offset);
   virtual int GetHistoryBackListCount();
   virtual int GetHistoryForwardListCount();
   virtual void OnNavStateChanged(WebView* webview);
@@ -453,6 +453,10 @@ class RenderView : public RenderWidget,
   // Update the feed list.
   void UpdateFeedList(scoped_refptr<FeedList> feedlist);
 
+  // Tells the browser process to navigate to a back/forward entry at the given
+  // offset from current.
+  void GoToEntryAtOffset(int offset);
+
   // RenderView IPC message handlers
   void SendThumbnail();
   void OnPrintPages();
@@ -759,6 +763,11 @@ class RenderView : public RenderWidget,
   // out of date responses.
   int form_field_autofill_request_id_;
 
+  // A cached WebHistoryItem used for back/forward navigations initiated by
+  // WebCore (via the window.history.go API).  We only have one such navigation
+  // pending at a time.
+  scoped_refptr<WebHistoryItem> history_navigation_item_;
+
   // We need to prevent windows from closing themselves with a window.close()
   // call while a blocked popup notification is being displayed. We cannot
   // synchronously querry the Browser process. We cannot wait for the Browser