Safely cancel prerenders on threads other than the UI thread.

Previously, prerendering was cancelled on the IO thread by not
doing something, and then passing a task to the UI thread
to abort the prerender.  This resulted in a race which could
result in swapping in the prerender before the task was
executed.  This fixes that.

BUG=83062
TEST=PrerenderStatusManagerTests, PrerenderBrowserTests
Review URL: http://codereview.chromium.org/7038012

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@86082 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 10 insertions, 44 deletions

diff --git a/content/browser/DEPS b/content/browser/DEPS
index 055ff1a..5678284 100644
--- a/content/browser/DEPS
+++ b/content/browser/DEPS
@@ -62,6 +62,7 @@ include_rules = [
 

   # http://crbug.com/77090

   "+chrome/browser/prerender/prerender_manager.h",

+  "+chrome/browser/prerender/prerender_tracker.h",

 

   # http://crbug.com/76788

   "+chrome/browser/profiles/profile.h",

diff --git a/content/browser/renderer_host/resource_dispatcher_host.cc b/content/browser/renderer_host/resource_dispatcher_host.cc
index 8fdc0c3..451f99e 100644
--- a/content/browser/renderer_host/resource_dispatcher_host.cc
+++ b/content/browser/renderer_host/resource_dispatcher_host.cc
@@ -26,6 +26,7 @@
 #include "chrome/browser/external_protocol_handler.h"
 #include "chrome/browser/net/url_request_tracking.h"
 #include "chrome/browser/prerender/prerender_manager.h"
+#include "chrome/browser/prerender/prerender_tracker.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/renderer_host/download_resource_handler.h"
 #include "chrome/browser/renderer_host/safe_browsing_resource_handler.h"
@@ -432,7 +433,9 @@ void ResourceDispatcherHost::BeginRequest(
   }
 
   const GURL referrer = MaybeStripReferrer(request_data.referrer);
-  const bool is_prerendering = IsPrerenderingChildRoutePair(child_id, route_id);
+  const bool is_prerendering =
+      prerender::PrerenderTracker::GetInstance()->IsPrerenderingOnIOThread(
+          child_id, route_id);
 
   // Handle a PREFETCH resource type. If prefetch is disabled, squelch the
   // request. If prerendering is enabled, trigger a prerender for the URL
@@ -467,16 +470,11 @@ void ResourceDispatcherHost::BeginRequest(
   // Abort any prerenders that spawn requests that use invalid HTTP methods.
   if (is_prerendering &&
       !prerender::PrerenderManager::IsValidHttpMethod(request_data.method)) {
-    BrowserThread::PostTask(
-        BrowserThread::UI, FROM_HERE,
-        NewRunnableFunction(
-            prerender::DestroyPreloadForRenderView,
-            resource_context.prerender_manager(),
-            child_id,
-            route_id,
-            prerender::FINAL_STATUS_INVALID_HTTP_METHOD));
-    AbortRequestBeforeItStarts(filter_, sync_result, route_id, request_id);
-    return;
+    if (prerender::PrerenderTracker::GetInstance()->TryCancelOnIOThread(
+            child_id, route_id, prerender::FINAL_STATUS_INVALID_HTTP_METHOD)) {
+      AbortRequestBeforeItStarts(filter_, sync_result, route_id, request_id);
+      return;
+    }
   }
 
   // Construct the event handler.
@@ -2036,28 +2034,6 @@ net::RequestPriority ResourceDispatcherHost::DetermineRequestPriority(
   }
 }
 
-void ResourceDispatcherHost::AddPrerenderChildRoutePair(int child_id,
-                                                        int route_id) {
-  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  DCHECK(!IsPrerenderingChildRoutePair(child_id, route_id));
-  prerender_child_route_pairs_.insert(std::make_pair(child_id, route_id));
-}
-
-void ResourceDispatcherHost::RemovePrerenderChildRoutePair(int child_id,
-                                                           int route_id) {
-  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  DCHECK(IsPrerenderingChildRoutePair(child_id, route_id));
-  prerender_child_route_pairs_.erase(std::make_pair(child_id, route_id));
-}
-
-bool ResourceDispatcherHost::IsPrerenderingChildRoutePair(int child_id,
-                                                          int route_id) const {
-  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  std::pair<int, int> c_r_pair = std::make_pair(child_id, route_id);
-  return (prerender_child_route_pairs_.find(c_r_pair) !=
-            prerender_child_route_pairs_.end());
-}
-
 
 // static
 bool ResourceDispatcherHost::is_prefetch_enabled() {
diff --git a/content/browser/renderer_host/resource_dispatcher_host.h b/content/browser/renderer_host/resource_dispatcher_host.h
index f7a5c64..f8643fe 100644
--- a/content/browser/renderer_host/resource_dispatcher_host.h
+++ b/content/browser/renderer_host/resource_dispatcher_host.h
@@ -244,14 +244,6 @@ class ResourceDispatcherHost : public net::URLRequest::Delegate {
   static bool is_prefetch_enabled();
   static void set_is_prefetch_enabled(bool value);
 
-  void AddPrerenderChildRoutePair(int child_id, int route_id);
-  void RemovePrerenderChildRoutePair(int child_id, int route_id);
-
-  typedef std::set<std::pair<int, int> > PrerenderChildRouteIdPairs;
-  const PrerenderChildRouteIdPairs& prerender_child_route_id_pairs() const {
-    return prerender_child_route_pairs_;
-  }
-
  private:
   FRIEND_TEST_ALL_PREFIXES(ResourceDispatcherHostTest,
                            TestBlockedRequestsProcessDies);
@@ -384,8 +376,6 @@ class ResourceDispatcherHost : public net::URLRequest::Delegate {
                         const GURL& new_first_party_for_cookies);
   void OnReleaseDownloadedFile(int request_id);
 
-  bool IsPrerenderingChildRoutePair(int child_id, int route_id) const;
-
   ResourceHandler* CreateSafeBrowsingResourceHandler(
       ResourceHandler* handler, int child_id, int route_id,
       ResourceType::Type resource_type);
@@ -487,7 +477,6 @@ class ResourceDispatcherHost : public net::URLRequest::Delegate {
   ResourceMessageFilter* filter_;
 
   static bool is_prefetch_enabled_;
-  PrerenderChildRouteIdPairs prerender_child_route_pairs_;
 
 
   DISALLOW_COPY_AND_ASSIGN(ResourceDispatcherHost);