Correct content script injection for cancelled loads

- Set frame state to document_idle after a failed provisional load to
  prevent getting stuck when a provisional load is cancelled.

BUG=533863
TEST=./browser_tests --gtest_filter=ExecuteScriptApiTest.FrameWithHttp204

Review URL: https://codereview.chromium.org/1621973002

Cr-Commit-Position: refs/heads/master@{#372556}

1 files changed, 23 insertions, 2 deletions

diff --git a/extensions/renderer/script_injection_manager.cc b/extensions/renderer/script_injection_manager.cc
index 8876707..aa0f5d3 100644
--- a/extensions/renderer/script_injection_manager.cc
+++ b/extensions/renderer/script_injection_manager.cc
@@ -71,6 +71,7 @@ class ScriptInjectionManager::RFOHelper : public content::RenderFrameObserver {
   bool OnMessageReceived(const IPC::Message& message) override;
   void DidCreateNewDocument() override;
   void DidCreateDocumentElement() override;
+  void DidFailProvisionalLoad(const blink::WebURLError& error) override;
   void DidFinishDocumentLoad() override;
   void DidFinishLoad() override;
   void FrameDetached() override;
@@ -138,6 +139,27 @@ void ScriptInjectionManager::RFOHelper::DidCreateDocumentElement() {
   manager_->StartInjectScripts(render_frame(), UserScript::DOCUMENT_START);
 }
 
+void ScriptInjectionManager::RFOHelper::DidFailProvisionalLoad(
+    const blink::WebURLError& error) {
+  FrameStatusMap::iterator it = manager_->frame_statuses_.find(render_frame());
+  if (it != manager_->frame_statuses_.end() &&
+      it->second == UserScript::DOCUMENT_START) {
+    // Since the provisional load failed, the frame stays at its previous loaded
+    // state and origin (or the parent's origin for new/about:blank frames).
+    // Reset the frame to DOCUMENT_IDLE in order to reflect that the frame is
+    // done loading, and avoid any deadlock in the system.
+    //
+    // We skip injection of DOCUMENT_END and DOCUMENT_IDLE scripts, because the
+    // injections closely follow the DOMContentLoaded (and onload) events, which
+    // are not triggered after a failed provisional load.
+    // This assumption is verified in the checkDOMContentLoadedEvent subtest of
+    // ExecuteScriptApiTest.FrameWithHttp204 (browser_tests).
+    InvalidateAndResetFrame();
+    should_run_idle_ = false;
+    manager_->frame_statuses_[render_frame()] = UserScript::DOCUMENT_IDLE;
+  }
+}
+
 void ScriptInjectionManager::RFOHelper::DidFinishDocumentLoad() {
   DCHECK(content::RenderThread::Get());
   manager_->StartInjectScripts(render_frame(), UserScript::DOCUMENT_END);
@@ -461,8 +483,7 @@ void ScriptInjectionManager::HandlePermitScriptInjection(int64_t request_id) {
 
   // At this point, because the request is present in pending_injections_, we
   // know that this is the same page that issued the request (otherwise,
-  // RFOHelper's DidStartProvisionalLoad callback would have caused it to be
-  // cleared out).
+  // RFOHelper::InvalidateAndResetFrame would have caused it to be cleared out).
 
   scoped_ptr<ScriptInjection> injection(std::move(*iter));
   pending_injections_.erase(iter);