7 files changed, 54 insertions, 0 deletions
diff --git a/content/browser/renderer_host/resource_dispatcher_host.cc b/content/browser/renderer_host/resource_dispatcher_host.cc
index 716cd12..f360590 100644
--- a/content/browser/renderer_host/resource_dispatcher_host.cc
+++ b/content/browser/renderer_host/resource_dispatcher_host.cc
@@ -343,6 +343,8 @@ bool ResourceDispatcherHost::OnMessageReceived(const IPC::Message& message,
     IPC_MESSAGE_HANDLER(ResourceHostMsg_DataDownloaded_ACK, OnDataDownloadedACK)
     IPC_MESSAGE_HANDLER(ResourceHostMsg_UploadProgress_ACK, OnUploadProgressACK)
     IPC_MESSAGE_HANDLER(ResourceHostMsg_CancelRequest, OnCancelRequest)
+    IPC_MESSAGE_HANDLER(ResourceHostMsg_TransferRequestToNewPage,
+                        OnTransferRequestToNewPage)
     IPC_MESSAGE_HANDLER(ResourceHostMsg_FollowRedirect, OnFollowRedirect)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SwapOut_ACK, OnSwapOutACK)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DidLoadResourceFromMemoryCache,
@@ -639,6 +641,24 @@ void ResourceDispatcherHost::OnCancelRequest(int request_id) {
   CancelRequest(filter_->child_id(), request_id, true);
 }
 
+// Assigns the pending request a new routing_id because it was transferred
+// to a new page.
+void ResourceDispatcherHost::OnTransferRequestToNewPage(int new_routing_id,
+                                                        int request_id) {
+  PendingRequestList::iterator i = pending_requests_.find(
+      GlobalRequestID(filter_->child_id(), request_id));
+  if (i == pending_requests_.end()) {
+    // We probably want to remove this warning eventually, but I wanted to be
+    // able to notice when this happens during initial development since it
+    // should be rare and may indicate a bug.
+    DLOG(WARNING) << "Updating a request that wasn't found";
+    return;
+  }
+  net::URLRequest* request = i->second;
+  ResourceDispatcherHostRequestInfo* info = InfoForRequest(request);
+  info->set_route_id(new_routing_id);
+}
+
 void ResourceDispatcherHost::OnFollowRedirect(
     int request_id,
     bool has_new_first_party_for_cookies,
diff --git a/content/browser/renderer_host/resource_dispatcher_host.h b/content/browser/renderer_host/resource_dispatcher_host.h
index 706ecfe..8de0129 100644
--- a/content/browser/renderer_host/resource_dispatcher_host.h
+++ b/content/browser/renderer_host/resource_dispatcher_host.h
@@ -395,6 +395,7 @@ class ResourceDispatcherHost : public net::URLRequest::Delegate {
   void OnDataDownloadedACK(int request_id);
   void OnUploadProgressACK(int request_id);
   void OnCancelRequest(int request_id);
+  void OnTransferRequestToNewPage(int new_routing_id, int request_id);
   void OnFollowRedirect(int request_id,
                         bool has_new_first_party_for_cookies,
                         const GURL& new_first_party_for_cookies);
diff --git a/content/browser/renderer_host/resource_dispatcher_host_request_info.h b/content/browser/renderer_host/resource_dispatcher_host_request_info.h
index 5afdc3e..1e39b77 100644
--- a/content/browser/renderer_host/resource_dispatcher_host_request_info.h
+++ b/content/browser/renderer_host/resource_dispatcher_host_request_info.h
@@ -91,6 +91,10 @@ class ResourceDispatcherHostRequestInfo : public net::URLRequest::UserData {
   // or like-thing in the renderer that the request gets routed to).
   int route_id() const { return route_id_; }
 
+  // The route_id of pending request can change when it is transferred to a new
+  // page (as in iframe transfer using adoptNode JS API).
+  void set_route_id(int route_id) { route_id_ = route_id; }
+
   // The pid of the originating process, if the request is sent on behalf of a
   // another process.  Otherwise it is 0.
   int origin_pid() const { return origin_pid_; }
diff --git a/content/common/resource_dispatcher.cc b/content/common/resource_dispatcher.cc
index c16d92f..2ee2db7 100644
--- a/content/common/resource_dispatcher.cc
+++ b/content/common/resource_dispatcher.cc
@@ -53,6 +53,7 @@ class IPCResourceLoaderBridge : public ResourceLoaderBridge {
   virtual void Cancel();
   virtual void SetDefersLoading(bool value);
   virtual void SyncLoad(SyncLoadResponse* response);
+  virtual void UpdateRoutingId(int new_routing_id);
 
  private:
   ResourceLoaderBridge::Peer* peer_;
@@ -224,6 +225,18 @@ void IPCResourceLoaderBridge::SyncLoad(SyncLoadResponse* response) {
   response->download_file_path = result.download_file_path;
 }
 
+void IPCResourceLoaderBridge::UpdateRoutingId(int new_routing_id) {
+  if (request_id_ < 0) {
+    NOTREACHED() << "Trying to update an unstarted request";
+    return;
+  }
+
+  routing_id_ = new_routing_id;
+  dispatcher_->message_sender()->Send(
+      new ResourceHostMsg_TransferRequestToNewPage(new_routing_id,
+                                                   request_id_));
+}
+
 }  // namespace webkit_glue
 
 // ResourceDispatcher ---------------------------------------------------------
diff --git a/content/common/resource_messages.h b/content/common/resource_messages.h
index bd2251a..cd748b85 100644
--- a/content/common/resource_messages.h
+++ b/content/common/resource_messages.h
@@ -160,6 +160,13 @@ IPC_MESSAGE_ROUTED2(ResourceHostMsg_RequestResource,
 IPC_MESSAGE_ROUTED1(ResourceHostMsg_CancelRequest,
                     int /* request_id */)
 
+// Sets a new routing id for the resource request with the ID given as the
+// parameter. This happens when a pending request is transferred to another
+// page.
+IPC_MESSAGE_CONTROL2(ResourceHostMsg_TransferRequestToNewPage,
+                     int /* new routing_id */,
+                     int /* request_id */)
+
 // Follows a redirect that occured for the resource request with the ID given
 // as the parameter.
 IPC_MESSAGE_ROUTED3(ResourceHostMsg_FollowRedirect,
diff --git a/content/renderer/render_view.cc b/content/renderer/render_view.cc
index baa34d8..369b267 100644
--- a/content/renderer/render_view.cc
+++ b/content/renderer/render_view.cc
@@ -141,6 +141,7 @@
 #include "webkit/glue/webkit_constants.h"
 #include "webkit/glue/webkit_glue.h"
 #include "webkit/glue/webmediaplayer_impl.h"
+#include "webkit/glue/weburlloader_impl.h"
 #include "webkit/plugins/npapi/default_plugin_shared.h"
 #include "webkit/plugins/npapi/plugin_list.h"
 #include "webkit/plugins/npapi/webplugin_delegate.h"
@@ -2824,6 +2825,12 @@ void RenderView::didRunInsecureContent(
       target));
 }
 
+void RenderView::didAdoptURLLoader(WebKit::WebURLLoader* loader) {
+  webkit_glue::WebURLLoaderImpl* loader_impl =
+      static_cast<webkit_glue::WebURLLoaderImpl*>(loader);
+  loader_impl->UpdateRoutingId(routing_id_);
+}
+
 void RenderView::didExhaustMemoryAvailableForScript(WebFrame* frame) {
   Send(new ViewHostMsg_JSOutOfMemory(routing_id_));
 }
diff --git a/content/renderer/render_view.h b/content/renderer/render_view.h
index 1d1919e..13522ce 100644
--- a/content/renderer/render_view.h
+++ b/content/renderer/render_view.h
@@ -138,6 +138,7 @@ class WebPlugin;
 class WebSpeechInputController;
 class WebSpeechInputListener;
 class WebStorageNamespace;
+class WebURLLoader;
 class WebURLRequest;
 class WebView;
 struct WebContextMenuData;
@@ -547,6 +548,7 @@ class RenderView : public RenderWidget,
       WebKit::WebFrame* frame,
       const WebKit::WebSecurityOrigin& origin,
       const WebKit::WebURL& target);
+  virtual void didAdoptURLLoader(WebKit::WebURLLoader* loader);
   virtual void didExhaustMemoryAvailableForScript(WebKit::WebFrame* frame);
   virtual void didCreateScriptContext(WebKit::WebFrame* frame);
   virtual void didDestroyScriptContext(WebKit::WebFrame* frame);