content/browser/frame_host/navigation_controller_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/frame_host/navigation_controller_impl.h"
   6
   7 #include "base/bind.h"
   8 #include "base/command_line.h"
   9 #include "base/logging.h"
  10 #include "base/metrics/histogram.h"
  11 #include "base/strings/string_number_conversions.h"  // Temporary
  12 #include "base/strings/string_util.h"
  13 #include "base/strings/utf_string_conversions.h"
  14 #include "base/time/time.h"
  15 #include "base/trace_event/trace_event.h"
  16 #include "cc/base/switches.h"
  17 #include "content/browser/bad_message.h"
  18 #include "content/browser/browser_url_handler_impl.h"
  19 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
  20 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
  21 #include "content/browser/frame_host/debug_urls.h"
  22 #include "content/browser/frame_host/interstitial_page_impl.h"
  23 #include "content/browser/frame_host/navigation_entry_impl.h"
  24 #include "content/browser/frame_host/navigation_entry_screenshot_manager.h"
  25 #include "content/browser/renderer_host/render_view_host_impl.h"  // Temporary
  26 #include "content/browser/site_instance_impl.h"
  27 #include "content/common/frame_messages.h"
  28 #include "content/common/view_messages.h"
  29 #include "content/public/browser/browser_context.h"
  30 #include "content/public/browser/content_browser_client.h"
  31 #include "content/public/browser/invalidate_type.h"
  32 #include "content/public/browser/navigation_details.h"
  33 #include "content/public/browser/notification_service.h"
  34 #include "content/public/browser/notification_types.h"
  35 #include "content/public/browser/render_widget_host.h"
  36 #include "content/public/browser/render_widget_host_view.h"
  37 #include "content/public/browser/storage_partition.h"
  38 #include "content/public/browser/user_metrics.h"
  39 #include "content/public/common/content_client.h"
  40 #include "content/public/common/content_constants.h"
  41 #include "content/public/common/content_switches.h"
  42 #include "net/base/escape.h"
  43 #include "net/base/mime_util.h"
  44 #include "net/base/net_util.h"
  45 #include "skia/ext/platform_canvas.h"
  46 #include "url/url_constants.h"
  47
  48 namespace content {
  49 namespace {
  50
  51 // Invoked when entries have been pruned, or removed. For example, if the
  52 // current entries are [google, digg, yahoo], with the current entry google,
  53 // and the user types in cnet, then digg and yahoo are pruned.
  54 void NotifyPrunedEntries(NavigationControllerImpl* nav_controller,
  55                          bool from_front,
  56                          int count) {
  57   PrunedDetails details;
  58   details.from_front = from_front;
  59   details.count = count;
  60   NotificationService::current()->Notify(
  61       NOTIFICATION_NAV_LIST_PRUNED,
  62       Source<NavigationController>(nav_controller),
  63       Details<PrunedDetails>(&details));
  64 }
  65
  66 // Ensure the given NavigationEntry has a valid state, so that WebKit does not
  67 // get confused if we navigate back to it.
  68 //
  69 // An empty state is treated as a new navigation by WebKit, which would mean
  70 // losing the navigation entries and generating a new navigation entry after
  71 // this one. We don't want that. To avoid this we create a valid state which
  72 // WebKit will not treat as a new navigation.
  73 void SetPageStateIfEmpty(NavigationEntryImpl* entry) {
  74   if (!entry->GetPageState().IsValid())
  75     entry->SetPageState(PageState::CreateFromURL(entry->GetURL()));
  76 }
  77
  78 NavigationEntryImpl::RestoreType ControllerRestoreTypeToEntryType(
  79     NavigationController::RestoreType type) {
  80   switch (type) {
  81     case NavigationController::RESTORE_CURRENT_SESSION:
  82       return NavigationEntryImpl::RESTORE_CURRENT_SESSION;
  83     case NavigationController::RESTORE_LAST_SESSION_EXITED_CLEANLY:
  84       return NavigationEntryImpl::RESTORE_LAST_SESSION_EXITED_CLEANLY;
  85     case NavigationController::RESTORE_LAST_SESSION_CRASHED:
  86       return NavigationEntryImpl::RESTORE_LAST_SESSION_CRASHED;
  87   }
  88   NOTREACHED();
  89   return NavigationEntryImpl::RESTORE_CURRENT_SESSION;
  90 }
  91
  92 // Configure all the NavigationEntries in entries for restore. This resets
  93 // the transition type to reload and makes sure the content state isn't empty.
  94 void ConfigureEntriesForRestore(
  95     std::vector<linked_ptr<NavigationEntryImpl> >* entries,
  96     NavigationController::RestoreType type) {
  97   for (size_t i = 0; i < entries->size(); ++i) {
  98     // Use a transition type of reload so that we don't incorrectly increase
  99     // the typed count.
 100     (*entries)[i]->SetTransitionType(ui::PAGE_TRANSITION_RELOAD);
 101     (*entries)[i]->set_restore_type(ControllerRestoreTypeToEntryType(type));
 102     // NOTE(darin): This code is only needed for backwards compat.
 103     SetPageStateIfEmpty((*entries)[i].get());
 104   }
 105 }
 106
 107 // There are two general cases where a navigation is in page:
 108 // 1. A fragment navigation, in which the url is kept the same except for the
 109 //    reference fragment.
 110 // 2. A history API navigation (pushState and replaceState). This case is
 111 //    always in-page, but the urls are not guaranteed to match excluding the
 112 //    fragment. The relevant spec allows pushState/replaceState to any URL on
 113 //    the same origin.
 114 // However, due to reloads, even identical urls are *not* guaranteed to be
 115 // in-page navigations, we have to trust the renderer almost entirely.
 116 // The one thing we do know is that cross-origin navigations will *never* be
 117 // in-page. Therefore, trust the renderer if the URLs are on the same origin,
 118 // and assume the renderer is malicious if a cross-origin navigation claims to
 119 // be in-page.
 120 bool AreURLsInPageNavigation(const GURL& existing_url,
 121                              const GURL& new_url,
 122                              bool renderer_says_in_page,
 123                              RenderFrameHost* rfh) {
 124   WebPreferences prefs = rfh->GetRenderViewHost()->GetWebkitPreferences();
 125   bool is_same_origin = existing_url.is_empty() ||
 126                         // TODO(japhet): We should only permit navigations
 127                         // originating from about:blank to be in-page if the
 128                         // about:blank is the first document that frame loaded.
 129                         // We don't have sufficient information to identify
 130                         // that case at the moment, so always allow about:blank
 131                         // for now.
 132                         existing_url == GURL(url::kAboutBlankURL) ||
 133                         existing_url.GetOrigin() == new_url.GetOrigin() ||
 134                         !prefs.web_security_enabled ||
 135                         (prefs.allow_universal_access_from_file_urls &&
 136                          existing_url.SchemeIs(url::kFileScheme));
 137   if (!is_same_origin && renderer_says_in_page) {
 138     bad_message::ReceivedBadMessage(rfh->GetProcess(),
 139                                     bad_message::NC_IN_PAGE_NAVIGATION);
 140   }
 141   return is_same_origin && renderer_says_in_page;
 142 }
 143
 144 // Determines whether or not we should be carrying over a user agent override
 145 // between two NavigationEntries.
 146 bool ShouldKeepOverride(const NavigationEntry* last_entry) {
 147   return last_entry && last_entry->GetIsOverridingUserAgent();
 148 }
 149
 150 }  // namespace
 151
 152 // NavigationControllerImpl ----------------------------------------------------
 153
 154 const size_t kMaxEntryCountForTestingNotSet = static_cast<size_t>(-1);
 155
 156 // static
 157 size_t NavigationControllerImpl::max_entry_count_for_testing_ =
 158     kMaxEntryCountForTestingNotSet;
 159
 160 // Should Reload check for post data? The default is true, but is set to false
 161 // when testing.
 162 static bool g_check_for_repost = true;
 163
 164 // static
 165 NavigationEntry* NavigationController::CreateNavigationEntry(
 166       const GURL& url,
 167       const Referrer& referrer,
 168       ui::PageTransition transition,
 169       bool is_renderer_initiated,
 170       const std::string& extra_headers,
 171       BrowserContext* browser_context) {
 172   // Fix up the given URL before letting it be rewritten, so that any minor
 173   // cleanup (e.g., removing leading dots) will not lead to a virtual URL.
 174   GURL dest_url(url);
 175   BrowserURLHandlerImpl::GetInstance()->FixupURLBeforeRewrite(&dest_url,
 176                                                               browser_context);
 177
 178   // Allow the browser URL handler to rewrite the URL. This will, for example,
 179   // remove "view-source:" from the beginning of the URL to get the URL that
 180   // will actually be loaded. This real URL won't be shown to the user, just
 181   // used internally.
 182   GURL loaded_url(dest_url);
 183   bool reverse_on_redirect = false;
 184   BrowserURLHandlerImpl::GetInstance()->RewriteURLIfNecessary(
 185       &loaded_url, browser_context, &reverse_on_redirect);
 186
 187   NavigationEntryImpl* entry = new NavigationEntryImpl(
 188       NULL,  // The site instance for tabs is sent on navigation
 189              // (WebContents::GetSiteInstance).
 190       -1,
 191       loaded_url,
 192       referrer,
 193       base::string16(),
 194       transition,
 195       is_renderer_initiated);
 196   entry->SetVirtualURL(dest_url);
 197   entry->set_user_typed_url(dest_url);
 198   entry->set_update_virtual_url_with_url(reverse_on_redirect);
 199   entry->set_extra_headers(extra_headers);
 200   return entry;
 201 }
 202
 203 // static
 204 void NavigationController::DisablePromptOnRepost() {
 205   g_check_for_repost = false;
 206 }
 207
 208 base::Time NavigationControllerImpl::TimeSmoother::GetSmoothedTime(
 209     base::Time t) {
 210   // If |t| is between the water marks, we're in a run of duplicates
 211   // or just getting out of it, so increase the high-water mark to get
 212   // a time that probably hasn't been used before and return it.
 213   if (low_water_mark_ <= t && t <= high_water_mark_) {
 214     high_water_mark_ += base::TimeDelta::FromMicroseconds(1);
 215     return high_water_mark_;
 216   }
 217
 218   // Otherwise, we're clear of the last duplicate run, so reset the
 219   // water marks.
 220   low_water_mark_ = high_water_mark_ = t;
 221   return t;
 222 }
 223
 224 NavigationControllerImpl::NavigationControllerImpl(
 225     NavigationControllerDelegate* delegate,
 226     BrowserContext* browser_context)
 227     : browser_context_(browser_context),
 228       pending_entry_(NULL),
 229       failed_pending_entry_id_(0),
 230       failed_pending_entry_should_replace_(false),
 231       last_committed_entry_index_(-1),
 232       pending_entry_index_(-1),
 233       transient_entry_index_(-1),
 234       delegate_(delegate),
 235       max_restored_page_id_(-1),
 236       ssl_manager_(this),
 237       needs_reload_(false),
 238       is_initial_navigation_(true),
 239       in_navigate_to_pending_entry_(false),
 240       pending_reload_(NO_RELOAD),
 241       get_timestamp_callback_(base::Bind(&base::Time::Now)),
 242       screenshot_manager_(new NavigationEntryScreenshotManager(this)) {
 243   DCHECK(browser_context_);
 244 }
 245
 246 NavigationControllerImpl::~NavigationControllerImpl() {
 247   DiscardNonCommittedEntriesInternal();
 248 }
 249
 250 WebContents* NavigationControllerImpl::GetWebContents() const {
 251   return delegate_->GetWebContents();
 252 }
 253
 254 BrowserContext* NavigationControllerImpl::GetBrowserContext() const {
 255   return browser_context_;
 256 }
 257
 258 void NavigationControllerImpl::SetBrowserContext(
 259     BrowserContext* browser_context) {
 260   browser_context_ = browser_context;
 261 }
 262
 263 void NavigationControllerImpl::Restore(
 264     int selected_navigation,
 265     RestoreType type,
 266     std::vector<NavigationEntry*>* entries) {
 267   // Verify that this controller is unused and that the input is valid.
 268   DCHECK(GetEntryCount() == 0 && !GetPendingEntry());
 269   DCHECK(selected_navigation >= 0 &&
 270          selected_navigation < static_cast<int>(entries->size()));
 271
 272   needs_reload_ = true;
 273   for (size_t i = 0; i < entries->size(); ++i) {
 274     NavigationEntryImpl* entry =
 275         NavigationEntryImpl::FromNavigationEntry((*entries)[i]);
 276     entries_.push_back(linked_ptr<NavigationEntryImpl>(entry));
 277   }
 278   entries->clear();
 279
 280   // And finish the restore.
 281   FinishRestore(selected_navigation, type);
 282 }
 283
 284 void NavigationControllerImpl::Reload(bool check_for_repost) {
 285   ReloadInternal(check_for_repost, RELOAD);
 286 }
 287 void NavigationControllerImpl::ReloadIgnoringCache(bool check_for_repost) {
 288   ReloadInternal(check_for_repost, RELOAD_IGNORING_CACHE);
 289 }
 290 void NavigationControllerImpl::ReloadOriginalRequestURL(bool check_for_repost) {
 291   ReloadInternal(check_for_repost, RELOAD_ORIGINAL_REQUEST_URL);
 292 }
 293
 294 void NavigationControllerImpl::ReloadInternal(bool check_for_repost,
 295                                               ReloadType reload_type) {
 296   if (transient_entry_index_ != -1) {
 297     // If an interstitial is showing, treat a reload as a navigation to the
 298     // transient entry's URL.
 299     NavigationEntryImpl* transient_entry = GetTransientEntry();
 300     if (!transient_entry)
 301       return;
 302     LoadURL(transient_entry->GetURL(),
 303             Referrer(),
 304             ui::PAGE_TRANSITION_RELOAD,
 305             transient_entry->extra_headers());
 306     return;
 307   }
 308
 309   NavigationEntryImpl* entry = NULL;
 310   int current_index = -1;
 311
 312   // If we are reloading the initial navigation, just use the current
 313   // pending entry.  Otherwise look up the current entry.
 314   if (IsInitialNavigation() && pending_entry_) {
 315     entry = pending_entry_;
 316     // The pending entry might be in entries_ (e.g., after a Clone), so we
 317     // should also update the current_index.
 318     current_index = pending_entry_index_;
 319   } else {
 320     DiscardNonCommittedEntriesInternal();
 321     current_index = GetCurrentEntryIndex();
 322     if (current_index != -1) {
 323       entry = GetEntryAtIndex(current_index);
 324     }
 325   }
 326
 327   // If we are no where, then we can't reload.  TODO(darin): We should add a
 328   // CanReload method.
 329   if (!entry)
 330     return;
 331
 332   if (reload_type == NavigationControllerImpl::RELOAD_ORIGINAL_REQUEST_URL &&
 333       entry->GetOriginalRequestURL().is_valid() && !entry->GetHasPostData()) {
 334     // We may have been redirected when navigating to the current URL.
 335     // Use the URL the user originally intended to visit, if it's valid and if a
 336     // POST wasn't involved; the latter case avoids issues with sending data to
 337     // the wrong page.
 338     entry->SetURL(entry->GetOriginalRequestURL());
 339     entry->SetReferrer(Referrer());
 340   }
 341
 342   if (g_check_for_repost && check_for_repost &&
 343       entry->GetHasPostData()) {
 344     // The user is asking to reload a page with POST data. Prompt to make sure
 345     // they really want to do this. If they do, the dialog will call us back
 346     // with check_for_repost = false.
 347     delegate_->NotifyBeforeFormRepostWarningShow();
 348
 349     pending_reload_ = reload_type;
 350     delegate_->ActivateAndShowRepostFormWarningDialog();
 351   } else {
 352     if (!IsInitialNavigation())
 353       DiscardNonCommittedEntriesInternal();
 354
 355     // If we are reloading an entry that no longer belongs to the current
 356     // site instance (for example, refreshing a page for just installed app),
 357     // the reload must happen in a new process.
 358     // The new entry must have a new page_id and site instance, so it behaves
 359     // as new navigation (which happens to clear forward history).
 360     // Tabs that are discarded due to low memory conditions may not have a site
 361     // instance, and should not be treated as a cross-site reload.
 362     SiteInstanceImpl* site_instance = entry->site_instance();
 363     // Permit reloading guests without further checks.
 364     bool is_isolated_guest = site_instance && site_instance->HasProcess() &&
 365         site_instance->GetProcess()->IsIsolatedGuest();
 366     if (!is_isolated_guest && site_instance &&
 367         site_instance->HasWrongProcessForURL(entry->GetURL())) {
 368       // Create a navigation entry that resembles the current one, but do not
 369       // copy page id, site instance, content state, or timestamp.
 370       NavigationEntryImpl* nav_entry = NavigationEntryImpl::FromNavigationEntry(
 371           CreateNavigationEntry(
 372               entry->GetURL(), entry->GetReferrer(), entry->GetTransitionType(),
 373               false, entry->extra_headers(), browser_context_));
 374
 375       // Mark the reload type as NO_RELOAD, so navigation will not be considered
 376       // a reload in the renderer.
 377       reload_type = NavigationController::NO_RELOAD;
 378
 379       nav_entry->set_should_replace_entry(true);
 380       pending_entry_ = nav_entry;
 381     } else {
 382       pending_entry_ = entry;
 383       pending_entry_index_ = current_index;
 384
 385       // The title of the page being reloaded might have been removed in the
 386       // meanwhile, so we need to revert to the default title upon reload and
 387       // invalidate the previously cached title (SetTitle will do both).
 388       // See Chromium issue 96041.
 389       pending_entry_->SetTitle(base::string16());
 390
 391       pending_entry_->SetTransitionType(ui::PAGE_TRANSITION_RELOAD);
 392     }
 393
 394     NavigateToPendingEntry(reload_type);
 395   }
 396 }
 397
 398 void NavigationControllerImpl::CancelPendingReload() {
 399   DCHECK(pending_reload_ != NO_RELOAD);
 400   pending_reload_ = NO_RELOAD;
 401 }
 402
 403 void NavigationControllerImpl::ContinuePendingReload() {
 404   if (pending_reload_ == NO_RELOAD) {
 405     NOTREACHED();
 406   } else {
 407     ReloadInternal(false, pending_reload_);
 408     pending_reload_ = NO_RELOAD;
 409   }
 410 }
 411
 412 bool NavigationControllerImpl::IsInitialNavigation() const {
 413   return is_initial_navigation_;
 414 }
 415
 416 NavigationEntryImpl* NavigationControllerImpl::GetEntryWithPageID(
 417   SiteInstance* instance, int32 page_id) const {
 418   int index = GetEntryIndexWithPageID(instance, page_id);
 419   return (index != -1) ? entries_[index].get() : NULL;
 420 }
 421
 422 void NavigationControllerImpl::LoadEntry(NavigationEntryImpl* entry) {
 423   // When navigating to a new page, we don't know for sure if we will actually
 424   // end up leaving the current page.  The new page load could for example
 425   // result in a download or a 'no content' response (e.g., a mailto: URL).
 426   SetPendingEntry(entry);
 427   NavigateToPendingEntry(NO_RELOAD);
 428 }
 429
 430 void NavigationControllerImpl::SetPendingEntry(NavigationEntryImpl* entry) {
 431   DiscardNonCommittedEntriesInternal();
 432   pending_entry_ = entry;
 433   NotificationService::current()->Notify(
 434       NOTIFICATION_NAV_ENTRY_PENDING,
 435       Source<NavigationController>(this),
 436       Details<NavigationEntry>(entry));
 437 }
 438
 439 NavigationEntryImpl* NavigationControllerImpl::GetActiveEntry() const {
 440   if (transient_entry_index_ != -1)
 441     return entries_[transient_entry_index_].get();
 442   if (pending_entry_)
 443     return pending_entry_;
 444   return GetLastCommittedEntry();
 445 }
 446
 447 NavigationEntryImpl* NavigationControllerImpl::GetVisibleEntry() const {
 448   if (transient_entry_index_ != -1)
 449     return entries_[transient_entry_index_].get();
 450   // The pending entry is safe to return for new (non-history), browser-
 451   // initiated navigations.  Most renderer-initiated navigations should not
 452   // show the pending entry, to prevent URL spoof attacks.
 453   //
 454   // We make an exception for renderer-initiated navigations in new tabs, as
 455   // long as no other page has tried to access the initial empty document in
 456   // the new tab.  If another page modifies this blank page, a URL spoof is
 457   // possible, so we must stop showing the pending entry.
 458   bool safe_to_show_pending =
 459       pending_entry_ &&
 460       // Require a new navigation.
 461       pending_entry_index_ == -1 &&
 462       // Require either browser-initiated or an unmodified new tab.
 463       (!pending_entry_->is_renderer_initiated() || IsUnmodifiedBlankTab());
 464
 465   // Also allow showing the pending entry for history navigations in a new tab,
 466   // such as Ctrl+Back.  In this case, no existing page is visible and no one
 467   // can script the new tab before it commits.
 468   if (!safe_to_show_pending &&
 469       pending_entry_ &&
 470       pending_entry_index_ != -1 &&
 471       IsInitialNavigation() &&
 472       !pending_entry_->is_renderer_initiated())
 473     safe_to_show_pending = true;
 474
 475   if (safe_to_show_pending)
 476     return pending_entry_;
 477   return GetLastCommittedEntry();
 478 }
 479
 480 int NavigationControllerImpl::GetCurrentEntryIndex() const {
 481   if (transient_entry_index_ != -1)
 482     return transient_entry_index_;
 483   if (pending_entry_index_ != -1)
 484     return pending_entry_index_;
 485   return last_committed_entry_index_;
 486 }
 487
 488 NavigationEntryImpl* NavigationControllerImpl::GetLastCommittedEntry() const {
 489   if (last_committed_entry_index_ == -1)
 490     return NULL;
 491   return entries_[last_committed_entry_index_].get();
 492 }
 493
 494 bool NavigationControllerImpl::CanViewSource() const {
 495   const std::string& mime_type = delegate_->GetContentsMimeType();
 496   bool is_viewable_mime_type = net::IsSupportedNonImageMimeType(mime_type) &&
 497       !net::IsSupportedMediaMimeType(mime_type);
 498   NavigationEntry* visible_entry = GetVisibleEntry();
 499   return visible_entry && !visible_entry->IsViewSourceMode() &&
 500       is_viewable_mime_type && !delegate_->GetInterstitialPage();
 501 }
 502
 503 int NavigationControllerImpl::GetLastCommittedEntryIndex() const {
 504   return last_committed_entry_index_;
 505 }
 506
 507 int NavigationControllerImpl::GetEntryCount() const {
 508   DCHECK(entries_.size() <= max_entry_count());
 509   return static_cast<int>(entries_.size());
 510 }
 511
 512 NavigationEntryImpl* NavigationControllerImpl::GetEntryAtIndex(
 513     int index) const {
 514   return entries_.at(index).get();
 515 }
 516
 517 NavigationEntryImpl* NavigationControllerImpl::GetEntryAtOffset(
 518     int offset) const {
 519   int index = GetIndexForOffset(offset);
 520   if (index < 0 || index >= GetEntryCount())
 521     return NULL;
 522
 523   return entries_[index].get();
 524 }
 525
 526 int NavigationControllerImpl::GetIndexForOffset(int offset) const {
 527   return GetCurrentEntryIndex() + offset;
 528 }
 529
 530 void NavigationControllerImpl::TakeScreenshot() {
 531   screenshot_manager_->TakeScreenshot();
 532 }
 533
 534 void NavigationControllerImpl::SetScreenshotManager(
 535     NavigationEntryScreenshotManager* manager) {
 536   screenshot_manager_.reset(manager ? manager :
 537                             new NavigationEntryScreenshotManager(this));
 538 }
 539
 540 bool NavigationControllerImpl::CanGoBack() const {
 541   return entries_.size() > 1 && GetCurrentEntryIndex() > 0;
 542 }
 543
 544 bool NavigationControllerImpl::CanGoForward() const {
 545   int index = GetCurrentEntryIndex();
 546   return index >= 0 && index < (static_cast<int>(entries_.size()) - 1);
 547 }
 548
 549 bool NavigationControllerImpl::CanGoToOffset(int offset) const {
 550   int index = GetIndexForOffset(offset);
 551   return index >= 0 && index < GetEntryCount();
 552 }
 553
 554 void NavigationControllerImpl::GoBack() {
 555   if (!CanGoBack()) {
 556     NOTREACHED();
 557     return;
 558   }
 559
 560   // Base the navigation on where we are now...
 561   int current_index = GetCurrentEntryIndex();
 562
 563   DiscardNonCommittedEntries();
 564
 565   pending_entry_index_ = current_index - 1;
 566   entries_[pending_entry_index_]->SetTransitionType(
 567       ui::PageTransitionFromInt(
 568           entries_[pending_entry_index_]->GetTransitionType() |
 569           ui::PAGE_TRANSITION_FORWARD_BACK));
 570   NavigateToPendingEntry(NO_RELOAD);
 571 }
 572
 573 void NavigationControllerImpl::GoForward() {
 574   if (!CanGoForward()) {
 575     NOTREACHED();
 576     return;
 577   }
 578
 579   bool transient = (transient_entry_index_ != -1);
 580
 581   // Base the navigation on where we are now...
 582   int current_index = GetCurrentEntryIndex();
 583
 584   DiscardNonCommittedEntries();
 585
 586   pending_entry_index_ = current_index;
 587   // If there was a transient entry, we removed it making the current index
 588   // the next page.
 589   if (!transient)
 590     pending_entry_index_++;
 591
 592   entries_[pending_entry_index_]->SetTransitionType(
 593       ui::PageTransitionFromInt(
 594           entries_[pending_entry_index_]->GetTransitionType() |
 595           ui::PAGE_TRANSITION_FORWARD_BACK));
 596   NavigateToPendingEntry(NO_RELOAD);
 597 }
 598
 599 void NavigationControllerImpl::GoToIndex(int index) {
 600   if (index < 0 || index >= static_cast<int>(entries_.size())) {
 601     NOTREACHED();
 602     return;
 603   }
 604
 605   if (transient_entry_index_ != -1) {
 606     if (index == transient_entry_index_) {
 607       // Nothing to do when navigating to the transient.
 608       return;
 609     }
 610     if (index > transient_entry_index_) {
 611       // Removing the transient is goint to shift all entries by 1.
 612       index--;
 613     }
 614   }
 615
 616   DiscardNonCommittedEntries();
 617
 618   pending_entry_index_ = index;
 619   entries_[pending_entry_index_]->SetTransitionType(
 620       ui::PageTransitionFromInt(
 621           entries_[pending_entry_index_]->GetTransitionType() |
 622           ui::PAGE_TRANSITION_FORWARD_BACK));
 623   NavigateToPendingEntry(NO_RELOAD);
 624 }
 625
 626 void NavigationControllerImpl::GoToOffset(int offset) {
 627   if (!CanGoToOffset(offset))
 628     return;
 629
 630   GoToIndex(GetIndexForOffset(offset));
 631 }
 632
 633 bool NavigationControllerImpl::RemoveEntryAtIndex(int index) {
 634   if (index == last_committed_entry_index_ ||
 635       index == pending_entry_index_)
 636     return false;
 637
 638   RemoveEntryAtIndexInternal(index);
 639   return true;
 640 }
 641
 642 void NavigationControllerImpl::UpdateVirtualURLToURL(
 643     NavigationEntryImpl* entry, const GURL& new_url) {
 644   GURL new_virtual_url(new_url);
 645   if (BrowserURLHandlerImpl::GetInstance()->ReverseURLRewrite(
 646           &new_virtual_url, entry->GetVirtualURL(), browser_context_)) {
 647     entry->SetVirtualURL(new_virtual_url);
 648   }
 649 }
 650
 651 void NavigationControllerImpl::LoadURL(
 652     const GURL& url,
 653     const Referrer& referrer,
 654     ui::PageTransition transition,
 655     const std::string& extra_headers) {
 656   LoadURLParams params(url);
 657   params.referrer = referrer;
 658   params.transition_type = transition;
 659   params.extra_headers = extra_headers;
 660   LoadURLWithParams(params);
 661 }
 662
 663 void NavigationControllerImpl::LoadURLWithParams(const LoadURLParams& params) {
 664   TRACE_EVENT1("browser,navigation",
 665                "NavigationControllerImpl::LoadURLWithParams",
 666                "url", params.url.possibly_invalid_spec());
 667   if (HandleDebugURL(params.url, params.transition_type)) {
 668     // If Telemetry is running, allow the URL load to proceed as if it's
 669     // unhandled, otherwise Telemetry can't tell if Navigation completed.
 670     if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
 671             cc::switches::kEnableGpuBenchmarking))
 672       return;
 673   }
 674
 675   // Any renderer-side debug URLs or javascript: URLs should be ignored if the
 676   // renderer process is not live, unless it is the initial navigation of the
 677   // tab.
 678   if (IsRendererDebugURL(params.url)) {
 679     // TODO(creis): Find the RVH for the correct frame.
 680     if (!delegate_->GetRenderViewHost()->IsRenderViewLive() &&
 681         !IsInitialNavigation())
 682       return;
 683   }
 684
 685   // Checks based on params.load_type.
 686   switch (params.load_type) {
 687     case LOAD_TYPE_DEFAULT:
 688       break;
 689     case LOAD_TYPE_BROWSER_INITIATED_HTTP_POST:
 690       if (!params.url.SchemeIs(url::kHttpScheme) &&
 691           !params.url.SchemeIs(url::kHttpsScheme)) {
 692         NOTREACHED() << "Http post load must use http(s) scheme.";
 693         return;
 694       }
 695       break;
 696     case LOAD_TYPE_DATA:
 697       if (!params.url.SchemeIs(url::kDataScheme)) {
 698         NOTREACHED() << "Data load must use data scheme.";
 699         return;
 700       }
 701       break;
 702     default:
 703       NOTREACHED();
 704       break;
 705   };
 706
 707   // The user initiated a load, we don't need to reload anymore.
 708   needs_reload_ = false;
 709
 710   bool override = false;
 711   switch (params.override_user_agent) {
 712     case UA_OVERRIDE_INHERIT:
 713       override = ShouldKeepOverride(GetLastCommittedEntry());
 714       break;
 715     case UA_OVERRIDE_TRUE:
 716       override = true;
 717       break;
 718     case UA_OVERRIDE_FALSE:
 719       override = false;
 720       break;
 721     default:
 722       NOTREACHED();
 723       break;
 724   }
 725
 726   NavigationEntryImpl* entry = NavigationEntryImpl::FromNavigationEntry(
 727       CreateNavigationEntry(
 728           params.url,
 729           params.referrer,
 730           params.transition_type,
 731           params.is_renderer_initiated,
 732           params.extra_headers,
 733           browser_context_));
 734   if (params.frame_tree_node_id != -1)
 735     entry->set_frame_tree_node_id(params.frame_tree_node_id);
 736   entry->set_source_site_instance(
 737       static_cast<SiteInstanceImpl*>(params.source_site_instance.get()));
 738   if (params.redirect_chain.size() > 0)
 739     entry->SetRedirectChain(params.redirect_chain);
 740   // Don't allow an entry replacement if there is no entry to replace.
 741   // http://crbug.com/457149
 742   if (params.should_replace_current_entry && entries_.size() > 0)
 743     entry->set_should_replace_entry(true);
 744   entry->set_should_clear_history_list(params.should_clear_history_list);
 745   entry->SetIsOverridingUserAgent(override);
 746   entry->set_transferred_global_request_id(
 747       params.transferred_global_request_id);
 748   entry->SetFrameToNavigate(params.frame_name);
 749
 750 #if defined(OS_ANDROID)
 751   if (params.intent_received_timestamp > 0) {
 752     entry->set_intent_received_timestamp(
 753         base::TimeTicks() +
 754         base::TimeDelta::FromMilliseconds(params.intent_received_timestamp));
 755   }
 756 #endif
 757
 758   switch (params.load_type) {
 759     case LOAD_TYPE_DEFAULT:
 760       break;
 761     case LOAD_TYPE_BROWSER_INITIATED_HTTP_POST:
 762       entry->SetHasPostData(true);
 763       entry->SetBrowserInitiatedPostData(
 764           params.browser_initiated_post_data.get());
 765       break;
 766     case LOAD_TYPE_DATA:
 767       entry->SetBaseURLForDataURL(params.base_url_for_data_url);
 768       entry->SetVirtualURL(params.virtual_url_for_data_url);
 769       entry->SetCanLoadLocalResources(params.can_load_local_resources);
 770       break;
 771     default:
 772       NOTREACHED();
 773       break;
 774   };
 775
 776   LoadEntry(entry);
 777 }
 778
 779 bool NavigationControllerImpl::RendererDidNavigate(
 780     RenderFrameHostImpl* rfh,
 781     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
 782     LoadCommittedDetails* details) {
 783   is_initial_navigation_ = false;
 784
 785   // Save the previous state before we clobber it.
 786   if (GetLastCommittedEntry()) {
 787     details->previous_url = GetLastCommittedEntry()->GetURL();
 788     details->previous_entry_index = GetLastCommittedEntryIndex();
 789   } else {
 790     details->previous_url = GURL();
 791     details->previous_entry_index = -1;
 792   }
 793
 794   // If we have a pending entry at this point, it should have a SiteInstance.
 795   // Restored entries start out with a null SiteInstance, but we should have
 796   // assigned one in NavigateToPendingEntry.
 797   DCHECK(pending_entry_index_ == -1 || pending_entry_->site_instance());
 798
 799   // If we are doing a cross-site reload, we need to replace the existing
 800   // navigation entry, not add another entry to the history. This has the side
 801   // effect of removing forward browsing history, if such existed. Or if we are
 802   // doing a cross-site redirect navigation, we will do a similar thing.
 803   //
 804   // If this is an error load, we may have already removed the pending entry
 805   // when we got the notice of the load failure. If so, look at the copy of the
 806   // pending parameters that were saved.
 807   if (params.url_is_unreachable && failed_pending_entry_id_ != 0) {
 808     details->did_replace_entry = failed_pending_entry_should_replace_;
 809   } else {
 810     details->did_replace_entry = pending_entry_ &&
 811                                  pending_entry_->should_replace_entry();
 812   }
 813
 814   // Do navigation-type specific actions. These will make and commit an entry.
 815   details->type = ClassifyNavigation(rfh, params);
 816
 817   // is_in_page must be computed before the entry gets committed.
 818   details->is_in_page = AreURLsInPageNavigation(rfh->GetLastCommittedURL(),
 819       params.url, params.was_within_same_page, rfh);
 820
 821   switch (details->type) {
 822     case NAVIGATION_TYPE_NEW_PAGE:
 823       RendererDidNavigateToNewPage(rfh, params, details->did_replace_entry);
 824       break;
 825     case NAVIGATION_TYPE_EXISTING_PAGE:
 826       RendererDidNavigateToExistingPage(rfh, params);
 827       break;
 828     case NAVIGATION_TYPE_SAME_PAGE:
 829       RendererDidNavigateToSamePage(rfh, params);
 830       break;
 831     case NAVIGATION_TYPE_IN_PAGE:
 832       RendererDidNavigateInPage(rfh, params, &details->did_replace_entry);
 833       break;
 834     case NAVIGATION_TYPE_NEW_SUBFRAME:
 835       RendererDidNavigateNewSubframe(rfh, params);
 836       break;
 837     case NAVIGATION_TYPE_AUTO_SUBFRAME:
 838       if (!RendererDidNavigateAutoSubframe(rfh, params))
 839         return false;
 840       break;
 841     case NAVIGATION_TYPE_NAV_IGNORE:
 842       // If a pending navigation was in progress, this canceled it.  We should
 843       // discard it and make sure it is removed from the URL bar.  After that,
 844       // there is nothing we can do with this navigation, so we just return to
 845       // the caller that nothing has happened.
 846       if (pending_entry_) {
 847         DiscardNonCommittedEntries();
 848         delegate_->NotifyNavigationStateChanged(INVALIDATE_TYPE_URL);
 849       }
 850       return false;
 851     default:
 852       NOTREACHED();
 853   }
 854
 855   // At this point, we know that the navigation has just completed, so
 856   // record the time.
 857   //
 858   // TODO(akalin): Use "sane time" as described in
 859   // http://www.chromium.org/developers/design-documents/sane-time .
 860   base::Time timestamp =
 861       time_smoother_.GetSmoothedTime(get_timestamp_callback_.Run());
 862   DVLOG(1) << "Navigation finished at (smoothed) timestamp "
 863            << timestamp.ToInternalValue();
 864
 865   // We should not have a pending entry anymore.  Clear it again in case any
 866   // error cases above forgot to do so.
 867   DiscardNonCommittedEntriesInternal();
 868
 869   // All committed entries should have nonempty content state so WebKit doesn't
 870   // get confused when we go back to them (see the function for details).
 871   DCHECK(params.page_state.IsValid());
 872   NavigationEntryImpl* active_entry = GetLastCommittedEntry();
 873   active_entry->SetTimestamp(timestamp);
 874   active_entry->SetHttpStatusCode(params.http_status_code);
 875   active_entry->SetPageState(params.page_state);
 876   active_entry->SetRedirectChain(params.redirects);
 877
 878   // Use histogram to track memory impact of redirect chain because it's now
 879   // not cleared for committed entries.
 880   size_t redirect_chain_size = 0;
 881   for (size_t i = 0; i < params.redirects.size(); ++i) {
 882     redirect_chain_size += params.redirects[i].spec().length();
 883   }
 884   UMA_HISTOGRAM_COUNTS("Navigation.RedirectChainSize", redirect_chain_size);
 885
 886   // Once it is committed, we no longer need to track several pieces of state on
 887   // the entry.
 888   active_entry->ResetForCommit();
 889
 890   // The active entry's SiteInstance should match our SiteInstance.
 891   // TODO(creis): This check won't pass for subframes until we create entries
 892   // for subframe navigations.
 893   if (ui::PageTransitionIsMainFrame(params.transition))
 894     CHECK(active_entry->site_instance() == rfh->GetSiteInstance());
 895
 896   // Remember the bindings the renderer process has at this point, so that
 897   // we do not grant this entry additional bindings if we come back to it.
 898   active_entry->SetBindings(rfh->GetEnabledBindings());
 899
 900   // Now prep the rest of the details for the notification and broadcast.
 901   details->entry = active_entry;
 902   details->is_main_frame =
 903       ui::PageTransitionIsMainFrame(params.transition);
 904   details->serialized_security_info = params.security_info;
 905   details->http_status_code = params.http_status_code;
 906   NotifyNavigationEntryCommitted(details);
 907
 908   return true;
 909 }
 910
 911 NavigationType NavigationControllerImpl::ClassifyNavigation(
 912     RenderFrameHostImpl* rfh,
 913     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) const {
 914   if (params.page_id == -1) {
 915     // TODO(nasko, creis):  An out-of-process child frame has no way of
 916     // knowing the page_id of its parent, so it is passing back -1. The
 917     // semantics here should be re-evaluated during session history refactor
 918     // (see http://crbug.com/236848). For now, we assume this means the
 919     // child frame loaded and proceed. Note that this may do the wrong thing
 920     // for cross-process AUTO_SUBFRAME navigations.
 921     if (rfh->IsCrossProcessSubframe())
 922       return NAVIGATION_TYPE_NEW_SUBFRAME;
 923
 924     // The renderer generates the page IDs, and so if it gives us the invalid
 925     // page ID (-1) we know it didn't actually navigate. This happens in a few
 926     // cases:
 927     //
 928     // - If a page makes a popup navigated to about blank, and then writes
 929     //   stuff like a subframe navigated to a real page. We'll get the commit
 930     //   for the subframe, but there won't be any commit for the outer page.
 931     //
 932     // - We were also getting these for failed loads (for example, bug 21849).
 933     //   The guess is that we get a "load commit" for the alternate error page,
 934     //   but that doesn't affect the page ID, so we get the "old" one, which
 935     //   could be invalid. This can also happen for a cross-site transition
 936     //   that causes us to swap processes. Then the error page load will be in
 937     //   a new process with no page IDs ever assigned (and hence a -1 value),
 938     //   yet the navigation controller still might have previous pages in its
 939     //   list.
 940     //
 941     // In these cases, there's nothing we can do with them, so ignore.
 942     return NAVIGATION_TYPE_NAV_IGNORE;
 943   }
 944
 945   if (params.page_id > delegate_->GetMaxPageIDForSiteInstance(
 946           rfh->GetSiteInstance())) {
 947     // Greater page IDs than we've ever seen before are new pages. We may or may
 948     // not have a pending entry for the page, and this may or may not be the
 949     // main frame.
 950     if (ui::PageTransitionIsMainFrame(params.transition))
 951       return NAVIGATION_TYPE_NEW_PAGE;
 952
 953     // When this is a new subframe navigation, we should have a committed page
 954     // for which it's a suframe in. This may not be the case when an iframe is
 955     // navigated on a popup navigated to about:blank (the iframe would be
 956     // written into the popup by script on the main page). For these cases,
 957     // there isn't any navigation stuff we can do, so just ignore it.
 958     if (!GetLastCommittedEntry())
 959       return NAVIGATION_TYPE_NAV_IGNORE;
 960
 961     // Valid subframe navigation.
 962     return NAVIGATION_TYPE_NEW_SUBFRAME;
 963   }
 964
 965   // We only clear the session history when navigating to a new page.
 966   DCHECK(!params.history_list_was_cleared);
 967
 968   // Now we know that the notification is for an existing page. Find that entry.
 969   int existing_entry_index = GetEntryIndexWithPageID(
 970       rfh->GetSiteInstance(),
 971       params.page_id);
 972   if (existing_entry_index == -1) {
 973     // The page was not found. It could have been pruned because of the limit on
 974     // back/forward entries (not likely since we'll usually tell it to navigate
 975     // to such entries). It could also mean that the renderer is smoking crack.
 976     NOTREACHED();
 977
 978     // Because the unknown entry has committed, we risk showing the wrong URL in
 979     // release builds. Instead, we'll kill the renderer process to be safe.
 980     LOG(ERROR) << "terminating renderer for bad navigation: " << params.url;
 981     RecordAction(base::UserMetricsAction("BadMessageTerminate_NC"));
 982
 983     // Temporary code so we can get more information.  Format:
 984     //  http://url/foo.html#page1#max3#frame1#ids:2_Nx,1_1x,3_2
 985     std::string temp = params.url.spec();
 986     temp.append("#page");
 987     temp.append(base::IntToString(params.page_id));
 988     temp.append("#max");
 989     temp.append(base::IntToString(delegate_->GetMaxPageID()));
 990     temp.append("#frame");
 991     temp.append(base::IntToString(rfh->GetRoutingID()));
 992     temp.append("#ids");
 993     for (int i = 0; i < static_cast<int>(entries_.size()); ++i) {
 994       // Append entry metadata (e.g., 3_7x):
 995       //  3: page_id
 996       //  7: SiteInstance ID, or N for null
 997       //  x: appended if not from the current SiteInstance
 998       temp.append(base::IntToString(entries_[i]->GetPageID()));
 999       temp.append("_");
1000       if (entries_[i]->site_instance())
1001         temp.append(base::IntToString(entries_[i]->site_instance()->GetId()));
1002       else
1003         temp.append("N");
1004       if (entries_[i]->site_instance() != rfh->GetSiteInstance())
1005         temp.append("x");
1006       temp.append(",");
1007     }
1008     GURL url(temp);
1009     rfh->render_view_host()->Send(new ViewMsg_TempCrashWithData(url));
1010     return NAVIGATION_TYPE_NAV_IGNORE;
1011   }
1012   NavigationEntryImpl* existing_entry = entries_[existing_entry_index].get();
1013
1014   if (!ui::PageTransitionIsMainFrame(params.transition)) {
1015     // All manual subframes would get new IDs and were handled above, so we
1016     // know this is auto. Since the current page was found in the navigation
1017     // entry list, we're guaranteed to have a last committed entry.
1018     DCHECK(GetLastCommittedEntry());
1019     return NAVIGATION_TYPE_AUTO_SUBFRAME;
1020   }
1021
1022   // Anything below here we know is a main frame navigation.
1023   if (pending_entry_ &&
1024       !pending_entry_->is_renderer_initiated() &&
1025       existing_entry != pending_entry_ &&
1026       pending_entry_->GetPageID() == -1 &&
1027       existing_entry == GetLastCommittedEntry()) {
1028     // In this case, we have a pending entry for a URL but WebCore didn't do a
1029     // new navigation. This happens when you press enter in the URL bar to
1030     // reload. We will create a pending entry, but WebKit will convert it to
1031     // a reload since it's the same page and not create a new entry for it
1032     // (the user doesn't want to have a new back/forward entry when they do
1033     // this). If this matches the last committed entry, we want to just ignore
1034     // the pending entry and go back to where we were (the "existing entry").
1035     return NAVIGATION_TYPE_SAME_PAGE;
1036   }
1037
1038   // Any toplevel navigations with the same base (minus the reference fragment)
1039   // are in-page navigations. We weeded out subframe navigations above. Most of
1040   // the time this doesn't matter since WebKit doesn't tell us about subframe
1041   // navigations that don't actually navigate, but it can happen when there is
1042   // an encoding override (it always sends a navigation request).
1043   if (AreURLsInPageNavigation(existing_entry->GetURL(), params.url,
1044                               params.was_within_same_page, rfh)) {
1045     return NAVIGATION_TYPE_IN_PAGE;
1046   }
1047
1048   // Since we weeded out "new" navigations above, we know this is an existing
1049   // (back/forward) navigation.
1050   return NAVIGATION_TYPE_EXISTING_PAGE;
1051 }
1052
1053 void NavigationControllerImpl::RendererDidNavigateToNewPage(
1054     RenderFrameHostImpl* rfh,
1055     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
1056     bool replace_entry) {
1057   NavigationEntryImpl* new_entry;
1058   bool update_virtual_url;
1059   // Only make a copy of the pending entry if it is appropriate for the new page
1060   // that was just loaded.  We verify this at a coarse grain by checking that
1061   // the SiteInstance hasn't been assigned to something else.
1062   if (pending_entry_ &&
1063       (!pending_entry_->site_instance() ||
1064        pending_entry_->site_instance() == rfh->GetSiteInstance())) {
1065     new_entry = pending_entry_->Clone();
1066
1067     update_virtual_url = new_entry->update_virtual_url_with_url();
1068   } else {
1069     new_entry = new NavigationEntryImpl;
1070
1071     // Find out whether the new entry needs to update its virtual URL on URL
1072     // change and set up the entry accordingly. This is needed to correctly
1073     // update the virtual URL when replaceState is called after a pushState.
1074     GURL url = params.url;
1075     bool needs_update = false;
1076     BrowserURLHandlerImpl::GetInstance()->RewriteURLIfNecessary(
1077         &url, browser_context_, &needs_update);
1078     new_entry->set_update_virtual_url_with_url(needs_update);
1079
1080     // When navigating to a new page, give the browser URL handler a chance to
1081     // update the virtual URL based on the new URL. For example, this is needed
1082     // to show chrome://bookmarks/#1 when the bookmarks webui extension changes
1083     // the URL.
1084     update_virtual_url = needs_update;
1085   }
1086
1087   // Don't use the page type from the pending entry. Some interstitial page
1088   // may have set the type to interstitial. Once we commit, however, the page
1089   // type must always be normal or error.
1090   new_entry->set_page_type(params.url_is_unreachable ? PAGE_TYPE_ERROR
1091                                                      : PAGE_TYPE_NORMAL);
1092   new_entry->SetURL(params.url);
1093   if (update_virtual_url)
1094     UpdateVirtualURLToURL(new_entry, params.url);
1095   new_entry->SetReferrer(params.referrer);
1096   new_entry->SetPageID(params.page_id);
1097   new_entry->SetTransitionType(params.transition);
1098   new_entry->set_site_instance(
1099       static_cast<SiteInstanceImpl*>(rfh->GetSiteInstance()));
1100   new_entry->SetHasPostData(params.is_post);
1101   new_entry->SetPostID(params.post_id);
1102   new_entry->SetOriginalRequestURL(params.original_request_url);
1103   new_entry->SetIsOverridingUserAgent(params.is_overriding_user_agent);
1104
1105   // history.pushState() is classified as a navigation to a new page, but
1106   // sets was_within_same_page to true. In this case, we already have the
1107   // title and favicon available, so set them immediately.
1108   if (params.was_within_same_page && GetLastCommittedEntry()) {
1109     new_entry->SetTitle(GetLastCommittedEntry()->GetTitle());
1110     new_entry->GetFavicon() = GetLastCommittedEntry()->GetFavicon();
1111   }
1112
1113   DCHECK(!params.history_list_was_cleared || !replace_entry);
1114   // The browser requested to clear the session history when it initiated the
1115   // navigation. Now we know that the renderer has updated its state accordingly
1116   // and it is safe to also clear the browser side history.
1117   if (params.history_list_was_cleared) {
1118     DiscardNonCommittedEntriesInternal();
1119     entries_.clear();
1120     last_committed_entry_index_ = -1;
1121   }
1122
1123   InsertOrReplaceEntry(new_entry, replace_entry);
1124 }
1125
1126 void NavigationControllerImpl::RendererDidNavigateToExistingPage(
1127     RenderFrameHostImpl* rfh,
1128     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
1129   // We should only get here for main frame navigations.
1130   DCHECK(ui::PageTransitionIsMainFrame(params.transition));
1131
1132   // This is a back/forward navigation. The existing page for the ID is
1133   // guaranteed to exist by ClassifyNavigation, and we just need to update it
1134   // with new information from the renderer.
1135   int entry_index = GetEntryIndexWithPageID(rfh->GetSiteInstance(),
1136                                             params.page_id);
1137   DCHECK(entry_index >= 0 &&
1138          entry_index < static_cast<int>(entries_.size()));
1139   NavigationEntryImpl* entry = entries_[entry_index].get();
1140
1141   // The URL may have changed due to redirects.
1142   entry->set_page_type(params.url_is_unreachable ? PAGE_TYPE_ERROR
1143                                                  : PAGE_TYPE_NORMAL);
1144   entry->SetURL(params.url);
1145   entry->SetReferrer(params.referrer);
1146   if (entry->update_virtual_url_with_url())
1147     UpdateVirtualURLToURL(entry, params.url);
1148
1149   // The redirected to page should not inherit the favicon from the previous
1150   // page.
1151   if (ui::PageTransitionIsRedirect(params.transition))
1152     entry->GetFavicon() = FaviconStatus();
1153
1154   // The site instance will normally be the same except during session restore,
1155   // when no site instance will be assigned.
1156   DCHECK(entry->site_instance() == NULL ||
1157          entry->site_instance() == rfh->GetSiteInstance());
1158   entry->set_site_instance(
1159       static_cast<SiteInstanceImpl*>(rfh->GetSiteInstance()));
1160
1161   entry->SetHasPostData(params.is_post);
1162   entry->SetPostID(params.post_id);
1163
1164   // The entry we found in the list might be pending if the user hit
1165   // back/forward/reload. This load should commit it (since it's already in the
1166   // list, we can just discard the pending pointer).  We should also discard the
1167   // pending entry if it corresponds to a different navigation, since that one
1168   // is now likely canceled.  If it is not canceled, we will treat it as a new
1169   // navigation when it arrives, which is also ok.
1170   //
1171   // Note that we need to use the "internal" version since we don't want to
1172   // actually change any other state, just kill the pointer.
1173   DiscardNonCommittedEntriesInternal();
1174
1175   // If a transient entry was removed, the indices might have changed, so we
1176   // have to query the entry index again.
1177   last_committed_entry_index_ =
1178       GetEntryIndexWithPageID(rfh->GetSiteInstance(), params.page_id);
1179 }
1180
1181 void NavigationControllerImpl::RendererDidNavigateToSamePage(
1182     RenderFrameHostImpl* rfh,
1183     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
1184   // This mode implies we have a pending entry that's the same as an existing
1185   // entry for this page ID. This entry is guaranteed to exist by
1186   // ClassifyNavigation. All we need to do is update the existing entry.
1187   NavigationEntryImpl* existing_entry = GetEntryWithPageID(
1188       rfh->GetSiteInstance(), params.page_id);
1189
1190   // We assign the entry's unique ID to be that of the new one. Since this is
1191   // always the result of a user action, we want to dismiss infobars, etc. like
1192   // a regular user-initiated navigation.
1193   existing_entry->set_unique_id(pending_entry_->GetUniqueID());
1194
1195   // The URL may have changed due to redirects.
1196   existing_entry->set_page_type(params.url_is_unreachable ? PAGE_TYPE_ERROR
1197                                                           : PAGE_TYPE_NORMAL);
1198   if (existing_entry->update_virtual_url_with_url())
1199     UpdateVirtualURLToURL(existing_entry, params.url);
1200   existing_entry->SetURL(params.url);
1201   existing_entry->SetReferrer(params.referrer);
1202
1203   // The page may have been requested with a different HTTP method.
1204   existing_entry->SetHasPostData(params.is_post);
1205   existing_entry->SetPostID(params.post_id);
1206
1207   DiscardNonCommittedEntries();
1208 }
1209
1210 void NavigationControllerImpl::RendererDidNavigateInPage(
1211     RenderFrameHostImpl* rfh,
1212     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
1213     bool* did_replace_entry) {
1214   DCHECK(ui::PageTransitionIsMainFrame(params.transition)) <<
1215       "WebKit should only tell us about in-page navs for the main frame.";
1216   // We're guaranteed to have an entry for this one.
1217   NavigationEntryImpl* existing_entry = GetEntryWithPageID(
1218       rfh->GetSiteInstance(), params.page_id);
1219
1220   // Reference fragment navigation. We're guaranteed to have the last_committed
1221   // entry and it will be the same page as the new navigation (minus the
1222   // reference fragments, of course).  We'll update the URL of the existing
1223   // entry without pruning the forward history.
1224   existing_entry->set_page_type(params.url_is_unreachable ? PAGE_TYPE_ERROR
1225                                                           : PAGE_TYPE_NORMAL);
1226   existing_entry->SetURL(params.url);
1227   if (existing_entry->update_virtual_url_with_url())
1228     UpdateVirtualURLToURL(existing_entry, params.url);
1229
1230   existing_entry->SetHasPostData(params.is_post);
1231   existing_entry->SetPostID(params.post_id);
1232
1233   // This replaces the existing entry since the page ID didn't change.
1234   *did_replace_entry = true;
1235
1236   DiscardNonCommittedEntriesInternal();
1237
1238   // If a transient entry was removed, the indices might have changed, so we
1239   // have to query the entry index again.
1240   last_committed_entry_index_ =
1241       GetEntryIndexWithPageID(rfh->GetSiteInstance(), params.page_id);
1242 }
1243
1244 void NavigationControllerImpl::RendererDidNavigateNewSubframe(
1245     RenderFrameHostImpl* rfh,
1246     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
1247   if (!ui::PageTransitionCoreTypeIs(params.transition,
1248                                     ui::PAGE_TRANSITION_MANUAL_SUBFRAME)) {
1249     // There was a comment here that said, "This is not user-initiated. Ignore."
1250     // But this makes no sense; non-user-initiated navigations should be
1251     // determined to be of type NAVIGATION_TYPE_AUTO_SUBFRAME and sent to
1252     // RendererDidNavigateAutoSubframe below.
1253     //
1254     // This if clause dates back to https://codereview.chromium.org/115919 and
1255     // the handling of immediate redirects. TODO(avi): Is this still valid? I'm
1256     // pretty sure that's there's nothing left of that code and that we should
1257     // take this out.
1258     //
1259     // Except for cross-process iframes; this doesn't work yet for them.
1260     if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
1261           switches::kSitePerProcess)) {
1262       NOTREACHED();
1263     }
1264
1265     DiscardNonCommittedEntriesInternal();
1266     return;
1267   }
1268
1269   // Manual subframe navigations just get the current entry cloned so the user
1270   // can go back or forward to it. The actual subframe information will be
1271   // stored in the page state for each of those entries. This happens out of
1272   // band with the actual navigations.
1273   DCHECK(GetLastCommittedEntry()) << "ClassifyNavigation should guarantee "
1274                                   << "that a last committed entry exists.";
1275   NavigationEntryImpl* new_entry = GetLastCommittedEntry()->Clone();
1276   new_entry->SetPageID(params.page_id);
1277   InsertOrReplaceEntry(new_entry, false);
1278 }
1279
1280 bool NavigationControllerImpl::RendererDidNavigateAutoSubframe(
1281     RenderFrameHostImpl* rfh,
1282     const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
1283   DCHECK(ui::PageTransitionCoreTypeIs(params.transition,
1284                                       ui::PAGE_TRANSITION_AUTO_SUBFRAME));
1285
1286   // We're guaranteed to have a previously committed entry, and we now need to
1287   // handle navigation inside of a subframe in it without creating a new entry.
1288   DCHECK(GetLastCommittedEntry());
1289
1290   // Handle the case where we're navigating back/forward to a previous subframe
1291   // navigation entry. This is case "2." in NAV_AUTO_SUBFRAME comment in the
1292   // header file. In case "1." this will be a NOP.
1293   int entry_index = GetEntryIndexWithPageID(
1294       rfh->GetSiteInstance(),
1295       params.page_id);
1296   if (entry_index < 0 ||
1297       entry_index >= static_cast<int>(entries_.size())) {
1298     NOTREACHED();
1299     return false;
1300   }
1301
1302   // Update the current navigation entry in case we're going back/forward.
1303   if (entry_index != last_committed_entry_index_) {
1304     last_committed_entry_index_ = entry_index;
1305     DiscardNonCommittedEntriesInternal();
1306     return true;
1307   }
1308
1309   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
1310           switches::kSitePerProcess)) {
1311     // This may be a "new auto" case where we add a new FrameNavigationEntry, or
1312     // it may be a "history auto" case where we update an existing one.
1313     int64 frame_tree_node_id = rfh->frame_tree_node()->frame_tree_node_id();
1314     NavigationEntryImpl* last_committed = GetLastCommittedEntry();
1315     last_committed->AddOrUpdateFrameEntry(frame_tree_node_id,
1316                                           rfh->GetSiteInstance(),
1317                                           params.url,
1318                                           params.referrer);
1319   }
1320
1321   // We do not need to discard the pending entry in this case, since we will
1322   // not generate commit notifications for this auto-subframe navigation.
1323   return false;
1324 }
1325
1326 int NavigationControllerImpl::GetIndexOfEntry(
1327     const NavigationEntryImpl* entry) const {
1328   const NavigationEntries::const_iterator i(std::find(
1329       entries_.begin(),
1330       entries_.end(),
1331       entry));
1332   return (i == entries_.end()) ? -1 : static_cast<int>(i - entries_.begin());
1333 }
1334
1335 bool NavigationControllerImpl::IsURLInPageNavigation(
1336     const GURL& url,
1337     bool renderer_says_in_page,
1338     RenderFrameHost* rfh) const {
1339   NavigationEntry* last_committed = GetLastCommittedEntry();
1340   return last_committed && AreURLsInPageNavigation(
1341       last_committed->GetURL(), url, renderer_says_in_page, rfh);
1342 }
1343
1344 void NavigationControllerImpl::CopyStateFrom(
1345     const NavigationController& temp) {
1346   const NavigationControllerImpl& source =
1347       static_cast<const NavigationControllerImpl&>(temp);
1348   // Verify that we look new.
1349   DCHECK(GetEntryCount() == 0 && !GetPendingEntry());
1350
1351   if (source.GetEntryCount() == 0)
1352     return;  // Nothing new to do.
1353
1354   needs_reload_ = true;
1355   InsertEntriesFrom(source, source.GetEntryCount());
1356
1357   for (SessionStorageNamespaceMap::const_iterator it =
1358            source.session_storage_namespace_map_.begin();
1359        it != source.session_storage_namespace_map_.end();
1360        ++it) {
1361     SessionStorageNamespaceImpl* source_namespace =
1362         static_cast<SessionStorageNamespaceImpl*>(it->second.get());
1363     session_storage_namespace_map_[it->first] = source_namespace->Clone();
1364   }
1365
1366   FinishRestore(source.last_committed_entry_index_, RESTORE_CURRENT_SESSION);
1367
1368   // Copy the max page id map from the old tab to the new tab.  This ensures
1369   // that new and existing navigations in the tab's current SiteInstances
1370   // are identified properly.
1371   delegate_->CopyMaxPageIDsFrom(source.delegate()->GetWebContents());
1372 }
1373
1374 void NavigationControllerImpl::CopyStateFromAndPrune(
1375     NavigationController* temp,
1376     bool replace_entry) {
1377   // It is up to callers to check the invariants before calling this.
1378   CHECK(CanPruneAllButLastCommitted());
1379
1380   NavigationControllerImpl* source =
1381       static_cast<NavigationControllerImpl*>(temp);
1382
1383   // Remove all the entries leaving the last committed entry.
1384   PruneAllButLastCommittedInternal();
1385
1386   // We now have one entry, possibly with a new pending entry.  Ensure that
1387   // adding the entries from source won't put us over the limit.
1388   DCHECK_EQ(1, GetEntryCount());
1389   if (!replace_entry)
1390     source->PruneOldestEntryIfFull();
1391
1392   // Insert the entries from source. Don't use source->GetCurrentEntryIndex as
1393   // we don't want to copy over the transient entry. Ignore any pending entry,
1394   // since it has not committed in source.
1395   int max_source_index = source->last_committed_entry_index_;
1396   if (max_source_index == -1)
1397     max_source_index = source->GetEntryCount();
1398   else
1399     max_source_index++;
1400
1401   // Ignore the source's current entry if merging with replacement.
1402   // TODO(davidben): This should preserve entries forward of the current
1403   // too. http://crbug.com/317872
1404   if (replace_entry && max_source_index > 0)
1405     max_source_index--;
1406
1407   InsertEntriesFrom(*source, max_source_index);
1408
1409   // Adjust indices such that the last entry and pending are at the end now.
1410   last_committed_entry_index_ = GetEntryCount() - 1;
1411
1412   delegate_->SetHistoryOffsetAndLength(last_committed_entry_index_,
1413                                        GetEntryCount());
1414
1415   // Copy the max page id map from the old tab to the new tab. This ensures that
1416   // new and existing navigations in the tab's current SiteInstances are
1417   // identified properly.
1418   NavigationEntryImpl* last_committed = GetLastCommittedEntry();
1419   int32 site_max_page_id =
1420       delegate_->GetMaxPageIDForSiteInstance(last_committed->site_instance());
1421   delegate_->CopyMaxPageIDsFrom(source->delegate()->GetWebContents());
1422   delegate_->UpdateMaxPageIDForSiteInstance(last_committed->site_instance(),
1423                                             site_max_page_id);
1424   max_restored_page_id_ = source->max_restored_page_id_;
1425 }
1426
1427 bool NavigationControllerImpl::CanPruneAllButLastCommitted() {
1428   // If there is no last committed entry, we cannot prune.  Even if there is a
1429   // pending entry, it may not commit, leaving this WebContents blank, despite
1430   // possibly giving it new entries via CopyStateFromAndPrune.
1431   if (last_committed_entry_index_ == -1)
1432     return false;
1433
1434   // We cannot prune if there is a pending entry at an existing entry index.
1435   // It may not commit, so we have to keep the last committed entry, and thus
1436   // there is no sensible place to keep the pending entry.  It is ok to have
1437   // a new pending entry, which can optionally commit as a new navigation.
1438   if (pending_entry_index_ != -1)
1439     return false;
1440
1441   // We should not prune if we are currently showing a transient entry.
1442   if (transient_entry_index_ != -1)
1443     return false;
1444
1445   return true;
1446 }
1447
1448 void NavigationControllerImpl::PruneAllButLastCommitted() {
1449   PruneAllButLastCommittedInternal();
1450
1451   DCHECK_EQ(0, last_committed_entry_index_);
1452   DCHECK_EQ(1, GetEntryCount());
1453
1454   delegate_->SetHistoryOffsetAndLength(last_committed_entry_index_,
1455                                        GetEntryCount());
1456 }
1457
1458 void NavigationControllerImpl::PruneAllButLastCommittedInternal() {
1459   // It is up to callers to check the invariants before calling this.
1460   CHECK(CanPruneAllButLastCommitted());
1461
1462   // Erase all entries but the last committed entry.  There may still be a
1463   // new pending entry after this.
1464   entries_.erase(entries_.begin(),
1465                  entries_.begin() + last_committed_entry_index_);
1466   entries_.erase(entries_.begin() + 1, entries_.end());
1467   last_committed_entry_index_ = 0;
1468 }
1469
1470 void NavigationControllerImpl::ClearAllScreenshots() {
1471   screenshot_manager_->ClearAllScreenshots();
1472 }
1473
1474 void NavigationControllerImpl::SetSessionStorageNamespace(
1475     const std::string& partition_id,
1476     SessionStorageNamespace* session_storage_namespace) {
1477   if (!session_storage_namespace)
1478     return;
1479
1480   // We can't overwrite an existing SessionStorage without violating spec.
1481   // Attempts to do so may give a tab access to another tab's session storage
1482   // so die hard on an error.
1483   bool successful_insert = session_storage_namespace_map_.insert(
1484       make_pair(partition_id,
1485                 static_cast<SessionStorageNamespaceImpl*>(
1486                     session_storage_namespace)))
1487           .second;
1488   CHECK(successful_insert) << "Cannot replace existing SessionStorageNamespace";
1489 }
1490
1491 void NavigationControllerImpl::SetMaxRestoredPageID(int32 max_id) {
1492   max_restored_page_id_ = max_id;
1493 }
1494
1495 int32 NavigationControllerImpl::GetMaxRestoredPageID() const {
1496   return max_restored_page_id_;
1497 }
1498
1499 bool NavigationControllerImpl::IsUnmodifiedBlankTab() const {
1500   return IsInitialNavigation() &&
1501          !GetLastCommittedEntry() &&
1502          !delegate_->HasAccessedInitialDocument();
1503 }
1504
1505 SessionStorageNamespace*
1506 NavigationControllerImpl::GetSessionStorageNamespace(SiteInstance* instance) {
1507   std::string partition_id;
1508   if (instance) {
1509     // TODO(ajwong): When GetDefaultSessionStorageNamespace() goes away, remove
1510     // this if statement so |instance| must not be NULL.
1511     partition_id =
1512         GetContentClient()->browser()->GetStoragePartitionIdForSite(
1513             browser_context_, instance->GetSiteURL());
1514   }
1515
1516   SessionStorageNamespaceMap::const_iterator it =
1517       session_storage_namespace_map_.find(partition_id);
1518   if (it != session_storage_namespace_map_.end())
1519     return it->second.get();
1520
1521   // Create one if no one has accessed session storage for this partition yet.
1522   //
1523   // TODO(ajwong): Should this use the |partition_id| directly rather than
1524   // re-lookup via |instance|?  http://crbug.com/142685
1525   StoragePartition* partition =
1526               BrowserContext::GetStoragePartition(browser_context_, instance);
1527   SessionStorageNamespaceImpl* session_storage_namespace =
1528       new SessionStorageNamespaceImpl(
1529           static_cast<DOMStorageContextWrapper*>(
1530               partition->GetDOMStorageContext()));
1531   session_storage_namespace_map_[partition_id] = session_storage_namespace;
1532
1533   return session_storage_namespace;
1534 }
1535
1536 SessionStorageNamespace*
1537 NavigationControllerImpl::GetDefaultSessionStorageNamespace() {
1538   // TODO(ajwong): Remove if statement in GetSessionStorageNamespace().
1539   return GetSessionStorageNamespace(NULL);
1540 }
1541
1542 const SessionStorageNamespaceMap&
1543 NavigationControllerImpl::GetSessionStorageNamespaceMap() const {
1544   return session_storage_namespace_map_;
1545 }
1546
1547 bool NavigationControllerImpl::NeedsReload() const {
1548   return needs_reload_;
1549 }
1550
1551 void NavigationControllerImpl::SetNeedsReload() {
1552   needs_reload_ = true;
1553
1554   if (last_committed_entry_index_ != -1) {
1555     entries_[last_committed_entry_index_]->SetTransitionType(
1556         ui::PAGE_TRANSITION_RELOAD);
1557   }
1558 }
1559
1560 void NavigationControllerImpl::RemoveEntryAtIndexInternal(int index) {
1561   DCHECK(index < GetEntryCount());
1562   DCHECK(index != last_committed_entry_index_);
1563
1564   DiscardNonCommittedEntries();
1565
1566   entries_.erase(entries_.begin() + index);
1567   if (last_committed_entry_index_ > index)
1568     last_committed_entry_index_--;
1569 }
1570
1571 void NavigationControllerImpl::DiscardNonCommittedEntries() {
1572   bool transient = transient_entry_index_ != -1;
1573   DiscardNonCommittedEntriesInternal();
1574
1575   // If there was a transient entry, invalidate everything so the new active
1576   // entry state is shown.
1577   if (transient) {
1578     delegate_->NotifyNavigationStateChanged(INVALIDATE_TYPE_ALL);
1579   }
1580 }
1581
1582 NavigationEntryImpl* NavigationControllerImpl::GetPendingEntry() const {
1583   return pending_entry_;
1584 }
1585
1586 int NavigationControllerImpl::GetPendingEntryIndex() const {
1587   return pending_entry_index_;
1588 }
1589
1590 void NavigationControllerImpl::InsertOrReplaceEntry(NavigationEntryImpl* entry,
1591                                                     bool replace) {
1592   DCHECK(entry->GetTransitionType() != ui::PAGE_TRANSITION_AUTO_SUBFRAME);
1593
1594   // Copy the pending entry's unique ID to the committed entry.
1595   // I don't know if pending_entry_index_ can be other than -1 here.
1596   const NavigationEntryImpl* const pending_entry =
1597       (pending_entry_index_ == -1) ?
1598           pending_entry_ : entries_[pending_entry_index_].get();
1599   if (pending_entry)
1600     entry->set_unique_id(pending_entry->GetUniqueID());
1601
1602   DiscardNonCommittedEntriesInternal();
1603
1604   int current_size = static_cast<int>(entries_.size());
1605   DCHECK_IMPLIES(replace, current_size > 0);
1606
1607   if (current_size > 0) {
1608     // Prune any entries which are in front of the current entry.
1609     // Also prune the current entry if we are to replace the current entry.
1610     // last_committed_entry_index_ must be updated here since calls to
1611     // NotifyPrunedEntries() below may re-enter and we must make sure
1612     // last_committed_entry_index_ is not left in an invalid state.
1613     if (replace)
1614       --last_committed_entry_index_;
1615
1616     int num_pruned = 0;
1617     while (last_committed_entry_index_ < (current_size - 1)) {
1618       num_pruned++;
1619       entries_.pop_back();
1620       current_size--;
1621     }
1622     if (num_pruned > 0)  // Only notify if we did prune something.
1623       NotifyPrunedEntries(this, false, num_pruned);
1624   }
1625
1626   PruneOldestEntryIfFull();
1627
1628   entries_.push_back(linked_ptr<NavigationEntryImpl>(entry));
1629   last_committed_entry_index_ = static_cast<int>(entries_.size()) - 1;
1630
1631   // This is a new page ID, so we need everybody to know about it.
1632   delegate_->UpdateMaxPageID(entry->GetPageID());
1633 }
1634
1635 void NavigationControllerImpl::PruneOldestEntryIfFull() {
1636   if (entries_.size() >= max_entry_count()) {
1637     DCHECK_EQ(max_entry_count(), entries_.size());
1638     DCHECK_GT(last_committed_entry_index_, 0);
1639     RemoveEntryAtIndex(0);
1640     NotifyPrunedEntries(this, true, 1);
1641   }
1642 }
1643
1644 void NavigationControllerImpl::NavigateToPendingEntry(ReloadType reload_type) {
1645   needs_reload_ = false;
1646
1647   // If we were navigating to a slow-to-commit page, and the user performs
1648   // a session history navigation to the last committed page, RenderViewHost
1649   // will force the throbber to start, but WebKit will essentially ignore the
1650   // navigation, and won't send a message to stop the throbber. To prevent this
1651   // from happening, we drop the navigation here and stop the slow-to-commit
1652   // page from loading (which would normally happen during the navigation).
1653   if (pending_entry_index_ != -1 &&
1654       pending_entry_index_ == last_committed_entry_index_ &&
1655       (entries_[pending_entry_index_]->restore_type() ==
1656           NavigationEntryImpl::RESTORE_NONE) &&
1657       (entries_[pending_entry_index_]->GetTransitionType() &
1658           ui::PAGE_TRANSITION_FORWARD_BACK)) {
1659     delegate_->Stop();
1660
1661     // If an interstitial page is showing, we want to close it to get back
1662     // to what was showing before.
1663     if (delegate_->GetInterstitialPage())
1664       delegate_->GetInterstitialPage()->DontProceed();
1665
1666     DiscardNonCommittedEntries();
1667     return;
1668   }
1669
1670   // If an interstitial page is showing, the previous renderer is blocked and
1671   // cannot make new requests.  Unblock (and disable) it to allow this
1672   // navigation to succeed.  The interstitial will stay visible until the
1673   // resulting DidNavigate.
1674   if (delegate_->GetInterstitialPage()) {
1675     static_cast<InterstitialPageImpl*>(delegate_->GetInterstitialPage())->
1676         CancelForNavigation();
1677   }
1678
1679   // For session history navigations only the pending_entry_index_ is set.
1680   if (!pending_entry_) {
1681     DCHECK_NE(pending_entry_index_, -1);
1682     pending_entry_ = entries_[pending_entry_index_].get();
1683   }
1684
1685   // This call does not support re-entrancy.  See http://crbug.com/347742.
1686   CHECK(!in_navigate_to_pending_entry_);
1687   in_navigate_to_pending_entry_ = true;
1688   bool success = delegate_->NavigateToPendingEntry(reload_type);
1689   in_navigate_to_pending_entry_ = false;
1690
1691   if (!success)
1692     DiscardNonCommittedEntries();
1693
1694   // If the entry is being restored and doesn't have a SiteInstance yet, fill
1695   // it in now that we know. This allows us to find the entry when it commits.
1696   if (pending_entry_ && !pending_entry_->site_instance() &&
1697       pending_entry_->restore_type() != NavigationEntryImpl::RESTORE_NONE) {
1698     pending_entry_->set_site_instance(static_cast<SiteInstanceImpl*>(
1699         delegate_->GetPendingSiteInstance()));
1700     pending_entry_->set_restore_type(NavigationEntryImpl::RESTORE_NONE);
1701   }
1702 }
1703
1704 void NavigationControllerImpl::NotifyNavigationEntryCommitted(
1705     LoadCommittedDetails* details) {
1706   details->entry = GetLastCommittedEntry();
1707
1708   // We need to notify the ssl_manager_ before the web_contents_ so the
1709   // location bar will have up-to-date information about the security style
1710   // when it wants to draw.  See http://crbug.com/11157
1711   ssl_manager_.DidCommitProvisionalLoad(*details);
1712
1713   delegate_->NotifyNavigationStateChanged(INVALIDATE_TYPE_ALL);
1714   delegate_->NotifyNavigationEntryCommitted(*details);
1715
1716   // TODO(avi): Remove. http://crbug.com/170921
1717   NotificationDetails notification_details =
1718       Details<LoadCommittedDetails>(details);
1719   NotificationService::current()->Notify(
1720       NOTIFICATION_NAV_ENTRY_COMMITTED,
1721       Source<NavigationController>(this),
1722       notification_details);
1723 }
1724
1725 // static
1726 size_t NavigationControllerImpl::max_entry_count() {
1727   if (max_entry_count_for_testing_ != kMaxEntryCountForTestingNotSet)
1728      return max_entry_count_for_testing_;
1729   return kMaxSessionHistoryEntries;
1730 }
1731
1732 void NavigationControllerImpl::SetActive(bool is_active) {
1733   if (is_active && needs_reload_)
1734     LoadIfNecessary();
1735 }
1736
1737 void NavigationControllerImpl::LoadIfNecessary() {
1738   if (!needs_reload_)
1739     return;
1740
1741   // Calling Reload() results in ignoring state, and not loading.
1742   // Explicitly use NavigateToPendingEntry so that the renderer uses the
1743   // cached state.
1744   pending_entry_index_ = last_committed_entry_index_;
1745   NavigateToPendingEntry(NO_RELOAD);
1746 }
1747
1748 void NavigationControllerImpl::NotifyEntryChanged(const NavigationEntry* entry,
1749                                                   int index) {
1750   EntryChangedDetails det;
1751   det.changed_entry = entry;
1752   det.index = index;
1753   NotificationService::current()->Notify(
1754       NOTIFICATION_NAV_ENTRY_CHANGED,
1755       Source<NavigationController>(this),
1756       Details<EntryChangedDetails>(&det));
1757 }
1758
1759 void NavigationControllerImpl::FinishRestore(int selected_index,
1760                                              RestoreType type) {
1761   DCHECK(selected_index >= 0 && selected_index < GetEntryCount());
1762   ConfigureEntriesForRestore(&entries_, type);
1763
1764   SetMaxRestoredPageID(static_cast<int32>(GetEntryCount()));
1765
1766   last_committed_entry_index_ = selected_index;
1767 }
1768
1769 void NavigationControllerImpl::DiscardNonCommittedEntriesInternal() {
1770   DiscardPendingEntry(false);
1771   DiscardTransientEntry();
1772 }
1773
1774 void NavigationControllerImpl::DiscardPendingEntry(bool was_failure) {
1775   // It is not safe to call DiscardPendingEntry while NavigateToEntry is in
1776   // progress, since this will cause a use-after-free.  (We only allow this
1777   // when the tab is being destroyed for shutdown, since it won't return to
1778   // NavigateToEntry in that case.)  http://crbug.com/347742.
1779   CHECK(!in_navigate_to_pending_entry_ || delegate_->IsBeingDestroyed());
1780
1781   if (was_failure && pending_entry_) {
1782     failed_pending_entry_id_ = pending_entry_->GetUniqueID();
1783     failed_pending_entry_should_replace_ =
1784         pending_entry_->should_replace_entry();
1785   } else {
1786     failed_pending_entry_id_ = 0;
1787   }
1788
1789   if (pending_entry_index_ == -1)
1790     delete pending_entry_;
1791   pending_entry_ = NULL;
1792   pending_entry_index_ = -1;
1793 }
1794
1795 void NavigationControllerImpl::DiscardTransientEntry() {
1796   if (transient_entry_index_ == -1)
1797     return;
1798   entries_.erase(entries_.begin() + transient_entry_index_);
1799   if (last_committed_entry_index_ > transient_entry_index_)
1800     last_committed_entry_index_--;
1801   transient_entry_index_ = -1;
1802 }
1803
1804 int NavigationControllerImpl::GetEntryIndexWithPageID(
1805     SiteInstance* instance, int32 page_id) const {
1806   for (int i = static_cast<int>(entries_.size()) - 1; i >= 0; --i) {
1807     if ((entries_[i]->site_instance() == instance) &&
1808         (entries_[i]->GetPageID() == page_id))
1809       return i;
1810   }
1811   return -1;
1812 }
1813
1814 NavigationEntryImpl* NavigationControllerImpl::GetTransientEntry() const {
1815   if (transient_entry_index_ == -1)
1816     return NULL;
1817   return entries_[transient_entry_index_].get();
1818 }
1819
1820 void NavigationControllerImpl::SetTransientEntry(NavigationEntry* entry) {
1821   // Discard any current transient entry, we can only have one at a time.
1822   int index = 0;
1823   if (last_committed_entry_index_ != -1)
1824     index = last_committed_entry_index_ + 1;
1825   DiscardTransientEntry();
1826   entries_.insert(
1827       entries_.begin() + index, linked_ptr<NavigationEntryImpl>(
1828           NavigationEntryImpl::FromNavigationEntry(entry)));
1829   transient_entry_index_ = index;
1830   delegate_->NotifyNavigationStateChanged(INVALIDATE_TYPE_ALL);
1831 }
1832
1833 void NavigationControllerImpl::InsertEntriesFrom(
1834     const NavigationControllerImpl& source,
1835     int max_index) {
1836   DCHECK_LE(max_index, source.GetEntryCount());
1837   size_t insert_index = 0;
1838   for (int i = 0; i < max_index; i++) {
1839     // When cloning a tab, copy all entries except interstitial pages.
1840     if (source.entries_[i].get()->GetPageType() != PAGE_TYPE_INTERSTITIAL) {
1841       // TODO(creis): Once we start sharing FrameNavigationEntries between
1842       // NavigationEntries, it will not be safe to share them with another tab.
1843       // Must have a version of Clone that recreates them.
1844       entries_.insert(entries_.begin() + insert_index++,
1845                       linked_ptr<NavigationEntryImpl>(
1846                           source.entries_[i]->Clone()));
1847     }
1848   }
1849 }
1850
1851 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
1852     const base::Callback<base::Time()>& get_timestamp_callback) {
1853   get_timestamp_callback_ = get_timestamp_callback;
1854 }
1855
1856 }  // namespace content