[ios/web] Disconnect the scroll proxy during slimnav restore.

This is a speculative change to mitigate the crashes in https://crbug.com/959499

Bug: 959499
Change-Id: I37e9d088abf8093cf0a74d410d38a42edac0e5ed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1604522
Commit-Queue: Justin Cohen <justincohen@chromium.org>
Reviewed-by: Kurt Horimoto <kkhorimoto@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Reviewed-by: Danyao Wang <danyao@chromium.org>
Cr-Commit-Position: refs/heads/master@{#659352}

ios/web/common/features.h

@@ -35,6 +35,10 @@ extern const base::Feature kWKHTTPSystemCookieStore;
 // https://crbug.com/841105.
 extern const base::Feature kCrashOnUnexpectedURLChange;
 
+// Used to disconnect the scroll proxy during slimnav restore. This is a
+// speculative change to mitigate the crashes in https://crbug.com/959499.
+extern const base::Feature kDisconnectScrollProxyDuringRestore;
+
 // Used to enable the workaround for WKWebView history clobber bug
 // (crbug.com/887497).
 extern const base::Feature kHistoryClobberWorkaround;

ios/web/common/features.mm

@@ -30,6 +30,9 @@ const base::Feature kWKHTTPSystemCookieStore{"WKHTTPSystemCookieStore",
 const base::Feature kCrashOnUnexpectedURLChange{
     "CrashOnUnexpectedURLChange", base::FEATURE_ENABLED_BY_DEFAULT};
 
+const base::Feature kDisconnectScrollProxyDuringRestore{
+    "DisconnectScrollProxyDuringRestore", base::FEATURE_DISABLED_BY_DEFAULT};
+
 const base::Feature kHistoryClobberWorkaround{
     "WKWebViewHistoryClobberWorkaround", base::FEATURE_ENABLED_BY_DEFAULT};
 

ios/web/web_state/ui/crw_web_controller.mm

@@ -1965,10 +1965,14 @@ typedef void (^ViewportStateCompletion)(const web::PageViewportState*);
 
     // Disable |allowsBackForwardNavigationGestures| during restore. Otherwise,
     // WebKit will trigger a snapshot for each (blank) page, and quickly
-    // overload system memory.
+    // overload system memory.  Also disables the scroll proxy during session
+    // restoration.
     if (web::GetWebClient()->IsSlimNavigationManagerEnabled() &&
         self.navigationManagerImpl->IsRestoreSessionInProgress()) {
       _webView.allowsBackForwardNavigationGestures = NO;
+      if (base::FeatureList::IsEnabled(
+              web::features::kDisconnectScrollProxyDuringRestore))
+        [_containerView disconnectScrollProxy];
     }
 
     WKNavigation* navigation = nil;
@@ -2199,13 +2203,20 @@ typedef void (^ViewportStateCompletion)(const web::PageViewportState*);
   if (self.navigationState == web::WKNavigationState::FINISHED)
     return;
 
-  // Restore allowsBackForwardNavigationGestures once restoration is complete.
+  // Restore allowsBackForwardNavigationGestures and the scroll proxy once
+  // restoration is complete.
   if (web::GetWebClient()->IsSlimNavigationManagerEnabled() &&
       !self.navigationManagerImpl->IsRestoreSessionInProgress()) {
     if (_webView.allowsBackForwardNavigationGestures !=
-        _allowsBackForwardNavigationGestures)
+        _allowsBackForwardNavigationGestures) {
       _webView.allowsBackForwardNavigationGestures =
           _allowsBackForwardNavigationGestures;
+    }
+
+    if (base::FeatureList::IsEnabled(
+            web::features::kDisconnectScrollProxyDuringRestore)) {
+      [_containerView reconnectScrollProxy];
+    }
   }
 
   BOOL success = !context || !context->GetError();
@@ -3802,6 +3813,13 @@ typedef void (^ViewportStateCompletion)(const web::PageViewportState*);
       [[CRWWebViewContentView alloc] initWithWebView:self.webView
                                           scrollView:self.webScrollView];
   [_containerView displayWebViewContentView:webViewContentView];
+
+  if (web::GetWebClient()->IsSlimNavigationManagerEnabled() &&
+      self.navigationManagerImpl->IsRestoreSessionInProgress() &&
+      base::FeatureList::IsEnabled(
+          web::features::kDisconnectScrollProxyDuringRestore)) {
+    [_containerView disconnectScrollProxy];
+  }
 }
 
 - (void)removeWebView {

ios/web/web_state/ui/crw_web_controller_container_view.h

@@ -69,6 +69,11 @@
 // Removes all subviews and resets state to default.
 - (void)resetContent;
 
+// Disconnects and reconnects the scroll proxy to prevent extra calls to
+// WKebView.
+- (void)disconnectScrollProxy;
+- (void)reconnectScrollProxy;
+
 // Replaces the currently displayed content with |webViewContentView|.
 - (void)displayWebViewContentView:(CRWWebViewContentView*)webViewContentView;
 

ios/web/web_state/ui/crw_web_controller_container_view.mm

@@ -211,4 +211,12 @@
   self.contentViewProxy.contentView = self.webViewContentView;
 }
 
+- (void)disconnectScrollProxy {
+  [self.contentViewProxy disconnectScrollProxy];
+}
+
+- (void)reconnectScrollProxy {
+  [self.contentViewProxy reconnectScrollProxy];
+}
+
 @end

ios/web/web_state/ui/crw_web_view_proxy_impl.h

@@ -23,6 +23,11 @@
 // Init with a weak reference of web controller, used for passing through calls.
 - (instancetype)initWithWebController:(CRWWebController*)webController;
 
+// Disconnects and reconnects the scroll proxy to prevent extra calls to
+// WKebView.
+- (void)disconnectScrollProxy;
+- (void)reconnectScrollProxy;
+
 @end
 
 #endif  // IOS_WEB_WEB_STATE_UI_CRW_WEB_VIEW_PROXY_IMPL_H_

ios/web/web_state/ui/crw_web_view_proxy_impl.mm

@@ -170,6 +170,14 @@ UIView* GetFirstResponderSubview(UIView* view) {
   [_contentViewScrollViewProxy setScrollView:contentView.scrollView];
 }
 
+- (void)disconnectScrollProxy {
+  [_contentViewScrollViewProxy setScrollView:nil];
+}
+
+- (void)reconnectScrollProxy {
+  [_contentViewScrollViewProxy setScrollView:self.contentView.scrollView];
+}
+
 - (void)addSubview:(UIView*)view {
   return [_contentView addSubview:view];
 }