NetworkService: Support subresource requests to extension service workers.

This CL makes it so ServiceWorkerSubresourceLoaderFactory uses a
factory created from a ChildURLLoaderFactoryBundle rather than the direct
network factory for "network fallback" after service worker does
not provide a response to a FetchEvent.

The direct network factory didn't work in the case of
chrome-extension:// URLs, since network service does not understand
such URLs.

To create the fallback factory, we use the default
ChildURLLoaderFactoryBundle of the RenderFrameImpl, except remove the
"default factory" from that bundle. The default factory can be something
like the AppCache loader factory, which we don't want to hit when
performing network fallback.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: If6ae1d6fc161cae8ec4574417a0d8954215f878e
Bug: 836129
Reviewed-on: https://chromium-review.googlesource.com/1032354
Commit-Queue: Matt Falkenhagen <falken@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#557465}

content/renderer/loader/child_url_loader_factory_bundle.cc

@@ -186,32 +186,12 @@ void ChildURLLoaderFactoryBundle::CreateLoaderAndStart(
 
 std::unique_ptr<network::SharedURLLoaderFactoryInfo>
 ChildURLLoaderFactoryBundle::Clone() {
-  InitDefaultBlobFactoryIfNecessary();
-  InitDirectNetworkFactoryIfNecessary();
-
-  network::mojom::URLLoaderFactoryPtrInfo default_factory_info;
-  if (default_factory_)
-    default_factory_->Clone(mojo::MakeRequest(&default_factory_info));
-
-  std::map<std::string, network::mojom::URLLoaderFactoryPtrInfo> factories_info;
-  for (auto& factory : factories_) {
-    network::mojom::URLLoaderFactoryPtrInfo factory_info;
-    factory.second->Clone(mojo::MakeRequest(&factory_info));
-    factories_info.emplace(factory.first, std::move(factory_info));
-  }
-
-  network::mojom::URLLoaderFactoryPtrInfo direct_network_factory_info;
-  if (direct_network_factory_) {
-    direct_network_factory_->Clone(
-        mojo::MakeRequest(&direct_network_factory_info));
-  }
-
-  // Currently there is no need to override subresources from workers,
-  // therefore |subresource_overrides| are not shared with the clones.
+  return CloneInternal(true /* include_default */);
+}
 
-  return std::make_unique<ChildURLLoaderFactoryBundleInfo>(
-      std::move(default_factory_info), std::move(factories_info),
-      std::move(direct_network_factory_info));
+std::unique_ptr<network::SharedURLLoaderFactoryInfo>
+ChildURLLoaderFactoryBundle::CloneWithoutDefaultFactory() {
+  return CloneInternal(false /* include_default */);
 }
 
 void ChildURLLoaderFactoryBundle::Update(
@@ -260,6 +240,36 @@ void ChildURLLoaderFactoryBundle::InitDirectNetworkFactoryIfNecessary() {
   }
 }
 
+std::unique_ptr<network::SharedURLLoaderFactoryInfo>
+ChildURLLoaderFactoryBundle::CloneInternal(bool include_default) {
+  InitDefaultBlobFactoryIfNecessary();
+  InitDirectNetworkFactoryIfNecessary();
+
+  network::mojom::URLLoaderFactoryPtrInfo default_factory_info;
+  if (include_default && default_factory_)
+    default_factory_->Clone(mojo::MakeRequest(&default_factory_info));
+
+  std::map<std::string, network::mojom::URLLoaderFactoryPtrInfo> factories_info;
+  for (auto& factory : factories_) {
+    network::mojom::URLLoaderFactoryPtrInfo factory_info;
+    factory.second->Clone(mojo::MakeRequest(&factory_info));
+    factories_info.emplace(factory.first, std::move(factory_info));
+  }
+
+  network::mojom::URLLoaderFactoryPtrInfo direct_network_factory_info;
+  if (direct_network_factory_) {
+    direct_network_factory_->Clone(
+        mojo::MakeRequest(&direct_network_factory_info));
+  }
+
+  // Currently there is no need to override subresources from workers,
+  // therefore |subresource_overrides| are not shared with the clones.
+
+  return std::make_unique<ChildURLLoaderFactoryBundleInfo>(
+      std::move(default_factory_info), std::move(factories_info),
+      std::move(direct_network_factory_info));
+}
+
 std::unique_ptr<ChildURLLoaderFactoryBundleInfo>
 ChildURLLoaderFactoryBundle::PassInterface() {
   InitDefaultBlobFactoryIfNecessary();

content/renderer/loader/child_url_loader_factory_bundle.h

@@ -83,6 +83,11 @@ class CONTENT_EXPORT ChildURLLoaderFactoryBundle
 
   std::unique_ptr<network::SharedURLLoaderFactoryInfo> Clone() override;
 
+  // Returns an info that omits this bundle's default factory, if any. This is
+  // useful to make a clone that bypasses AppCache, for example.
+  std::unique_ptr<network::SharedURLLoaderFactoryInfo>
+  CloneWithoutDefaultFactory();
+
   std::unique_ptr<ChildURLLoaderFactoryBundleInfo> PassInterface();
 
   void Update(std::unique_ptr<ChildURLLoaderFactoryBundleInfo> info,
@@ -97,6 +102,8 @@ class CONTENT_EXPORT ChildURLLoaderFactoryBundle
  private:
   void InitDefaultBlobFactoryIfNecessary();
   void InitDirectNetworkFactoryIfNecessary();
+  std::unique_ptr<network::SharedURLLoaderFactoryInfo> CloneInternal(
+      bool include_default);
 
   PossiblyAssociatedFactoryGetterCallback direct_network_factory_getter_;
   PossiblyAssociatedURLLoaderFactoryPtr direct_network_factory_;

content/renderer/render_frame_impl.cc

@@ -3357,23 +3357,11 @@ RenderFrameImpl::CreateWorkerFetchContext() {
       container_host_ptr_info = provider_context->CloneContainerHostPtrInfo();
   }
 
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  std::unique_ptr<network::SharedURLLoaderFactoryInfo>
-      direct_network_loader_factory_info;
-  // Could be null in tests.
-  if (render_thread) {
-    direct_network_loader_factory_info =
-        base::MakeRefCounted<PossiblyAssociatedWrapperSharedURLLoaderFactory>(
-            render_thread->blink_platform_impl()
-                ->CreateNetworkURLLoaderFactory())
-            ->Clone();
-  }
-
   std::unique_ptr<WorkerFetchContextImpl> worker_fetch_context =
       std::make_unique<WorkerFetchContextImpl>(
           std::move(service_worker_client_request),
           std::move(container_host_ptr_info), GetLoaderFactoryBundle()->Clone(),
-          std::move(direct_network_loader_factory_info),
+          GetLoaderFactoryBundle()->CloneWithoutDefaultFactory(),
           GetContentClient()->renderer()->CreateURLLoaderThrottleProvider(
               URLLoaderThrottleProviderType::kWorker),
           GetContentClient()
@@ -3893,19 +3881,14 @@ void RenderFrameImpl::DidCreateDocumentLoader(
   if (document_loader->GetServiceWorkerNetworkProvider())
     return;
 
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  scoped_refptr<network::SharedURLLoaderFactory> direct_network_loader_factory;
-  if (render_thread) {
-    direct_network_loader_factory =
-        base::MakeRefCounted<PossiblyAssociatedWrapperSharedURLLoaderFactory>(
-            render_thread->blink_platform_impl()
-                ->CreateNetworkURLLoaderFactory());
-  }
+  scoped_refptr<network::SharedURLLoaderFactory> fallback_factory =
+      network::SharedURLLoaderFactory::Create(
+          GetLoaderFactoryBundle()->CloneWithoutDefaultFactory());
   document_loader->SetServiceWorkerNetworkProvider(
       ServiceWorkerNetworkProvider::CreateForNavigation(
           routing_id_, navigation_state->request_params(), frame_,
           content_initiated, std::move(controller_service_worker_info_),
-          std::move(direct_network_loader_factory)));
+          std::move(fallback_factory)));
 }
 
 void RenderFrameImpl::DidStartProvisionalLoad(

content/renderer/service_worker/service_worker_network_provider.cc

@@ -11,6 +11,7 @@
 #include "content/common/service_worker/service_worker_provider_host_info.h"
 #include "content/common/service_worker/service_worker_utils.h"
 #include "content/public/common/browser_side_navigation_policy.h"
+#include "content/public/common/origin_util.h"
 #include "content/renderer/loader/request_extra_data.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/renderer_blink_platform_impl.h"
@@ -111,8 +112,14 @@ class WebServiceWorkerNetworkProviderForFrame
         !provider_->context()->GetSubresourceLoaderFactory())
       return nullptr;
 
-    // If it's not for HTTP or HTTPS, no need to intercept the request.
-    if (!GURL(request.Url()).SchemeIsHTTPOrHTTPS())
+    // If the URL is not http(s) or otherwise whitelisted, do not intercept the
+    // request. Schemes like 'blob' and 'file' are not eligible to be
+    // intercepted by service workers.
+    // TODO(falken): Let ServiceWorkerSubresourceLoaderFactory handle the
+    // request and move this check there (i.e., for such URLs, it should use
+    // its fallback factory).
+    const GURL gurl(request.Url());
+    if (!gurl.SchemeIsHTTPOrHTTPS() && !OriginCanAccessServiceWorkers(gurl))
       return nullptr;
 
     // If GetSkipServiceWorker() returns true, do not intercept the request.
@@ -144,7 +151,7 @@ ServiceWorkerNetworkProvider::CreateForNavigation(
     blink::WebLocalFrame* frame,
     bool content_initiated,
     mojom::ControllerServiceWorkerInfoPtr controller_info,
-    scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory) {
+    scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory) {
   // Determine if a ServiceWorkerNetworkProvider should be created and properly
   // initialized for the navigation. A default ServiceWorkerNetworkProvider
   // will always be created since it is expected in a certain number of places,
@@ -186,7 +193,7 @@ ServiceWorkerNetworkProvider::CreateForNavigation(
   auto provider = base::WrapUnique(new ServiceWorkerNetworkProvider(
       route_id, blink::mojom::ServiceWorkerProviderType::kForWindow,
       provider_id, is_parent_frame_secure, std::move(controller_info),
-      std::move(default_loader_factory)));
+      std::move(fallback_loader_factory)));
   return std::make_unique<WebServiceWorkerNetworkProviderForFrame>(
       std::move(provider));
 }
@@ -197,13 +204,13 @@ ServiceWorkerNetworkProvider::CreateForSharedWorker(
     mojom::ServiceWorkerProviderInfoForSharedWorkerPtr info,
     network::mojom::URLLoaderFactoryAssociatedPtrInfo
         script_loader_factory_info,
-    scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory) {
+    scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory) {
   // S13nServiceWorker: |info| holds info about the precreated provider host.
   if (info) {
     DCHECK(ServiceWorkerUtils::IsServicificationEnabled());
     return base::WrapUnique(new ServiceWorkerNetworkProvider(
         std::move(info), std::move(script_loader_factory_info),
-        std::move(default_loader_factory)));
+        std::move(fallback_loader_factory)));
   }
 
   return base::WrapUnique(new ServiceWorkerNetworkProvider(
@@ -211,7 +218,7 @@ ServiceWorkerNetworkProvider::CreateForSharedWorker(
       blink::mojom::ServiceWorkerProviderType::kForSharedWorker,
       GetNextProviderId(), true /* is_parent_frame_secure */,
       nullptr /* controller_service_worker */,
-      std::move(default_loader_factory)));
+      std::move(fallback_loader_factory)));
 }
 
 // static
@@ -261,7 +268,7 @@ ServiceWorkerNetworkProvider::ServiceWorkerNetworkProvider(
     int provider_id,
     bool is_parent_frame_secure,
     mojom::ControllerServiceWorkerInfoPtr controller_info,
-    scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory) {
+    scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory) {
   DCHECK_NE(provider_id, kInvalidServiceWorkerProviderId);
   DCHECK(provider_type == blink::mojom::ServiceWorkerProviderType::kForWindow ||
          provider_type ==
@@ -282,7 +289,7 @@ ServiceWorkerNetworkProvider::ServiceWorkerNetworkProvider(
     context_ = base::MakeRefCounted<ServiceWorkerProviderContext>(
         provider_id, provider_type, std::move(client_request),
         std::move(host_ptr_info), std::move(controller_info),
-        std::move(default_loader_factory));
+        std::move(fallback_loader_factory));
     ChildThreadImpl::current()->channel()->GetRemoteAssociatedInterface(
         &dispatcher_host_);
     dispatcher_host_->OnProviderCreated(std::move(host_info));
@@ -290,7 +297,7 @@ ServiceWorkerNetworkProvider::ServiceWorkerNetworkProvider(
     context_ = base::MakeRefCounted<ServiceWorkerProviderContext>(
         provider_id, provider_type, std::move(client_request),
         std::move(host_ptr_info), std::move(controller_info),
-        std::move(default_loader_factory));
+        std::move(fallback_loader_factory));
   }
 }
 
@@ -299,13 +306,13 @@ ServiceWorkerNetworkProvider::ServiceWorkerNetworkProvider(
     mojom::ServiceWorkerProviderInfoForSharedWorkerPtr info,
     network::mojom::URLLoaderFactoryAssociatedPtrInfo
         script_loader_factory_info,
-    scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory) {
+    scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory) {
   ServiceWorkerDispatcher::GetOrCreateThreadSpecificInstance();
   context_ = base::MakeRefCounted<ServiceWorkerProviderContext>(
       info->provider_id,
       blink::mojom::ServiceWorkerProviderType::kForSharedWorker,
       std::move(info->client_request), std::move(info->host_ptr_info),
-      nullptr /* controller */, std::move(default_loader_factory));
+      nullptr /* controller */, std::move(fallback_loader_factory));
   if (script_loader_factory_info.is_valid())
     script_loader_factory_.Bind(std::move(script_loader_factory_info));
 }

content/renderer/service_worker/service_worker_network_provider.h

@@ -63,10 +63,10 @@ class CONTENT_EXPORT ServiceWorkerNetworkProvider {
   // For S13nServiceWorker:
   // |controller_info| contains the endpoint and object info that is needed to
   // set up the controller service worker for the client.
-  // |default_loader_factory| is a default loader factory for network requests,
-  // and is used when we create a subresource loader for controllees. This is
-  // non-null only if the provider is created for controllees, and if the
-  // loading context, e.g. a frame, provides it.
+  // |fallback_loader_factory| is a default loader factory for fallback
+  // requests, and is used when we create a subresource loader for controllees.
+  // This is non-null only if the provider is created for controllees, and if
+  // the loading context, e.g. a frame, provides it.
   static std::unique_ptr<blink::WebServiceWorkerNetworkProvider>
   CreateForNavigation(
       int route_id,
@@ -74,7 +74,7 @@ class CONTENT_EXPORT ServiceWorkerNetworkProvider {
       blink::WebLocalFrame* frame,
       bool content_initiated,
       mojom::ControllerServiceWorkerInfoPtr controller_info,
-      scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory);
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory);
 
   // Creates a ServiceWorkerNetworkProvider for a shared worker (as a
   // non-document service worker client).
@@ -82,7 +82,7 @@ class CONTENT_EXPORT ServiceWorkerNetworkProvider {
       mojom::ServiceWorkerProviderInfoForSharedWorkerPtr info,
       network::mojom::URLLoaderFactoryAssociatedPtrInfo
           script_loader_factory_info,
-      scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory);
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory);
 
   // Creates a ServiceWorkerNetworkProvider for a "controller" (i.e.
   // a service worker execution context).
@@ -116,20 +116,20 @@ class CONTENT_EXPORT ServiceWorkerNetworkProvider {
   //
   // For S13nServiceWorker:
   // See the comment at CreateForNavigation() for |controller_info| and
-  // |default_loader_factory|.
+  // |fallback_loader_factory|.
   ServiceWorkerNetworkProvider(
       int route_id,
       blink::mojom::ServiceWorkerProviderType type,
       int provider_id,
       bool is_parent_frame_secure,
       mojom::ControllerServiceWorkerInfoPtr controller_info,
-      scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory);
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory);
 
   ServiceWorkerNetworkProvider(
       mojom::ServiceWorkerProviderInfoForSharedWorkerPtr info,
       network::mojom::URLLoaderFactoryAssociatedPtrInfo
           script_loader_factory_info,
-      scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory);
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory);
 
   // This is for controllers, used in CreateForController.
   explicit ServiceWorkerNetworkProvider(

content/renderer/service_worker/service_worker_provider_context.cc

@@ -36,8 +36,8 @@ namespace content {
 // Holds state for service worker clients.
 struct ServiceWorkerProviderContext::ProviderStateForClient {
   explicit ProviderStateForClient(
-      scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory)
-      : default_loader_factory(std::move(default_loader_factory)) {}
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory)
+      : fallback_loader_factory(std::move(fallback_loader_factory)) {}
   ~ProviderStateForClient() = default;
 
   // |controller| will be set by SetController() and taken by TakeController().
@@ -52,7 +52,7 @@ struct ServiceWorkerProviderContext::ProviderStateForClient {
 
   // S13nServiceWorker:
   // Used when we create |subresource_loader_factory|.
-  scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory;
+  scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory;
 
   // Tracks feature usage for UseCounter.
   std::set<blink::mojom::WebFeature> used_features;
@@ -99,7 +99,7 @@ ServiceWorkerProviderContext::ServiceWorkerProviderContext(
     mojom::ServiceWorkerContainerAssociatedRequest request,
     mojom::ServiceWorkerContainerHostAssociatedPtrInfo host_ptr_info,
     mojom::ControllerServiceWorkerInfoPtr controller_info,
-    scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory)
+    scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory)
     : provider_type_(provider_type),
       provider_id_(provider_id),
       main_thread_task_runner_(base::ThreadTaskRunnerHandle::Get()),
@@ -107,7 +107,7 @@ ServiceWorkerProviderContext::ServiceWorkerProviderContext(
       weak_factory_(this) {
   container_host_.Bind(std::move(host_ptr_info));
   state_for_client_ = std::make_unique<ProviderStateForClient>(
-      std::move(default_loader_factory));
+      std::move(fallback_loader_factory));
 
   // Set up the URL loader factory for sending subresource requests to
   // the controller.
@@ -190,7 +190,7 @@ ServiceWorkerProviderContext::GetSubresourceLoaderFactory() {
   DCHECK(ServiceWorkerUtils::IsServicificationEnabled());
   if (!state->subresource_loader_factory) {
     ServiceWorkerSubresourceLoaderFactory::Create(
-        state->controller_connector, state->default_loader_factory,
+        state->controller_connector, state->fallback_loader_factory,
         mojo::MakeRequest(&state->subresource_loader_factory));
   }
   return state->subresource_loader_factory.get();
@@ -413,10 +413,9 @@ void ServiceWorkerProviderContext::CountFeature(
 bool ServiceWorkerProviderContext::CanCreateSubresourceLoaderFactory() const {
   // Expected that it is called only for clients.
   DCHECK(state_for_client_);
-  // |state_for_client_->default_loader_factory| could be null
-  // in unit tests.
+  // |state_for_client_->fallback_loader_factory| could be null in unit tests.
   return (ServiceWorkerUtils::IsServicificationEnabled() &&
-          state_for_client_->default_loader_factory);
+          state_for_client_->fallback_loader_factory);
 }
 
 void ServiceWorkerProviderContext::DestructOnMainThread() const {

content/renderer/service_worker/service_worker_provider_context.h

@@ -69,17 +69,17 @@ class CONTENT_EXPORT ServiceWorkerProviderContext
   // S13nServiceWorker is enabled) and object info that is needed to set up the
   // controller service worker for the client.
   // For S13nServiceWorker:
-  // |default_loader_factory| is a default loader factory for network requests,
-  // and is used when we create a subresource loader for controllees. This is
-  // non-null only if the provider is created for controllees, and if the
-  // loading context, e.g. a frame, provides it.
+  // |fallback_loader_factory| is a default loader factory for fallback
+  // requests, and is used when we create a subresource loader for controllees.
+  // This is non-null only if the provider is created for controllees, and if
+  // the loading context, e.g. a frame, provides it.
   ServiceWorkerProviderContext(
       int provider_id,
       blink::mojom::ServiceWorkerProviderType provider_type,
       mojom::ServiceWorkerContainerAssociatedRequest request,
       mojom::ServiceWorkerContainerHostAssociatedPtrInfo host_ptr_info,
       mojom::ControllerServiceWorkerInfoPtr controller_info,
-      scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory);
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_loader_factory);
 
   // Constructor for service worker execution contexts.
   ServiceWorkerProviderContext(

content/renderer/service_worker/service_worker_subresource_loader.cc

@@ -142,7 +142,7 @@ ServiceWorkerSubresourceLoader::ServiceWorkerSubresourceLoader(
     network::mojom::URLLoaderClientPtr client,
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
     scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
-    scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory)
+    scoped_refptr<network::SharedURLLoaderFactory> fallback_factory)
     : redirect_limit_(net::URLRequest::kMaxRedirects),
       url_loader_client_(std::move(client)),
       url_loader_binding_(this, std::move(request)),
@@ -154,7 +154,7 @@ ServiceWorkerSubresourceLoader::ServiceWorkerSubresourceLoader(
       options_(options),
       traffic_annotation_(traffic_annotation),
       resource_request_(resource_request),
-      network_loader_factory_(std::move(network_loader_factory)),
+      fallback_factory_(std::move(fallback_factory)),
       weak_factory_(this) {
   DCHECK(controller_connector_);
   response_head_.request_start = base::TimeTicks::Now();
@@ -214,7 +214,7 @@ void ServiceWorkerSubresourceLoader::DispatchFetchEvent() {
         ControllerServiceWorkerConnector::State::kNoController) {
       // The controller was lost after this loader or its loader factory was
       // created.
-      network_loader_factory_->CreateLoaderAndStart(
+      fallback_factory_->CreateLoaderAndStart(
           url_loader_binding_.Unbind(), routing_id_, request_id_, options_,
           resource_request_, std::move(url_loader_client_),
           traffic_annotation_);
@@ -342,8 +342,6 @@ void ServiceWorkerSubresourceLoader::OnResponseStream(
 void ServiceWorkerSubresourceLoader::OnFallback(
     base::Time dispatch_event_time) {
   SettleInflightFetchRequestIfNeeded();
-  DCHECK(network_loader_factory_);
-
   // When the request mode is CORS or CORS-with-forced-preflight and the origin
   // of the request URL is different from the security origin of the document,
   // we can't simply fallback to the network here. It is because the CORS
@@ -372,11 +370,17 @@ void ServiceWorkerSubresourceLoader::OnFallback(
                           response_head_.service_worker_ready_time));
   mojo::MakeStrongBinding(std::move(client_impl), mojo::MakeRequest(&client));
 
-  network_loader_factory_->CreateLoaderAndStart(
+  fallback_factory_->CreateLoaderAndStart(
       url_loader_binding_.Unbind(), routing_id_, request_id_, options_,
       resource_request_, std::move(client), traffic_annotation_);
   // Per spec, redirects after this point are not intercepted by the service
   // worker again (https://crbug.com/517364). So this loader is done.
+  //
+  // Assume ServiceWorkerSubresourceLoaderFactory is still alive and also
+  // has a ref to fallback_factory_, so it's OK to destruct here. If that
+  // factory dies, the web context that made the request is dead so the request
+  // is moot.
+  DCHECK(!fallback_factory_->HasOneRef());
   delete this;
 }
 
@@ -518,20 +522,20 @@ void ServiceWorkerSubresourceLoader::OnBlobReadingComplete(int net_error) {
 // static
 void ServiceWorkerSubresourceLoaderFactory::Create(
     scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
-    scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory,
+    scoped_refptr<network::SharedURLLoaderFactory> fallback_factory,
     network::mojom::URLLoaderFactoryRequest request) {
   new ServiceWorkerSubresourceLoaderFactory(std::move(controller_connector),
-                                            std::move(network_loader_factory),
+                                            std::move(fallback_factory),
                                             std::move(request));
 }
 
 ServiceWorkerSubresourceLoaderFactory::ServiceWorkerSubresourceLoaderFactory(
     scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
-    scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory,
+    scoped_refptr<network::SharedURLLoaderFactory> fallback_factory,
     network::mojom::URLLoaderFactoryRequest request)
     : controller_connector_(std::move(controller_connector)),
-      network_loader_factory_(std::move(network_loader_factory)) {
-  DCHECK(network_loader_factory_);
+      fallback_factory_(std::move(fallback_factory)) {
+  DCHECK(fallback_factory_);
   bindings_.AddBinding(this, std::move(request));
   bindings_.set_connection_error_handler(base::BindRepeating(
       &ServiceWorkerSubresourceLoaderFactory::OnConnectionError,
@@ -551,12 +555,12 @@ void ServiceWorkerSubresourceLoaderFactory::CreateLoaderAndStart(
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation) {
   // This loader destructs itself, as we want to transparently switch to the
   // network loader when fallback happens. When that happens the loader unbinds
-  // the request, passes the request to the Network Loader Factory, and
+  // the request, passes the request to the fallback factory, and
   // destructs itself (while the loader client continues to work).
-  new ServiceWorkerSubresourceLoader(
-      std::move(request), routing_id, request_id, options, resource_request,
-      std::move(client), traffic_annotation, controller_connector_,
-      network_loader_factory_);
+  new ServiceWorkerSubresourceLoader(std::move(request), routing_id, request_id,
+                                     options, resource_request,
+                                     std::move(client), traffic_annotation,
+                                     controller_connector_, fallback_factory_);
 }
 
 void ServiceWorkerSubresourceLoaderFactory::Clone(

content/renderer/service_worker/service_worker_subresource_loader.h

@@ -51,7 +51,7 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoader
       network::mojom::URLLoaderClientPtr client,
       const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
       scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
-      scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory);
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_factory);
 
   ~ServiceWorkerSubresourceLoader() override;
 
@@ -138,7 +138,7 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoader
   std::unique_ptr<StreamWaiter> stream_waiter_;
 
   // For network fallback.
-  scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory_;
+  scoped_refptr<network::SharedURLLoaderFactory> fallback_factory_;
 
   enum class Status {
     kNotStarted,
@@ -168,7 +168,7 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoaderFactory
   // any custom URLLoader factories.
   static void Create(
       scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
-      scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory,
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_factory,
       network::mojom::URLLoaderFactoryRequest request);
 
   ~ServiceWorkerSubresourceLoaderFactory() override;
@@ -187,16 +187,15 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoaderFactory
  private:
   ServiceWorkerSubresourceLoaderFactory(
       scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
-      scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory,
+      scoped_refptr<network::SharedURLLoaderFactory> fallback_factory,
       network::mojom::URLLoaderFactoryRequest request);
 
   void OnConnectionError();
 
   scoped_refptr<ControllerServiceWorkerConnector> controller_connector_;
 
-  // A URLLoaderFactory that directly goes to network, used when a request
-  // falls back to network.
-  scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory_;
+  // Used when a request falls back to network.
+  scoped_refptr<network::SharedURLLoaderFactory> fallback_factory_;
 
   mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
 

content/renderer/service_worker/worker_fetch_context_impl.cc

@@ -109,10 +109,8 @@ class WorkerFetchContextImpl::URLLoaderFactoryImpl
 WorkerFetchContextImpl::WorkerFetchContextImpl(
     mojom::ServiceWorkerWorkerClientRequest service_worker_client_request,
     mojom::ServiceWorkerContainerHostPtrInfo service_worker_container_host_info,
-    std::unique_ptr<network::SharedURLLoaderFactoryInfo>
-        url_loader_factory_info,
-    std::unique_ptr<network::SharedURLLoaderFactoryInfo>
-        direct_network_factory_info,
+    std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
+    std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory_info,
     std::unique_ptr<URLLoaderThrottleProvider> throttle_provider,
     std::unique_ptr<WebSocketHandshakeThrottleProvider>
         websocket_handshake_throttle_provider,
@@ -121,9 +119,8 @@ WorkerFetchContextImpl::WorkerFetchContextImpl(
       service_worker_client_request_(std::move(service_worker_client_request)),
       service_worker_container_host_info_(
           std::move(service_worker_container_host_info)),
-      url_loader_factory_info_(std::move(url_loader_factory_info)),
-      direct_network_loader_factory_info_(
-          std::move(direct_network_factory_info)),
+      loader_factory_info_(std::move(loader_factory_info)),
+      fallback_factory_info_(std::move(fallback_factory_info)),
       thread_safe_sender_(thread_safe_sender),
       throttle_provider_(std::move(throttle_provider)),
       websocket_handshake_throttle_provider_(
@@ -151,9 +148,8 @@ WorkerFetchContextImpl::CloneForNestedWorker() {
   // behavior. See https://crbug.com/731604
   auto new_context = std::make_unique<WorkerFetchContextImpl>(
       mojom::ServiceWorkerWorkerClientRequest(),
-      mojom::ServiceWorkerContainerHostPtrInfo(),
-      shared_url_loader_factory_->Clone(),
-      direct_network_loader_factory_->Clone(),
+      mojom::ServiceWorkerContainerHostPtrInfo(), loader_factory_->Clone(),
+      fallback_factory_->Clone(),
       throttle_provider_ ? throttle_provider_->Clone() : nullptr,
       websocket_handshake_throttle_provider_
           ? websocket_handshake_throttle_provider_->Clone()
@@ -171,10 +167,10 @@ void WorkerFetchContextImpl::InitializeOnWorkerThread() {
   resource_dispatcher_->set_terminate_sync_load_event(
       terminate_sync_load_event_);
 
-  shared_url_loader_factory_ = network::SharedURLLoaderFactory::Create(
-      std::move(url_loader_factory_info_));
-  direct_network_loader_factory_ = network::SharedURLLoaderFactory::Create(
-      std::move(direct_network_loader_factory_info_));
+  loader_factory_ =
+      network::SharedURLLoaderFactory::Create(std::move(loader_factory_info_));
+  fallback_factory_ = network::SharedURLLoaderFactory::Create(
+      std::move(fallback_factory_info_));
   if (service_worker_client_request_.is_pending())
     binding_.Bind(std::move(service_worker_client_request_));
 
@@ -192,10 +188,10 @@ void WorkerFetchContextImpl::InitializeOnWorkerThread() {
 
 std::unique_ptr<blink::WebURLLoaderFactory>
 WorkerFetchContextImpl::CreateURLLoaderFactory() {
-  DCHECK(shared_url_loader_factory_);
+  DCHECK(loader_factory_);
   DCHECK(!url_loader_factory_);
   auto factory = std::make_unique<URLLoaderFactoryImpl>(
-      resource_dispatcher_->GetWeakPtr(), shared_url_loader_factory_);
+      resource_dispatcher_->GetWeakPtr(), loader_factory_);
   url_loader_factory_ = factory->GetWeakPtr();
 
   if (ServiceWorkerUtils::IsServicificationEnabled())
@@ -344,12 +340,12 @@ void WorkerFetchContextImpl::ResetServiceWorkerURLLoaderFactory() {
     url_loader_factory_->SetServiceWorkerURLLoaderFactory(nullptr);
     return;
   }
+
   network::mojom::URLLoaderFactoryPtr service_worker_url_loader_factory;
   ServiceWorkerSubresourceLoaderFactory::Create(
       base::MakeRefCounted<ControllerServiceWorkerConnector>(
           service_worker_container_host_.get()),
-      direct_network_loader_factory_,
-      mojo::MakeRequest(&service_worker_url_loader_factory));
+      fallback_factory_, mojo::MakeRequest(&service_worker_url_loader_factory));
   url_loader_factory_->SetServiceWorkerURLLoaderFactory(
       std::move(service_worker_url_loader_factory));
 }

content/renderer/service_worker/worker_fetch_context_impl.h

@@ -37,21 +37,27 @@ class CONTENT_EXPORT WorkerFetchContextImpl
     : public blink::WebWorkerFetchContext,
       public mojom::ServiceWorkerWorkerClient {
  public:
-  // |url_loader_factory_info| is a generic URLLoaderFactory that may
-  // contain multiple URLLoader factories for different schemes internally,
-  // and used for regular resource loading from the worker context.
-  // |direct_network_factory_info| is a URLLoader factory that directly
-  // goes to the network, used when this context creates a
-  // ServiceWorkerSubresourceLoader because it is controlled by a service
-  // worker.
+  // |loader_factory_info| is used for regular loading by the worker.
+  //
+  // S13nServiceWorker:
+  // If the worker is controlled by a service worker, this class makes another
+  // loader factory which sends requests to the service worker, and passes
+  // |fallback_factory_info| to that factory to use for network fallback.
+  //
+  // |loader_factory_info| and |fallback_factory_info| are different because
+  // |loader_factory_info| can possibly include a default factory like AppCache,
+  // while |fallback_factory_info| should not have such a default factory and
+  // instead go directly to network for http(s) requests.
+  // |fallback_factory_info| might not be simply the direct network factory,
+  // because it might additionally support non-NetworkService schemes (e.g.,
+  // chrome-extension://).
   WorkerFetchContextImpl(
       mojom::ServiceWorkerWorkerClientRequest service_worker_client_request,
       mojom::ServiceWorkerContainerHostPtrInfo
           service_worker_container_host_info,
+      std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
       std::unique_ptr<network::SharedURLLoaderFactoryInfo>
-          url_loader_factory_info,
-      std::unique_ptr<network::SharedURLLoaderFactoryInfo>
-          direct_network_factory_info,
+          fallback_factory_info,
       std::unique_ptr<URLLoaderThrottleProvider> throttle_provider,
       std::unique_ptr<WebSocketHandshakeThrottleProvider>
           websocket_handshake_throttle_provider,
@@ -118,11 +124,10 @@ class CONTENT_EXPORT WorkerFetchContextImpl
   mojom::ServiceWorkerWorkerClientRequest service_worker_client_request_;
   // Consumed on the worker thread to create |service_worker_container_host_|.
   mojom::ServiceWorkerContainerHostPtrInfo service_worker_container_host_info_;
-  // Consumed on the worker thread to create |shared_url_loader_factory_|.
-  std::unique_ptr<network::SharedURLLoaderFactoryInfo> url_loader_factory_info_;
-  // Consumed on the worker thread to create |direct_network_loader_factory_|.
-  std::unique_ptr<network::SharedURLLoaderFactoryInfo>
-      direct_network_loader_factory_info_;
+  // Consumed on the worker thread to create |loader_factory_|.
+  std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info_;
+  // Consumed on the worker thread to create |fallback_factory_|.
+  std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory_info_;
   // Consumed on the worker thread to create |blob_registry_|.
   blink::mojom::BlobRegistryPtrInfo blob_registry_ptr_info_;
 
@@ -136,14 +141,16 @@ class CONTENT_EXPORT WorkerFetchContextImpl
   std::unique_ptr<ResourceDispatcher> resource_dispatcher_;
 
   // Initialized on the worker thread when InitializeOnWorkerThread() is called.
-  // |shared_url_loader_factory_| may be a bundled factory that contains
-  // multiple factories for different schemes and to be used for regular
-  // loading by the worker, while |direct_network_loader_factory_| is used
-  // specifically to initialize ServiceWorkerSubresourceLoader for network
-  // load that is controlled by a service worker (when this worker is a
-  // client of the service worker).
-  scoped_refptr<network::SharedURLLoaderFactory> shared_url_loader_factory_;
-  scoped_refptr<network::SharedURLLoaderFactory> direct_network_loader_factory_;
+  // |loader_factory_| is used for regular loading by the worker. In
+  // S13nServiceWorker, if the worker is controlled by a service worker, it
+  // creates a ServiceWorkerSubresourceLoaderFactory instead.
+  scoped_refptr<network::SharedURLLoaderFactory> loader_factory_;
+
+  // Initialized on the worker thread when InitializeOnWorkerThread() is called.
+  // S13nServiceWorker: If the worker is controlled by a service worker, it
+  // passes this factory to ServiceWorkerSubresourceLoaderFactory to use for
+  // network fallback.
+  scoped_refptr<network::SharedURLLoaderFactory> fallback_factory_;
 
   // S13nServiceWorker:
   // Initialized on the worker thread when InitializeOnWorkerThread() is called.

content/renderer/shared_worker/embedded_shared_worker_stub.cc

@@ -275,20 +275,20 @@ EmbeddedSharedWorkerStub::CreateApplicationCacheHost(
 
 std::unique_ptr<blink::WebServiceWorkerNetworkProvider>
 EmbeddedSharedWorkerStub::CreateServiceWorkerNetworkProvider() {
-  scoped_refptr<network::SharedURLLoaderFactory> direct_network_loader_factory;
+  scoped_refptr<network::SharedURLLoaderFactory> fallback_factory;
   // current() may be null in tests.
   if (RenderThreadImpl* render_thread = RenderThreadImpl::current()) {
-    direct_network_loader_factory =
-        base::MakeRefCounted<PossiblyAssociatedWrapperSharedURLLoaderFactory>(
-            render_thread->blink_platform_impl()
-                ->CreateNetworkURLLoaderFactory());
+    scoped_refptr<ChildURLLoaderFactoryBundle> bundle =
+        render_thread->blink_platform_impl()
+            ->CreateDefaultURLLoaderFactoryBundle();
+    fallback_factory = network::SharedURLLoaderFactory::Create(
+        bundle->CloneWithoutDefaultFactory());
   }
 
   std::unique_ptr<ServiceWorkerNetworkProvider> provider =
       ServiceWorkerNetworkProvider::CreateForSharedWorker(
           std::move(service_worker_provider_info_),
-          std::move(script_loader_factory_info_),
-          std::move(direct_network_loader_factory));
+          std::move(script_loader_factory_info_), std::move(fallback_factory));
   return std::make_unique<WebServiceWorkerNetworkProviderForSharedWorker>(
       std::move(provider), IsOriginSecure(url_));
 }
@@ -329,20 +329,10 @@ EmbeddedSharedWorkerStub::CreateWorkerFetchContext(
       RenderThreadImpl::current()
           ->blink_platform_impl()
           ->CreateDefaultURLLoaderFactoryBundle();
-
-  auto direct_network_loader_factory =
-      base::MakeRefCounted<PossiblyAssociatedWrapperSharedURLLoaderFactory>(
-          RenderThreadImpl::current()
-              ->blink_platform_impl()
-              ->CreateNetworkURLLoaderFactory());
-
-  DCHECK(url_loader_factory_bundle);
-  DCHECK(direct_network_loader_factory);
-
   auto worker_fetch_context = std::make_unique<WorkerFetchContextImpl>(
       std::move(request), std::move(container_host_ptr_info),
       url_loader_factory_bundle->Clone(),
-      direct_network_loader_factory->Clone(),
+      url_loader_factory_bundle->CloneWithoutDefaultFactory(),
       GetContentClient()->renderer()->CreateURLLoaderThrottleProvider(
           URLLoaderThrottleProviderType::kWorker),
       GetContentClient()

testing/buildbot/filters/mojo.fyi.network_browser_tests.filter

@@ -198,13 +198,7 @@
 # Finish ServiceWorker networking glue rewrite.
 # http://crbug.com/715640
 -ServiceWorkerTestWithJSBindings/ServiceWorkerTest.MimeHandlerView/0
--ServiceWorkerTestWithJSBindings/ServiceWorkerTest.SWServedBackgroundPageReceivesEvent/0
--ServiceWorkerTestWithJSBindings/ServiceWorkerTest.WebAccessibleResourcesFetch/0
--ServiceWorkerTestWithJSBindings/ServiceWorkerTest.WebAccessibleResourcesIframeSrc/0
 -ServiceWorkerTestWithNativeBindings/ServiceWorkerTest.MimeHandlerView/0
--ServiceWorkerTestWithNativeBindings/ServiceWorkerTest.SWServedBackgroundPageReceivesEvent/0
--ServiceWorkerTestWithNativeBindings/ServiceWorkerTest.WebAccessibleResourcesFetch/0
--ServiceWorkerTestWithNativeBindings/ServiceWorkerTest.WebAccessibleResourcesIframeSrc/0
 
 # Support URLLoaderFactories from embedder in shared workers.
 # https://crbug.com/839982