Revert "Remove ScriptContext::ScopedFrameDocumentLoader"

This reverts commit 2e28f009.

Reason for revert: suspecting to cause crashes, http://crbug.com/1052107

Original change's description:
> Remove ScriptContext::ScopedFrameDocumentLoader
> 
> This scope is used to map Frame to just-about-to-commit DocumentLoader.
> 
> With https://crrev.com/706529, we now call ReadyToCommitNavigation
> after the commit (as opposite to before the commit). Therefore,
> WebLocalFrame::GetDocumentLoader is already the right one and we don't
> need a scoped mapping.
> 
> Bug: 855189
> Change-Id: I95621b00ee4391986f063e56f20d8d7d25b5c532
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2046210
> Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
> Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#740198}

TBR=dgozman@chromium.org,rdevlin.cronin@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: 855189
Change-Id: I7021f96e4c6db2a41f048113b369eee7a21b07ae
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2083390Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#746166}

extensions/renderer/extension_frame_helper.cc

@@ -314,6 +314,16 @@ void ExtensionFrameHelper::ReadyToCommitNavigation(
   v8::Local<v8::Context> context =
       render_frame()->GetWebFrame()->MainWorldScriptContext();
   v8::Context::Scope context_scope(context);
+  // Normally we would use Document's URL for all kinds of checks, e.g. whether
+  // to inject a content script. However, when committing a navigation, we
+  // should use the URL of a Document being committed instead. This URL is
+  // accessible through WebDocumentLoader::GetURL().
+  // The scope below temporary maps a frame to a document loader, so that places
+  // which retrieve URL can use the right one. Ideally, we would plumb the
+  // correct URL (or maybe WebDocumentLoader) through the callchain, but there
+  // are many callers which will have to pass nullptr.
+  ScriptContext::ScopedFrameDocumentLoader scoped_document_loader(
+      render_frame()->GetWebFrame(), document_loader);
   extension_dispatcher_->DidCreateScriptContext(render_frame()->GetWebFrame(),
                                                 context, kMainWorldId);
   // TODO(devlin): Add constants for main world id, no extension group.

extensions/renderer/script_context.cc

@@ -67,8 +67,38 @@ static std::string ToStringOrDefault(v8::Isolate* isolate,
   return ascii_value.empty() ? dflt : ascii_value;
 }
 
+using FrameToDocumentLoader =
+    base::flat_map<blink::WebLocalFrame*, blink::WebDocumentLoader*>;
+
+FrameToDocumentLoader& FrameDocumentLoaderMap() {
+  static base::NoDestructor<FrameToDocumentLoader> map;
+  return *map;
+}
+
+blink::WebDocumentLoader* CurrentDocumentLoader(
+    const blink::WebLocalFrame* frame) {
+  auto& map = FrameDocumentLoaderMap();
+  auto it = map.find(frame);
+  return it == map.end() ? frame->GetDocumentLoader() : it->second;
+}
+
 }  // namespace
 
+ScriptContext::ScopedFrameDocumentLoader::ScopedFrameDocumentLoader(
+    blink::WebLocalFrame* frame,
+    blink::WebDocumentLoader* document_loader)
+    : frame_(frame), document_loader_(document_loader) {
+  auto& map = FrameDocumentLoaderMap();
+  DCHECK(map.find(frame_) == map.end());
+  map[frame_] = document_loader_;
+}
+
+ScriptContext::ScopedFrameDocumentLoader::~ScopedFrameDocumentLoader() {
+  auto& map = FrameDocumentLoaderMap();
+  DCHECK_EQ(document_loader_, map.find(frame_)->second);
+  map.erase(frame_);
+}
+
 ScriptContext::ScriptContext(const v8::Local<v8::Context>& v8_context,
                              blink::WebLocalFrame* web_frame,
                              const Extension* extension,
@@ -269,7 +299,7 @@ GURL ScriptContext::GetDocumentLoaderURLForFrame(
   // changes to match the parent document after Gmail document.writes into
   // it to create the editor.
   // http://code.google.com/p/chromium/issues/detail?id=86742
-  blink::WebDocumentLoader* document_loader = frame->GetDocumentLoader();
+  blink::WebDocumentLoader* document_loader = CurrentDocumentLoader(frame);
   return document_loader ? GURL(document_loader->GetUrl()) : GURL();
 }
 
@@ -278,7 +308,7 @@ GURL ScriptContext::GetAccessCheckedFrameURL(
     const blink::WebLocalFrame* frame) {
   const blink::WebURL& weburl = frame->GetDocument().Url();
   if (weburl.IsEmpty()) {
-    blink::WebDocumentLoader* document_loader = frame->GetDocumentLoader();
+    blink::WebDocumentLoader* document_loader = CurrentDocumentLoader(frame);
     if (document_loader &&
         frame->GetSecurityOrigin().CanAccess(
             blink::WebSecurityOrigin::Create(document_loader->GetUrl()))) {

extensions/renderer/script_context.h

@@ -24,6 +24,7 @@
 #include "v8/include/v8.h"
 
 namespace blink {
+class WebDocumentLoader;
 class WebLocalFrame;
 }
 
@@ -176,6 +177,21 @@ class ScriptContext {
   bool IsAnyFeatureAvailableToContext(const extensions::Feature& api,
                                       CheckAliasStatus check_alias);
 
+  // Scope which maps a frame to a document loader. This is used by various
+  // static methods below, which need to account for "just about to load"
+  // document when retrieving URL.
+  class ScopedFrameDocumentLoader {
+   public:
+    ScopedFrameDocumentLoader(blink::WebLocalFrame* frame,
+                              blink::WebDocumentLoader* document_loader);
+    ~ScopedFrameDocumentLoader();
+
+   private:
+    blink::WebLocalFrame* frame_;
+    blink::WebDocumentLoader* document_loader_;
+    DISALLOW_COPY_AND_ASSIGN(ScopedFrameDocumentLoader);
+  };
+
   // Utility to get the URL we will match against for a frame. If the frame has
   // committed, this is the commited URL. Otherwise it is the provisional URL.
   // The returned URL may be invalid.