Stop keeping raw pointer of RenderFrameHost in UrlLoaderFactoryProxyImpl

Bug: 1128270
Change-Id: I29d6caaba1093baf46d3ac6086db3aca7a4cb4e0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2449676Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Matt Menke <mmenke@chromium.org>
Commit-Queue: Tsuyoshi Horo <horo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#814518}

chrome/browser/loader/url_loader_factory_proxy_impl.cc

@@ -21,14 +21,18 @@ void UrlLoaderFactoryProxyImpl::Create(
 
 UrlLoaderFactoryProxyImpl::UrlLoaderFactoryProxyImpl(
     content::RenderFrameHost* frame_host)
-    : frame_host_(frame_host) {}
+    : frame_id_(content::GlobalFrameRoutingId(frame_host->GetProcess()->GetID(),
+                                              frame_host->GetRoutingID())) {}
 
 UrlLoaderFactoryProxyImpl::~UrlLoaderFactoryProxyImpl() = default;
 
 void UrlLoaderFactoryProxyImpl::GetProxiedURLLoaderFactory(
     mojo::PendingRemote<network::mojom::URLLoaderFactory> original_factory,
     mojo::PendingReceiver<network::mojom::URLLoaderFactory> proxied_factory) {
-  auto* process = frame_host_->GetProcess();
+  auto* frame_host = content::RenderFrameHost::FromID(frame_id_);
+  if (!frame_host)
+    return;
+  auto* process = frame_host->GetProcess();
   auto* browser_context = process->GetBrowserContext();
   auto* web_request_api =
       extensions::BrowserContextKeyedAPIFactory<extensions::WebRequestAPI>::Get(
@@ -36,10 +40,10 @@ void UrlLoaderFactoryProxyImpl::GetProxiedURLLoaderFactory(
   DCHECK(web_request_api);
 
   web_request_api->MaybeProxyURLLoaderFactory(
-      browser_context, frame_host_, process->GetID(),
+      browser_context, frame_host, process->GetID(),
       content::ContentBrowserClient::URLLoaderFactoryType::kDocumentSubResource,
       /*navigation_id=*/base::nullopt,
-      base::UkmSourceId::FromInt64(frame_host_->GetPageUkmSourceId()),
+      base::UkmSourceId::FromInt64(frame_host->GetPageUkmSourceId()),
       &proxied_factory,
       /*headber_client=*/nullptr);
 

chrome/browser/loader/url_loader_factory_proxy_impl.h

@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_LOADER_URL_LOADER_FACTORY_PROXY_IMPL_H_
 
 #include "chrome/common/url_loader_factory_proxy.mojom.h"
+#include "content/public/browser/global_routing_id.h"
 
 namespace content {
 class RenderFrameHost;
@@ -15,6 +16,8 @@ class RenderFrameHost;
 // requests, so that subresource requests that are served within the renderer
 // process (from a Web Bundle) can still be intercepted by Chrome extensions.
 // This interface is implemented only when ENABLE_EXTENSIONS build flag is set.
+// TODO(crbug.com/1135829): Consider using RenderDocumentHostUserData to
+// restrict the lifetime of this object to the lifetime of a navigation.
 class UrlLoaderFactoryProxyImpl : public chrome::mojom::UrlLoaderFactoryProxy {
  public:
   static void Create(
@@ -29,7 +32,7 @@ class UrlLoaderFactoryProxyImpl : public chrome::mojom::UrlLoaderFactoryProxy {
       override;
 
  private:
-  content::RenderFrameHost* frame_host_;
+  const content::GlobalFrameRoutingId frame_id_;
 };
 
 #endif  // CHROME_BROWSER_LOADER_URL_LOADER_FACTORY_PROXY_IMPL_H_