Make NetworkHintsHandlers use pending NetworkIsolationKeys.

They had been using the NetworkIsolationKey of the last committed
navigation, but since preconnects are triggered on headers received,
they can bear the commit to the RenderFrameHost.

This does mean that on navigating away, if the RenderFrameHost is
reused, there's a greater chance of using the NIK of the new commit
rather than the old one, when preconnecting.

Bug: 1157450
Change-Id: Id02e590cb47221194fee8e68cc7d213483c1920d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2584466
Commit-Queue: Matt Menke <mmenke@chromium.org>
Auto-Submit: Matt Menke <mmenke@chromium.org>
Reviewed-by: Alex Ilin <alexilin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#836622}

chrome/browser/predictors/network_hints_handler_impl.cc

@@ -13,9 +13,25 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "net/base/isolation_info.h"
 
 namespace predictors {
 
+namespace {
+
+// Preconnects can be received from the renderer before commit messages, so
+// need to use the key from the pending navigation, and not the committed
+// navigation, unlike other consumers. This does mean on navigating away from a
+// site, preconnect is more likely to incorrectly use the NetworkIsolationKey of
+// the previous commit.
+net::NetworkIsolationKey GetPendingNetworkIsolationKey(
+    content::RenderFrameHost* render_frame_host) {
+  return render_frame_host->GetPendingIsolationInfoForSubresources()
+      .network_isolation_key();
+}
+
+}  // namespace
+
 NetworkHintsHandlerImpl::~NetworkHintsHandlerImpl() = default;
 
 // static
@@ -38,7 +54,7 @@ void NetworkHintsHandlerImpl::PrefetchDNS(
     return;
 
   preconnect_manager_->StartPreresolveHosts(
-      names, render_frame_host->GetNetworkIsolationKey());
+      names, GetPendingNetworkIsolationKey(render_frame_host));
 }
 
 void NetworkHintsHandlerImpl::Preconnect(const GURL& url,
@@ -60,7 +76,7 @@ void NetworkHintsHandlerImpl::Preconnect(const GURL& url,
     return;
 
   preconnect_manager_->StartPreconnectUrl(
-      url, allow_credentials, render_frame_host->GetNetworkIsolationKey());
+      url, allow_credentials, GetPendingNetworkIsolationKey(render_frame_host));
 }
 
 NetworkHintsHandlerImpl::NetworkHintsHandlerImpl(

components/network_hints/browser/simple_network_hints_handler_impl.cc

@@ -30,6 +30,17 @@
 namespace network_hints {
 namespace {
 
+// Preconnects can be received from the renderer before commit messages, so
+// need to use the key from the pending navigation, and not the committed
+// navigation, unlike other consumers. This does mean on navigating away from a
+// site, preconnect is more likely to incorrectly use the NetworkIsolationKey of
+// the previous commit.
+net::NetworkIsolationKey GetPendingNetworkIsolationKey(
+    content::RenderFrameHost* render_frame_host) {
+  return render_frame_host->GetPendingIsolationInfoForSubresources()
+      .network_isolation_key();
+}
+
 const int kDefaultPort = 80;
 
 // This class contains a std::unique_ptr of itself, it is passed in through
@@ -73,7 +84,7 @@ class DnsLookupRequest : public network::ResolveHostClientBase {
         ->GetStoragePartition()
         ->GetNetworkContext()
         ->ResolveHost(host_port_pair,
-                      render_frame_host->GetNetworkIsolationKey(),
+                      GetPendingNetworkIsolationKey(render_frame_host),
                       std::move(resolve_host_parameters),
                       receiver_.BindNewPipeAndPassRemote());
     receiver_.set_disconnect_handler(