Set up Mojo connection when RenderFrameHost is reused for new RenderFrame

After a render process dies, the main RenderFrameHostImpl can be reused for a
new RenderFrame in a new render process. In this case, the Mojo connection
between the RFHI and the new RenderFrame was not being set up. This CL fixes
the glitch and additionally future-proofs for the case where sub-frames can be
reused as well:

- When the FrameTree resets process state, it instructs the RFHI's affected
  to invalidate their Mojo connections.
- When the RenderFrameHostManager creates a new RenderFrame for an RFHI,
  it instructs that RFHI to set up the Mojo connection if necessary.

BUG=421069
TEST=Navigate to about://omnibox. Kill the tab via the Task Manager and reload.
Observe that the page produces output upon submission of input.

Review URL: https://codereview.chromium.org/666563005

Cr-Commit-Position: refs/heads/master@{#301329}

content/browser/frame_host/frame_tree.cc

@@ -47,8 +47,12 @@ bool FrameTreeNodeForId(int64 frame_tree_node_id,
 // given RenderViewHost's process.
 bool ResetNodesForNewProcess(RenderViewHost* render_view_host,
                              FrameTreeNode* node) {
-  if (render_view_host == node->current_frame_host()->render_view_host())
+  if (render_view_host == node->current_frame_host()->render_view_host()) {
+    // Ensure that if the frame host is reused for a new RenderFrame, it will
+    // set up the Mojo connection with that frame.
+    node->current_frame_host()->InvalidateMojoConnection();
     node->ResetForNewProcess();
+  }
   return true;
 }
 

content/browser/frame_host/render_frame_host_impl.cc

@@ -209,20 +209,7 @@ RenderFrameHostImpl::RenderFrameHostImpl(RenderViewHostImpl* render_view_host,
     GetSiteInstance()->increment_active_frame_count();
   }
 
-  if (GetProcess()->GetServiceRegistry()) {
-    RenderFrameSetupPtr setup;
-    GetProcess()->GetServiceRegistry()->ConnectToRemoteService(&setup);
-    mojo::ServiceProviderPtr service_provider;
-    setup->GetServiceProviderForFrame(routing_id_,
-                                      mojo::GetProxy(&service_provider));
-    service_registry_.BindRemoteServiceProvider(
-        service_provider.PassMessagePipe());
-
-#if defined(OS_ANDROID)
-    service_registry_android_.reset(
-        new ServiceRegistryAndroid(&service_registry_));
-#endif
-  }
+  SetUpMojoIfNeeded();
 
   swapout_event_monitor_timeout_.reset(new TimeoutMonitor(base::Bind(
       &RenderFrameHostImpl::OnSwappedOut, weak_ptr_factory_.GetWeakPtr())));
@@ -322,7 +309,7 @@ RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() {
 }
 
 ServiceRegistry* RenderFrameHostImpl::GetServiceRegistry() {
-  return &service_registry_;
+  return service_registry_.get();
 }
 
 bool RenderFrameHostImpl::Send(IPC::Message* message) {
@@ -1442,6 +1429,35 @@ void RenderFrameHostImpl::CommitNavigation(
   stream_handle_ = body.Pass();
 }
 
+void RenderFrameHostImpl::SetUpMojoIfNeeded() {
+  if (service_registry_.get())
+    return;
+
+  service_registry_.reset(new ServiceRegistryImpl());
+  if (!GetProcess()->GetServiceRegistry())
+    return;
+
+  RenderFrameSetupPtr setup;
+  GetProcess()->GetServiceRegistry()->ConnectToRemoteService(&setup);
+  mojo::ServiceProviderPtr service_provider;
+  setup->GetServiceProviderForFrame(routing_id_,
+                                    mojo::GetProxy(&service_provider));
+  service_registry_->BindRemoteServiceProvider(
+      service_provider.PassMessagePipe());
+
+#if defined(OS_ANDROID)
+  service_registry_android_.reset(
+      new ServiceRegistryAndroid(service_registry_.get()));
+#endif
+}
+
+void RenderFrameHostImpl::InvalidateMojoConnection() {
+  service_registry_.reset();
+#if defined(OS_ANDROID)
+  service_registry_android_.reset();
+#endif
+}
+
 void RenderFrameHostImpl::PlatformNotificationPermissionRequestDone(
     int request_id, blink::WebNotificationPermission permission) {
   Send(new PlatformNotificationMsg_PermissionRequestComplete(

content/browser/frame_host/render_frame_host_impl.h

@@ -363,6 +363,14 @@ class CONTENT_EXPORT RenderFrameHostImpl
                         const CommonNavigationParams& common_params,
                         const CommitNavigationParams& commit_params);
 
+  // Sets up the Mojo connection between this instance and its associated render
+  // frame if it has not yet been set up.
+  void SetUpMojoIfNeeded();
+
+  // Tears down the browser-side state relating to the Mojo connection between
+  // this instance and its associated render frame.
+  void InvalidateMojoConnection();
+
  protected:
   friend class RenderFrameHostFactory;
 
@@ -558,7 +566,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // SiteInstance.
   scoped_ptr<TimeoutMonitor> swapout_event_monitor_timeout_;
 
-  ServiceRegistryImpl service_registry_;
+  scoped_ptr<ServiceRegistryImpl> service_registry_;
 
 #if defined(OS_ANDROID)
   scoped_ptr<ServiceRegistryAndroid> service_registry_android_;

content/browser/frame_host/render_frame_host_manager.cc

@@ -186,6 +186,15 @@ RenderFrameHostImpl* RenderFrameHostManager::Navigate(
   // If the renderer crashed, then try to create a new one to satisfy this
   // navigation request.
   if (!dest_render_frame_host->IsRenderFrameLive()) {
+    // Instruct the destination render frame host to set up a Mojo connection
+    // with the new render frame if necessary.  Note that this call needs to
+    // occur before initializing the RenderView; the flow of creating the
+    // RenderView can cause browser-side code to execute that expects the this
+    // RFH's ServiceRegistry to be initialized (e.g., if the site is a WebUI
+    // site that is handled via Mojo, then Mojo WebUI code in //chrome will
+    // add a service to this RFH's ServiceRegistry).
+    dest_render_frame_host->SetUpMojoIfNeeded();
+
     // Recreate the opener chain.
     int opener_route_id = delegate_->CreateOpenerRenderViewsForRenderManager(
         dest_render_frame_host->GetSiteInstance());