Set correct value of RemoteFrameClientImpl::BackForwardLength

Plumb the correct value of BackForwardLength, which was already
available on WebViewImpl, instead of using a hardcoded value.
This allows popups with the noopener tag to close
themselves.

Test: SitePerProcessBrowserTest.CloseNoopenerWindow
Bug: 1170631
Change-Id: I718b5c32ba03dfde8412cb652ae269575aa33b89
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2940347
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Commit-Queue: Sharon Yang <yangsharon@chromium.org>
Cr-Commit-Position: refs/heads/master@{#890898}

content/browser/site_per_process_browsertest.cc

@@ -14909,6 +14909,37 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessBrowserTest,
           "from accessing a cross-origin frame."));
 }
 
+// Make sure that a popup with a cross site subframe can be closed from the
+// subframe.
+IN_PROC_BROWSER_TEST_P(SitePerProcessBrowserTest, CloseNoopenerWindow) {
+  GURL main_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  // Open a same site popup with a subframe using the noopener ref.
+  GURL popup_url(
+      embedded_test_server()->GetURL("a.com", "/page_with_blank_iframe.html"));
+  ShellAddedObserver new_shell_observer;
+  EXPECT_TRUE(ExecJs(
+      shell(),
+      JsReplace("popup = window.open($1,'_blank','noopener');", popup_url)));
+  Shell* popup = new_shell_observer.GetShell();
+  WebContentsImpl* popup_web_contents =
+      static_cast<WebContentsImpl*>(popup->web_contents());
+  FrameTreeNode* popup_root = popup_web_contents->GetFrameTree()->root();
+  EXPECT_TRUE(WaitForLoadStop(popup_web_contents));
+
+  // Navigate the popup subframe cross site to b.com.
+  FrameTreeNode* child = popup_root->child_at(0);
+  GURL cross_origin_url(
+      embedded_test_server()->GetURL("b.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURLFromRenderer(child, cross_origin_url));
+
+  // Check that the popup successfully closes from the subframe.
+  WebContentsDestroyedWatcher destroyed_watcher(popup->web_contents());
+  EXPECT_TRUE(ExecJs(child, "window.parent.close()"));
+  destroyed_watcher.Wait();
+}
+
 class SitePerProcessCompositorViewportBrowserTest
     : public SitePerProcessBrowserTestBase,
       public testing::WithParamInterface<double> {

content/browser/site_per_process_browsertest.h

@@ -23,6 +23,10 @@ class SitePerProcessBrowserTestBase : public ContentBrowserTest {
  public:
   SitePerProcessBrowserTestBase();
 
+  SitePerProcessBrowserTestBase(const SitePerProcessBrowserTestBase&) = delete;
+  SitePerProcessBrowserTestBase& operator=(
+      const SitePerProcessBrowserTestBase&) = delete;
+
  protected:
   std::string DepictFrameTree(FrameTreeNode* node);
 
@@ -42,8 +46,6 @@ class SitePerProcessBrowserTestBase : public ContentBrowserTest {
  private:
   FrameTreeVisualizer visualizer_;
   base::test::ScopedFeatureList feature_list_;
-
-  DISALLOW_COPY_AND_ASSIGN(SitePerProcessBrowserTestBase);
 };
 
 class SitePerProcessBrowserTest
@@ -52,12 +54,14 @@ class SitePerProcessBrowserTest
  public:
   SitePerProcessBrowserTest();
 
+  SitePerProcessBrowserTest(const SitePerProcessBrowserTest&) = delete;
+  SitePerProcessBrowserTest& operator=(const SitePerProcessBrowserTest&) =
+      delete;
+
   std::string GetExpectedOrigin(const std::string& host);
 
  private:
   base::test::ScopedFeatureList feature_list_;
-
-  DISALLOW_COPY_AND_ASSIGN(SitePerProcessBrowserTest);
 };
 
 }  // namespace content

third_party/blink/renderer/core/exported/web_view_impl.h

@@ -215,6 +215,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,
   void IncreaseHistoryListFromNavigation() override;
   int32_t HistoryBackListCount() const override;
   int32_t HistoryForwardListCount() const override;
+  int32_t HistoryListLength() const { return history_list_length_; }
   const SessionStorageNamespaceId& GetSessionStorageNamespaceId() override;
 
   // Functions to add and remove observers for this object.
@@ -896,6 +897,13 @@ class CORE_EXPORT WebViewImpl final : public WebView,
   base::WeakPtrFactory<WebViewImpl> weak_ptr_factory_{this};
 };
 
+// WebView is always implemented by WebViewImpl, so explicitly allow the
+// downcast.
+template <>
+struct DowncastTraits<WebViewImpl> {
+  static bool AllowFrom(const WebView& web_view) { return true; }
+};
+
 }  // namespace blink
 
 #endif  // THIRD_PARTY_BLINK_RENDERER_CORE_EXPORTED_WEB_VIEW_IMPL_H_

third_party/blink/renderer/core/frame/local_frame_client_impl.cc

@@ -917,10 +917,7 @@ void LocalFrameClientImpl::DispatchDidChangeManifest() {
 
 unsigned LocalFrameClientImpl::BackForwardLength() {
   WebViewImpl* webview = web_frame_->ViewImpl();
-  if (!webview)
-    return 0;
-  return webview->HistoryBackListCount() + 1 +
-         webview->HistoryForwardListCount();
+  return webview ? webview->HistoryListLength() : 0;
 }
 
 BlameContext* LocalFrameClientImpl::GetFrameBlameContext() {

third_party/blink/renderer/core/frame/remote_frame_client_impl.cc

@@ -15,6 +15,7 @@
 #include "third_party/blink/renderer/core/events/mouse_event.h"
 #include "third_party/blink/renderer/core/events/web_input_event_conversion.h"
 #include "third_party/blink/renderer/core/events/wheel_event.h"
+#include "third_party/blink/renderer/core/exported/web_view_impl.h"
 #include "third_party/blink/renderer/core/frame/remote_frame.h"
 #include "third_party/blink/renderer/core/frame/remote_frame_view.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
@@ -65,11 +66,7 @@ void RemoteFrameClientImpl::Detached(FrameDetachType type) {
 }
 
 unsigned RemoteFrameClientImpl::BackForwardLength() {
-  // TODO(creis,japhet): This method should return the real value for the
-  // session history length. For now, return static value for the initial
-  // navigation and the subsequent one moving the frame out-of-process.
-  // See https://crbug.com/501116.
-  return 2;
+  return To<WebViewImpl>(web_frame_->View())->HistoryListLength();
 }
 
 AssociatedInterfaceProvider*