content/browser/frame_host/render_frame_host_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/frame_host/render_frame_host_impl.h"
   6
   7 #include "base/bind.h"
   8 #include "base/containers/hash_tables.h"
   9 #include "base/lazy_instance.h"
  10 #include "base/metrics/histogram.h"
  11 #include "base/metrics/user_metrics_action.h"
  12 #include "base/time/time.h"
  13 #include "content/browser/accessibility/accessibility_mode_helper.h"
  14 #include "content/browser/accessibility/browser_accessibility_manager.h"
  15 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
  16 #include "content/browser/child_process_security_policy_impl.h"
  17 #include "content/browser/cross_site_request_manager.h"
  18 #include "content/browser/frame_host/cross_process_frame_connector.h"
  19 #include "content/browser/frame_host/cross_site_transferring_request.h"
  20 #include "content/browser/frame_host/frame_tree.h"
  21 #include "content/browser/frame_host/frame_tree_node.h"
  22 #include "content/browser/frame_host/navigator.h"
  23 #include "content/browser/frame_host/render_frame_host_delegate.h"
  24 #include "content/browser/frame_host/render_frame_proxy_host.h"
  25 #include "content/browser/renderer_host/input/input_router.h"
  26 #include "content/browser/renderer_host/input/timeout_monitor.h"
  27 #include "content/browser/renderer_host/render_process_host_impl.h"
  28 #include "content/browser/renderer_host/render_view_host_impl.h"
  29 #include "content/browser/renderer_host/render_widget_host_impl.h"
  30 #include "content/browser/renderer_host/render_widget_host_view_base.h"
  31 #include "content/browser/transition_request_manager.h"
  32 #include "content/common/accessibility_messages.h"
  33 #include "content/common/desktop_notification_messages.h"
  34 #include "content/common/frame_messages.h"
  35 #include "content/common/input_messages.h"
  36 #include "content/common/inter_process_time_ticks_converter.h"
  37 #include "content/common/platform_notification_messages.h"
  38 #include "content/common/render_frame_setup.mojom.h"
  39 #include "content/common/swapped_out_messages.h"
  40 #include "content/public/browser/ax_event_notification_details.h"
  41 #include "content/public/browser/browser_accessibility_state.h"
  42 #include "content/public/browser/browser_thread.h"
  43 #include "content/public/browser/content_browser_client.h"
  44 #include "content/public/browser/desktop_notification_delegate.h"
  45 #include "content/public/browser/render_process_host.h"
  46 #include "content/public/browser/render_widget_host_view.h"
  47 #include "content/public/browser/user_metrics.h"
  48 #include "content/public/common/content_constants.h"
  49 #include "content/public/common/url_constants.h"
  50 #include "content/public/common/url_utils.h"
  51 #include "ui/accessibility/ax_tree.h"
  52 #include "url/gurl.h"
  53
  54 using base::TimeDelta;
  55
  56 namespace content {
  57
  58 namespace {
  59
  60 // The (process id, routing id) pair that identifies one RenderFrame.
  61 typedef std::pair<int32, int32> RenderFrameHostID;
  62 typedef base::hash_map<RenderFrameHostID, RenderFrameHostImpl*>
  63     RoutingIDFrameMap;
  64 base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
  65     LAZY_INSTANCE_INITIALIZER;
  66
  67 class DesktopNotificationDelegateImpl : public DesktopNotificationDelegate {
  68  public:
  69   DesktopNotificationDelegateImpl(RenderFrameHost* render_frame_host,
  70                                   int notification_id)
  71       : render_process_id_(render_frame_host->GetProcess()->GetID()),
  72         render_frame_id_(render_frame_host->GetRoutingID()),
  73         notification_id_(notification_id) {}
  74
  75   virtual ~DesktopNotificationDelegateImpl() {}
  76
  77   virtual void NotificationDisplayed() OVERRIDE {
  78     RenderFrameHost* rfh =
  79         RenderFrameHost::FromID(render_process_id_, render_frame_id_);
  80     if (!rfh)
  81       return;
  82
  83     rfh->Send(new DesktopNotificationMsg_PostDisplay(
  84         rfh->GetRoutingID(), notification_id_));
  85   }
  86
  87   virtual void NotificationError() OVERRIDE {
  88     RenderFrameHost* rfh =
  89         RenderFrameHost::FromID(render_process_id_, render_frame_id_);
  90     if (!rfh)
  91       return;
  92
  93     rfh->Send(new DesktopNotificationMsg_PostError(
  94         rfh->GetRoutingID(), notification_id_));
  95   }
  96
  97   virtual void NotificationClosed(bool by_user) OVERRIDE {
  98     RenderFrameHost* rfh =
  99         RenderFrameHost::FromID(render_process_id_, render_frame_id_);
 100     if (!rfh)
 101       return;
 102
 103     rfh->Send(new DesktopNotificationMsg_PostClose(
 104         rfh->GetRoutingID(), notification_id_, by_user));
 105     static_cast<RenderFrameHostImpl*>(rfh)->NotificationClosed(
 106         notification_id_);
 107   }
 108
 109   virtual void NotificationClick() OVERRIDE {
 110     RenderFrameHost* rfh =
 111         RenderFrameHost::FromID(render_process_id_, render_frame_id_);
 112     if (!rfh)
 113       return;
 114
 115     rfh->Send(new DesktopNotificationMsg_PostClick(
 116         rfh->GetRoutingID(), notification_id_));
 117   }
 118
 119  private:
 120   int render_process_id_;
 121   int render_frame_id_;
 122   int notification_id_;
 123 };
 124
 125 // Translate a WebKit text direction into a base::i18n one.
 126 base::i18n::TextDirection WebTextDirectionToChromeTextDirection(
 127     blink::WebTextDirection dir) {
 128   switch (dir) {
 129     case blink::WebTextDirectionLeftToRight:
 130       return base::i18n::LEFT_TO_RIGHT;
 131     case blink::WebTextDirectionRightToLeft:
 132       return base::i18n::RIGHT_TO_LEFT;
 133     default:
 134       NOTREACHED();
 135       return base::i18n::UNKNOWN_DIRECTION;
 136   }
 137 }
 138
 139 }  // namespace
 140
 141 RenderFrameHost* RenderFrameHost::FromID(int render_process_id,
 142                                          int render_frame_id) {
 143   return RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
 144 }
 145
 146 // static
 147 RenderFrameHostImpl* RenderFrameHostImpl::FromID(int process_id,
 148                                                  int routing_id) {
 149   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 150   RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer();
 151   RoutingIDFrameMap::iterator it = frames->find(
 152       RenderFrameHostID(process_id, routing_id));
 153   return it == frames->end() ? NULL : it->second;
 154 }
 155
 156 RenderFrameHostImpl::RenderFrameHostImpl(RenderViewHostImpl* render_view_host,
 157                                          RenderFrameHostDelegate* delegate,
 158                                          FrameTree* frame_tree,
 159                                          FrameTreeNode* frame_tree_node,
 160                                          int routing_id,
 161                                          bool is_swapped_out)
 162     : render_view_host_(render_view_host),
 163       delegate_(delegate),
 164       cross_process_frame_connector_(NULL),
 165       render_frame_proxy_host_(NULL),
 166       frame_tree_(frame_tree),
 167       frame_tree_node_(frame_tree_node),
 168       routing_id_(routing_id),
 169       is_swapped_out_(is_swapped_out),
 170       renderer_initialized_(false),
 171       navigations_suspended_(false),
 172       weak_ptr_factory_(this) {
 173   frame_tree_->RegisterRenderFrameHost(this);
 174   GetProcess()->AddRoute(routing_id_, this);
 175   g_routing_id_frame_map.Get().insert(std::make_pair(
 176       RenderFrameHostID(GetProcess()->GetID(), routing_id_),
 177       this));
 178
 179   if (GetProcess()->GetServiceRegistry()) {
 180     RenderFrameSetupPtr setup;
 181     GetProcess()->GetServiceRegistry()->ConnectToRemoteService(&setup);
 182     mojo::ServiceProviderPtr service_provider;
 183     setup->GetServiceProviderForFrame(routing_id_,
 184                                       mojo::Get(&service_provider));
 185     service_registry_.BindRemoteServiceProvider(
 186         service_provider.PassMessagePipe());
 187   }
 188 }
 189
 190 RenderFrameHostImpl::~RenderFrameHostImpl() {
 191   GetProcess()->RemoveRoute(routing_id_);
 192   g_routing_id_frame_map.Get().erase(
 193       RenderFrameHostID(GetProcess()->GetID(), routing_id_));
 194   // Clean up any leftover state from cross-site requests.
 195   CrossSiteRequestManager::GetInstance()->SetHasPendingCrossSiteRequest(
 196       GetProcess()->GetID(), routing_id_, false);
 197
 198   if (delegate_)
 199     delegate_->RenderFrameDeleted(this);
 200
 201   // Notify the FrameTree that this RFH is going away, allowing it to shut down
 202   // the corresponding RenderViewHost if it is no longer needed.
 203   frame_tree_->UnregisterRenderFrameHost(this);
 204 }
 205
 206 int RenderFrameHostImpl::GetRoutingID() {
 207   return routing_id_;
 208 }
 209
 210 SiteInstance* RenderFrameHostImpl::GetSiteInstance() {
 211   return render_view_host_->GetSiteInstance();
 212 }
 213
 214 RenderProcessHost* RenderFrameHostImpl::GetProcess() {
 215   // TODO(nasko): This should return its own process, once we have working
 216   // cross-process navigation for subframes.
 217   return render_view_host_->GetProcess();
 218 }
 219
 220 RenderFrameHost* RenderFrameHostImpl::GetParent() {
 221   FrameTreeNode* parent_node = frame_tree_node_->parent();
 222   if (!parent_node)
 223     return NULL;
 224   return parent_node->current_frame_host();
 225 }
 226
 227 const std::string& RenderFrameHostImpl::GetFrameName() {
 228   return frame_tree_node_->frame_name();
 229 }
 230
 231 bool RenderFrameHostImpl::IsCrossProcessSubframe() {
 232   FrameTreeNode* parent_node = frame_tree_node_->parent();
 233   if (!parent_node)
 234     return false;
 235   return GetSiteInstance() !=
 236       parent_node->current_frame_host()->GetSiteInstance();
 237 }
 238
 239 GURL RenderFrameHostImpl::GetLastCommittedURL() {
 240   return frame_tree_node_->current_url();
 241 }
 242
 243 gfx::NativeView RenderFrameHostImpl::GetNativeView() {
 244   RenderWidgetHostView* view = render_view_host_->GetView();
 245   if (!view)
 246     return NULL;
 247   return view->GetNativeView();
 248 }
 249
 250 void RenderFrameHostImpl::ExecuteJavaScript(
 251     const base::string16& javascript) {
 252   Send(new FrameMsg_JavaScriptExecuteRequest(routing_id_,
 253                                              javascript,
 254                                              0, false));
 255 }
 256
 257 void RenderFrameHostImpl::ExecuteJavaScript(
 258      const base::string16& javascript,
 259      const JavaScriptResultCallback& callback) {
 260   static int next_id = 1;
 261   int key = next_id++;
 262   Send(new FrameMsg_JavaScriptExecuteRequest(routing_id_,
 263                                              javascript,
 264                                              key, true));
 265   javascript_callbacks_.insert(std::make_pair(key, callback));
 266 }
 267
 268 RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() {
 269   return render_view_host_;
 270 }
 271
 272 ServiceRegistry* RenderFrameHostImpl::GetServiceRegistry() {
 273   static_cast<RenderProcessHostImpl*>(GetProcess())->EnsureMojoActivated();
 274   return &service_registry_;
 275 }
 276
 277 bool RenderFrameHostImpl::Send(IPC::Message* message) {
 278   if (IPC_MESSAGE_ID_CLASS(message->type()) == InputMsgStart) {
 279     return render_view_host_->input_router()->SendInput(
 280         make_scoped_ptr(message));
 281   }
 282
 283   // Route IPCs through the RenderFrameProxyHost when in swapped out state.
 284   // Note: For subframes in --site-per-process mode, we don't use swapped out
 285   // RenderFrameHosts.
 286   if (frame_tree_node_->IsMainFrame() && render_view_host_->IsSwappedOut()) {
 287     DCHECK(render_frame_proxy_host_);
 288     return render_frame_proxy_host_->Send(message);
 289   }
 290
 291   return GetProcess()->Send(message);
 292 }
 293
 294 bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
 295   // Filter out most IPC messages if this renderer is swapped out.
 296   // We still want to handle certain ACKs to keep our state consistent.
 297   // TODO(nasko): Only check RenderViewHost state, as this object's own state
 298   // isn't yet properly updated. Transition this check once the swapped out
 299   // state is correct in RenderFrameHost itself.
 300   if (render_view_host_->IsSwappedOut()) {
 301     if (!SwappedOutMessages::CanHandleWhileSwappedOut(msg)) {
 302       // If this is a synchronous message and we decided not to handle it,
 303       // we must send an error reply, or else the renderer will be stuck
 304       // and won't respond to future requests.
 305       if (msg.is_sync()) {
 306         IPC::Message* reply = IPC::SyncMessage::GenerateReply(&msg);
 307         reply->set_reply_error();
 308         Send(reply);
 309       }
 310       // Don't continue looking for someone to handle it.
 311       return true;
 312     }
 313   }
 314
 315   if (delegate_->OnMessageReceived(this, msg))
 316     return true;
 317
 318   RenderFrameProxyHost* proxy =
 319       frame_tree_node_->render_manager()->GetProxyToParent();
 320   if (proxy && proxy->cross_process_frame_connector() &&
 321       proxy->cross_process_frame_connector()->OnMessageReceived(msg))
 322     return true;
 323
 324   bool handled = true;
 325   IPC_BEGIN_MESSAGE_MAP(RenderFrameHostImpl, msg)
 326     IPC_MESSAGE_HANDLER(FrameHostMsg_AddMessageToConsole, OnAddMessageToConsole)
 327     IPC_MESSAGE_HANDLER(FrameHostMsg_Detach, OnDetach)
 328     IPC_MESSAGE_HANDLER(FrameHostMsg_FrameFocused, OnFrameFocused)
 329     IPC_MESSAGE_HANDLER(FrameHostMsg_DidStartProvisionalLoadForFrame,
 330                         OnDidStartProvisionalLoadForFrame)
 331     IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailProvisionalLoadWithError,
 332                         OnDidFailProvisionalLoadWithError)
 333     IPC_MESSAGE_HANDLER(FrameHostMsg_DidRedirectProvisionalLoad,
 334                         OnDidRedirectProvisionalLoad)
 335     IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailLoadWithError,
 336                         OnDidFailLoadWithError)
 337     IPC_MESSAGE_HANDLER_GENERIC(FrameHostMsg_DidCommitProvisionalLoad,
 338                                 OnNavigate(msg))
 339     IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL)
 340     IPC_MESSAGE_HANDLER(FrameHostMsg_DocumentOnLoadCompleted,
 341                         OnDocumentOnLoadCompleted)
 342     IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK)
 343     IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK)
 344     IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu)
 345     IPC_MESSAGE_HANDLER(FrameHostMsg_JavaScriptExecuteResponse,
 346                         OnJavaScriptExecuteResponse)
 347     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage,
 348                                     OnRunJavaScriptMessage)
 349     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm,
 350                                     OnRunBeforeUnloadConfirm)
 351     IPC_MESSAGE_HANDLER(FrameHostMsg_DidAccessInitialDocument,
 352                         OnDidAccessInitialDocument)
 353     IPC_MESSAGE_HANDLER(FrameHostMsg_DidDisownOpener, OnDidDisownOpener)
 354     IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateTitle, OnUpdateTitle)
 355     IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateEncoding, OnUpdateEncoding)
 356     IPC_MESSAGE_HANDLER(FrameHostMsg_BeginNavigation,
 357                         OnBeginNavigation)
 358     IPC_MESSAGE_HANDLER(PlatformNotificationHostMsg_RequestPermission,
 359                         OnRequestPlatformNotificationPermission)
 360     IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show,
 361                         OnShowDesktopNotification)
 362     IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel,
 363                         OnCancelDesktopNotification)
 364     IPC_MESSAGE_HANDLER(FrameHostMsg_TextSurroundingSelectionResponse,
 365                         OnTextSurroundingSelectionResponse)
 366     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_Events, OnAccessibilityEvents)
 367     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_LocationChanges,
 368                         OnAccessibilityLocationChanges)
 369   IPC_END_MESSAGE_MAP()
 370
 371   return handled;
 372 }
 373
 374 void RenderFrameHostImpl::AccessibilitySetFocus(int object_id) {
 375   Send(new AccessibilityMsg_SetFocus(routing_id_, object_id));
 376 }
 377
 378 void RenderFrameHostImpl::AccessibilityDoDefaultAction(int object_id) {
 379   Send(new AccessibilityMsg_DoDefaultAction(routing_id_, object_id));
 380 }
 381
 382 void RenderFrameHostImpl::AccessibilityShowMenu(
 383     const gfx::Point& global_point) {
 384   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 385       render_view_host_->GetView());
 386   if (view)
 387     view->AccessibilityShowMenu(global_point);
 388 }
 389
 390 void RenderFrameHostImpl::AccessibilityScrollToMakeVisible(
 391     int acc_obj_id, const gfx::Rect& subfocus) {
 392   Send(new AccessibilityMsg_ScrollToMakeVisible(
 393       routing_id_, acc_obj_id, subfocus));
 394 }
 395
 396 void RenderFrameHostImpl::AccessibilityScrollToPoint(
 397     int acc_obj_id, const gfx::Point& point) {
 398   Send(new AccessibilityMsg_ScrollToPoint(
 399       routing_id_, acc_obj_id, point));
 400 }
 401
 402 void RenderFrameHostImpl::AccessibilitySetTextSelection(
 403     int object_id, int start_offset, int end_offset) {
 404   Send(new AccessibilityMsg_SetTextSelection(
 405       routing_id_, object_id, start_offset, end_offset));
 406 }
 407
 408 bool RenderFrameHostImpl::AccessibilityViewHasFocus() const {
 409   RenderWidgetHostView* view = render_view_host_->GetView();
 410   if (view)
 411     return view->HasFocus();
 412   return false;
 413 }
 414
 415 gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
 416   RenderWidgetHostView* view = render_view_host_->GetView();
 417   if (view)
 418     return view->GetViewBounds();
 419   return gfx::Rect();
 420 }
 421
 422 gfx::Point RenderFrameHostImpl::AccessibilityOriginInScreen(
 423     const gfx::Rect& bounds) const {
 424   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 425       render_view_host_->GetView());
 426   if (view)
 427     return view->AccessibilityOriginInScreen(bounds);
 428   return gfx::Point();
 429 }
 430
 431 void RenderFrameHostImpl::AccessibilityHitTest(const gfx::Point& point) {
 432   Send(new AccessibilityMsg_HitTest(routing_id_, point));
 433 }
 434
 435 void RenderFrameHostImpl::AccessibilityFatalError() {
 436   Send(new AccessibilityMsg_FatalError(routing_id_));
 437   browser_accessibility_manager_.reset(NULL);
 438 }
 439
 440 gfx::AcceleratedWidget
 441     RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
 442   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 443       render_view_host_->GetView());
 444   if (view)
 445     return view->AccessibilityGetAcceleratedWidget();
 446   return gfx::kNullAcceleratedWidget;
 447 }
 448
 449 gfx::NativeViewAccessible
 450     RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
 451   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 452       render_view_host_->GetView());
 453   if (view)
 454     return view->AccessibilityGetNativeViewAccessible();
 455   return NULL;
 456 }
 457
 458 bool RenderFrameHostImpl::CreateRenderFrame(int parent_routing_id) {
 459   TRACE_EVENT0("frame_host", "RenderFrameHostImpl::CreateRenderFrame");
 460   DCHECK(!IsRenderFrameLive()) << "Creating frame twice";
 461
 462   // The process may (if we're sharing a process with another host that already
 463   // initialized it) or may not (we have our own process or the old process
 464   // crashed) have been initialized. Calling Init multiple times will be
 465   // ignored, so this is safe.
 466   if (!GetProcess()->Init())
 467     return false;
 468
 469   DCHECK(GetProcess()->HasConnection());
 470
 471   renderer_initialized_ = true;
 472   Send(new FrameMsg_NewFrame(routing_id_, parent_routing_id));
 473
 474   return true;
 475 }
 476
 477 bool RenderFrameHostImpl::IsRenderFrameLive() {
 478   return GetProcess()->HasConnection() && renderer_initialized_;
 479 }
 480
 481 void RenderFrameHostImpl::Init() {
 482   GetProcess()->ResumeRequestsForView(routing_id_);
 483 }
 484
 485 void RenderFrameHostImpl::OnAddMessageToConsole(
 486     int32 level,
 487     const base::string16& message,
 488     int32 line_no,
 489     const base::string16& source_id) {
 490   if (delegate_->AddMessageToConsole(level, message, line_no, source_id))
 491     return;
 492
 493   // Pass through log level only on WebUI pages to limit console spew.
 494   int32 resolved_level =
 495       HasWebUIScheme(delegate_->GetMainFrameLastCommittedURL()) ? level : 0;
 496
 497   if (resolved_level >= ::logging::GetMinLogLevel()) {
 498     logging::LogMessage("CONSOLE", line_no, resolved_level).stream() << "\"" <<
 499         message << "\", source: " << source_id << " (" << line_no << ")";
 500   }
 501 }
 502
 503 void RenderFrameHostImpl::OnCreateChildFrame(int new_routing_id,
 504                                              const std::string& frame_name) {
 505   RenderFrameHostImpl* new_frame = frame_tree_->AddFrame(
 506       frame_tree_node_, new_routing_id, frame_name);
 507   if (delegate_)
 508     delegate_->RenderFrameCreated(new_frame);
 509 }
 510
 511 void RenderFrameHostImpl::OnDetach() {
 512   frame_tree_->RemoveFrame(frame_tree_node_);
 513 }
 514
 515 void RenderFrameHostImpl::OnFrameFocused() {
 516   frame_tree_->SetFocusedFrame(frame_tree_node_);
 517 }
 518
 519 void RenderFrameHostImpl::OnOpenURL(
 520     const FrameHostMsg_OpenURL_Params& params) {
 521   GURL validated_url(params.url);
 522   GetProcess()->FilterURL(false, &validated_url);
 523
 524   frame_tree_node_->navigator()->RequestOpenURL(
 525       this, validated_url, params.referrer, params.disposition,
 526       params.should_replace_current_entry, params.user_gesture);
 527 }
 528
 529 void RenderFrameHostImpl::OnDocumentOnLoadCompleted() {
 530   // This message is only sent for top-level frames. TODO(avi): when frame tree
 531   // mirroring works correctly, add a check here to enforce it.
 532   delegate_->DocumentOnLoadCompleted(this);
 533 }
 534
 535 void RenderFrameHostImpl::OnDidStartProvisionalLoadForFrame(
 536     const GURL& url,
 537     bool is_transition_navigation) {
 538   frame_tree_node_->navigator()->DidStartProvisionalLoad(
 539       this, url, is_transition_navigation);
 540 }
 541
 542 void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
 543     const FrameHostMsg_DidFailProvisionalLoadWithError_Params& params) {
 544   frame_tree_node_->navigator()->DidFailProvisionalLoadWithError(this, params);
 545 }
 546
 547 void RenderFrameHostImpl::OnDidFailLoadWithError(
 548     const GURL& url,
 549     int error_code,
 550     const base::string16& error_description) {
 551   GURL validated_url(url);
 552   GetProcess()->FilterURL(false, &validated_url);
 553
 554   frame_tree_node_->navigator()->DidFailLoadWithError(
 555       this, validated_url, error_code, error_description);
 556 }
 557
 558 void RenderFrameHostImpl::OnDidRedirectProvisionalLoad(
 559     int32 page_id,
 560     const GURL& source_url,
 561     const GURL& target_url) {
 562   CHECK_EQ(render_view_host_->page_id_, page_id);
 563   frame_tree_node_->navigator()->DidRedirectProvisionalLoad(
 564       this, render_view_host_->page_id_, source_url, target_url);
 565 }
 566
 567 // Called when the renderer navigates.  For every frame loaded, we'll get this
 568 // notification containing parameters identifying the navigation.
 569 //
 570 // Subframes are identified by the page transition type.  For subframes loaded
 571 // as part of a wider page load, the page_id will be the same as for the top
 572 // level frame.  If the user explicitly requests a subframe navigation, we will
 573 // get a new page_id because we need to create a new navigation entry for that
 574 // action.
 575 void RenderFrameHostImpl::OnNavigate(const IPC::Message& msg) {
 576   // Read the parameters out of the IPC message directly to avoid making another
 577   // copy when we filter the URLs.
 578   PickleIterator iter(msg);
 579   FrameHostMsg_DidCommitProvisionalLoad_Params validated_params;
 580   if (!IPC::ParamTraits<FrameHostMsg_DidCommitProvisionalLoad_Params>::
 581       Read(&msg, &iter, &validated_params))
 582     return;
 583
 584   // Update the RVH's current page ID so that future IPCs from the renderer
 585   // correspond to the new page.
 586   render_view_host_->page_id_ = validated_params.page_id;
 587
 588   // If we're waiting for a cross-site beforeunload ack from this renderer and
 589   // we receive a Navigate message from the main frame, then the renderer was
 590   // navigating already and sent it before hearing the ViewMsg_Stop message.
 591   // We do not want to cancel the pending navigation in this case, since the
 592   // old page will soon be stopped.  Instead, treat this as a beforeunload ack
 593   // to allow the pending navigation to continue.
 594   if (render_view_host_->is_waiting_for_beforeunload_ack_ &&
 595       render_view_host_->unload_ack_is_for_cross_site_transition_ &&
 596       PageTransitionIsMainFrame(validated_params.transition)) {
 597     OnBeforeUnloadACK(true, send_before_unload_start_time_,
 598                       base::TimeTicks::Now());
 599     return;
 600   }
 601
 602   // If we're waiting for an unload ack from this renderer and we receive a
 603   // Navigate message, then the renderer was navigating before it received the
 604   // unload request.  It will either respond to the unload request soon or our
 605   // timer will expire.  Either way, we should ignore this message, because we
 606   // have already committed to closing this renderer.
 607   if (render_view_host_->IsWaitingForUnloadACK())
 608     return;
 609
 610   RenderProcessHost* process = GetProcess();
 611
 612   // Attempts to commit certain off-limits URL should be caught more strictly
 613   // than our FilterURL checks below.  If a renderer violates this policy, it
 614   // should be killed.
 615   if (!CanCommitURL(validated_params.url)) {
 616     VLOG(1) << "Blocked URL " << validated_params.url.spec();
 617     validated_params.url = GURL(url::kAboutBlankURL);
 618     RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled"));
 619     // Kills the process.
 620     process->ReceivedBadMessage();
 621   }
 622
 623   // Without this check, an evil renderer can trick the browser into creating
 624   // a navigation entry for a banned URL.  If the user clicks the back button
 625   // followed by the forward button (or clicks reload, or round-trips through
 626   // session restore, etc), we'll think that the browser commanded the
 627   // renderer to load the URL and grant the renderer the privileges to request
 628   // the URL.  To prevent this attack, we block the renderer from inserting
 629   // banned URLs into the navigation controller in the first place.
 630   process->FilterURL(false, &validated_params.url);
 631   process->FilterURL(true, &validated_params.referrer.url);
 632   for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
 633       it != validated_params.redirects.end(); ++it) {
 634     process->FilterURL(false, &(*it));
 635   }
 636   process->FilterURL(true, &validated_params.searchable_form_url);
 637
 638   // Without this check, the renderer can trick the browser into using
 639   // filenames it can't access in a future session restore.
 640   if (!render_view_host_->CanAccessFilesOfPageState(
 641           validated_params.page_state)) {
 642     GetProcess()->ReceivedBadMessage();
 643     return;
 644   }
 645
 646   frame_tree_node()->navigator()->DidNavigate(this, validated_params);
 647 }
 648
 649 RenderWidgetHostImpl* RenderFrameHostImpl::GetRenderWidgetHost() {
 650   return static_cast<RenderWidgetHostImpl*>(render_view_host_);
 651 }
 652
 653 int RenderFrameHostImpl::GetEnabledBindings() {
 654   return render_view_host_->GetEnabledBindings();
 655 }
 656
 657 void RenderFrameHostImpl::OnCrossSiteResponse(
 658     const GlobalRequestID& global_request_id,
 659     scoped_ptr<CrossSiteTransferringRequest> cross_site_transferring_request,
 660     const std::vector<GURL>& transfer_url_chain,
 661     const Referrer& referrer,
 662     PageTransition page_transition,
 663     bool should_replace_current_entry) {
 664   frame_tree_node_->render_manager()->OnCrossSiteResponse(
 665       this, global_request_id, cross_site_transferring_request.Pass(),
 666       transfer_url_chain, referrer, page_transition,
 667       should_replace_current_entry);
 668 }
 669
 670 void RenderFrameHostImpl::OnDeferredAfterResponseStarted(
 671     const GlobalRequestID& global_request_id,
 672     const TransitionLayerData& transition_data) {
 673   frame_tree_node_->render_manager()->OnDeferredAfterResponseStarted(
 674       global_request_id, this);
 675
 676   if (GetParent() || !delegate_->WillHandleDeferAfterResponseStarted())
 677     frame_tree_node_->render_manager()->ResumeResponseDeferredAtStart();
 678   else
 679     delegate_->DidDeferAfterResponseStarted(transition_data);
 680 }
 681
 682 void RenderFrameHostImpl::SwapOut(RenderFrameProxyHost* proxy) {
 683   // TODO(creis): Move swapped out state to RFH.  Until then, only update it
 684   // when swapping out the main frame.
 685   if (!GetParent()) {
 686     // If this RenderViewHost is not in the default state, it must have already
 687     // gone through this, therefore just return.
 688     if (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT)
 689       return;
 690
 691     render_view_host_->SetState(
 692         RenderViewHostImpl::STATE_WAITING_FOR_UNLOAD_ACK);
 693     render_view_host_->unload_event_monitor_timeout_->Start(
 694         base::TimeDelta::FromMilliseconds(
 695             RenderViewHostImpl::kUnloadTimeoutMS));
 696   }
 697
 698   set_render_frame_proxy_host(proxy);
 699
 700   if (render_view_host_->IsRenderViewLive())
 701     Send(new FrameMsg_SwapOut(routing_id_, proxy->GetRoutingID()));
 702
 703   if (!GetParent())
 704     delegate_->SwappedOut(this);
 705
 706   // Allow the navigation to proceed.
 707   frame_tree_node_->render_manager()->SwappedOut(this);
 708 }
 709
 710 void RenderFrameHostImpl::OnBeforeUnloadACK(
 711     bool proceed,
 712     const base::TimeTicks& renderer_before_unload_start_time,
 713     const base::TimeTicks& renderer_before_unload_end_time) {
 714   // TODO(creis): Support properly beforeunload on subframes. For now just
 715   // pretend that the handler ran and allowed the navigation to proceed.
 716   if (GetParent()) {
 717     render_view_host_->is_waiting_for_beforeunload_ack_ = false;
 718     frame_tree_node_->render_manager()->OnBeforeUnloadACK(
 719         render_view_host_->unload_ack_is_for_cross_site_transition_, proceed,
 720         renderer_before_unload_end_time);
 721     return;
 722   }
 723
 724   render_view_host_->decrement_in_flight_event_count();
 725   render_view_host_->StopHangMonitorTimeout();
 726   // If this renderer navigated while the beforeunload request was in flight, we
 727   // may have cleared this state in OnNavigate, in which case we can ignore
 728   // this message.
 729   // However renderer might also be swapped out but we still want to proceed
 730   // with navigation, otherwise it would block future navigations. This can
 731   // happen when pending cross-site navigation is canceled by a second one just
 732   // before OnNavigate while current RVH is waiting for commit but second
 733   // navigation is started from the beginning.
 734   if (!render_view_host_->is_waiting_for_beforeunload_ack_) {
 735     return;
 736   }
 737
 738   render_view_host_->is_waiting_for_beforeunload_ack_ = false;
 739
 740   base::TimeTicks before_unload_end_time;
 741   if (!send_before_unload_start_time_.is_null() &&
 742       !renderer_before_unload_start_time.is_null() &&
 743       !renderer_before_unload_end_time.is_null()) {
 744     // When passing TimeTicks across process boundaries, we need to compensate
 745     // for any skew between the processes. Here we are converting the
 746     // renderer's notion of before_unload_end_time to TimeTicks in the browser
 747     // process. See comments in inter_process_time_ticks_converter.h for more.
 748     InterProcessTimeTicksConverter converter(
 749         LocalTimeTicks::FromTimeTicks(send_before_unload_start_time_),
 750         LocalTimeTicks::FromTimeTicks(base::TimeTicks::Now()),
 751         RemoteTimeTicks::FromTimeTicks(renderer_before_unload_start_time),
 752         RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
 753     LocalTimeTicks browser_before_unload_end_time =
 754         converter.ToLocalTimeTicks(
 755             RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
 756     before_unload_end_time = browser_before_unload_end_time.ToTimeTicks();
 757
 758     // Collect UMA on the inter-process skew.
 759     bool is_skew_additive = false;
 760     if (converter.IsSkewAdditiveForMetrics()) {
 761       is_skew_additive = true;
 762       base::TimeDelta skew = converter.GetSkewForMetrics();
 763       if (skew >= base::TimeDelta()) {
 764         UMA_HISTOGRAM_TIMES(
 765             "InterProcessTimeTicks.BrowserBehind_RendererToBrowser", skew);
 766       } else {
 767         UMA_HISTOGRAM_TIMES(
 768             "InterProcessTimeTicks.BrowserAhead_RendererToBrowser", -skew);
 769       }
 770     }
 771     UMA_HISTOGRAM_BOOLEAN(
 772         "InterProcessTimeTicks.IsSkewAdditive_RendererToBrowser",
 773         is_skew_additive);
 774   }
 775   frame_tree_node_->render_manager()->OnBeforeUnloadACK(
 776       render_view_host_->unload_ack_is_for_cross_site_transition_, proceed,
 777       before_unload_end_time);
 778
 779   // If canceled, notify the delegate to cancel its pending navigation entry.
 780   if (!proceed)
 781     render_view_host_->GetDelegate()->DidCancelLoading();
 782 }
 783
 784 void RenderFrameHostImpl::OnSwapOutACK() {
 785   OnSwappedOut(false);
 786 }
 787
 788 void RenderFrameHostImpl::OnSwappedOut(bool timed_out) {
 789   // For now, we only need to update the RVH state machine for top-level swaps.
 790   // Subframe swaps (in --site-per-process) can just continue via RFHM.
 791   if (!GetParent())
 792     render_view_host_->OnSwappedOut(timed_out);
 793   else
 794     frame_tree_node_->render_manager()->SwappedOut(this);
 795 }
 796
 797 void RenderFrameHostImpl::OnContextMenu(const ContextMenuParams& params) {
 798   // Validate the URLs in |params|.  If the renderer can't request the URLs
 799   // directly, don't show them in the context menu.
 800   ContextMenuParams validated_params(params);
 801   RenderProcessHost* process = GetProcess();
 802
 803   // We don't validate |unfiltered_link_url| so that this field can be used
 804   // when users want to copy the original link URL.
 805   process->FilterURL(true, &validated_params.link_url);
 806   process->FilterURL(true, &validated_params.src_url);
 807   process->FilterURL(false, &validated_params.page_url);
 808   process->FilterURL(true, &validated_params.frame_url);
 809
 810   delegate_->ShowContextMenu(this, validated_params);
 811 }
 812
 813 void RenderFrameHostImpl::OnJavaScriptExecuteResponse(
 814     int id, const base::ListValue& result) {
 815   const base::Value* result_value;
 816   if (!result.Get(0, &result_value)) {
 817     // Programming error or rogue renderer.
 818     NOTREACHED() << "Got bad arguments for OnJavaScriptExecuteResponse";
 819     return;
 820   }
 821
 822   std::map<int, JavaScriptResultCallback>::iterator it =
 823       javascript_callbacks_.find(id);
 824   if (it != javascript_callbacks_.end()) {
 825     it->second.Run(result_value);
 826     javascript_callbacks_.erase(it);
 827   } else {
 828     NOTREACHED() << "Received script response for unknown request";
 829   }
 830 }
 831
 832 void RenderFrameHostImpl::OnRunJavaScriptMessage(
 833     const base::string16& message,
 834     const base::string16& default_prompt,
 835     const GURL& frame_url,
 836     JavaScriptMessageType type,
 837     IPC::Message* reply_msg) {
 838   // While a JS message dialog is showing, tabs in the same process shouldn't
 839   // process input events.
 840   GetProcess()->SetIgnoreInputEvents(true);
 841   render_view_host_->StopHangMonitorTimeout();
 842   delegate_->RunJavaScriptMessage(this, message, default_prompt,
 843                                   frame_url, type, reply_msg);
 844 }
 845
 846 void RenderFrameHostImpl::OnRunBeforeUnloadConfirm(
 847     const GURL& frame_url,
 848     const base::string16& message,
 849     bool is_reload,
 850     IPC::Message* reply_msg) {
 851   // While a JS before unload dialog is showing, tabs in the same process
 852   // shouldn't process input events.
 853   GetProcess()->SetIgnoreInputEvents(true);
 854   render_view_host_->StopHangMonitorTimeout();
 855   delegate_->RunBeforeUnloadConfirm(this, message, is_reload, reply_msg);
 856 }
 857
 858 void RenderFrameHostImpl::OnRequestPlatformNotificationPermission(
 859     const GURL& origin, int request_id) {
 860   base::Callback<void(blink::WebNotificationPermission)> done_callback =
 861       base::Bind(
 862           &RenderFrameHostImpl::PlatformNotificationPermissionRequestDone,
 863           weak_ptr_factory_.GetWeakPtr(),
 864           request_id);
 865
 866   GetContentClient()->browser()->RequestDesktopNotificationPermission(
 867       origin, this, done_callback);
 868 }
 869
 870 void RenderFrameHostImpl::OnShowDesktopNotification(
 871     int notification_id,
 872     const ShowDesktopNotificationHostMsgParams& params) {
 873   scoped_ptr<DesktopNotificationDelegateImpl> delegate(
 874       new DesktopNotificationDelegateImpl(this, notification_id));
 875
 876   base::Closure cancel_callback;
 877   GetContentClient()->browser()->ShowDesktopNotification(
 878       params,
 879       this,
 880       delegate.PassAs<DesktopNotificationDelegate>(),
 881       &cancel_callback);
 882   cancel_notification_callbacks_[notification_id] = cancel_callback;
 883 }
 884
 885 void RenderFrameHostImpl::OnCancelDesktopNotification(int notification_id) {
 886   if (!cancel_notification_callbacks_.count(notification_id)) {
 887     NOTREACHED();
 888     return;
 889   }
 890   cancel_notification_callbacks_[notification_id].Run();
 891   cancel_notification_callbacks_.erase(notification_id);
 892 }
 893
 894 void RenderFrameHostImpl::OnTextSurroundingSelectionResponse(
 895     const base::string16& content,
 896     size_t start_offset,
 897     size_t end_offset) {
 898   render_view_host_->OnTextSurroundingSelectionResponse(
 899       content, start_offset, end_offset);
 900 }
 901
 902 void RenderFrameHostImpl::OnDidAccessInitialDocument() {
 903   delegate_->DidAccessInitialDocument();
 904 }
 905
 906 void RenderFrameHostImpl::OnDidDisownOpener() {
 907   // This message is only sent for top-level frames. TODO(avi): when frame tree
 908   // mirroring works correctly, add a check here to enforce it.
 909   delegate_->DidDisownOpener(this);
 910 }
 911
 912 void RenderFrameHostImpl::OnUpdateTitle(
 913     int32 page_id,
 914     const base::string16& title,
 915     blink::WebTextDirection title_direction) {
 916   CHECK_EQ(render_view_host_->page_id_, page_id);
 917   // This message is only sent for top-level frames. TODO(avi): when frame tree
 918   // mirroring works correctly, add a check here to enforce it.
 919   if (title.length() > kMaxTitleChars) {
 920     NOTREACHED() << "Renderer sent too many characters in title.";
 921     return;
 922   }
 923
 924   delegate_->UpdateTitle(this, render_view_host_->page_id_, title,
 925                          WebTextDirectionToChromeTextDirection(
 926                              title_direction));
 927 }
 928
 929 void RenderFrameHostImpl::OnUpdateEncoding(const std::string& encoding_name) {
 930   // This message is only sent for top-level frames. TODO(avi): when frame tree
 931   // mirroring works correctly, add a check here to enforce it.
 932   delegate_->UpdateEncoding(this, encoding_name);
 933 }
 934
 935 void RenderFrameHostImpl::OnBeginNavigation(
 936     const FrameHostMsg_BeginNavigation_Params& params) {
 937 #if defined(USE_BROWSER_SIDE_NAVIGATION)
 938   frame_tree_node()->render_manager()->OnBeginNavigation(params);
 939 #endif
 940 }
 941
 942 void RenderFrameHostImpl::OnAccessibilityEvents(
 943     const std::vector<AccessibilityHostMsg_EventParams>& params) {
 944   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 945       render_view_host_->GetView());
 946
 947   AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
 948   if ((accessibility_mode != AccessibilityModeOff) && view &&
 949       RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
 950     if (accessibility_mode & AccessibilityModeFlagPlatform) {
 951       GetOrCreateBrowserAccessibilityManager();
 952       if (browser_accessibility_manager_)
 953         browser_accessibility_manager_->OnAccessibilityEvents(params);
 954     }
 955
 956     std::vector<AXEventNotificationDetails> details;
 957     details.reserve(params.size());
 958     for (size_t i = 0; i < params.size(); ++i) {
 959       const AccessibilityHostMsg_EventParams& param = params[i];
 960       AXEventNotificationDetails detail(param.update.node_id_to_clear,
 961                                         param.update.nodes,
 962                                         param.event_type,
 963                                         param.id,
 964                                         GetProcess()->GetID(),
 965                                         routing_id_);
 966       details.push_back(detail);
 967     }
 968
 969     delegate_->AccessibilityEventReceived(details);
 970   }
 971
 972   // Always send an ACK or the renderer can be in a bad state.
 973   Send(new AccessibilityMsg_Events_ACK(routing_id_));
 974
 975   // The rest of this code is just for testing; bail out if we're not
 976   // in that mode.
 977   if (accessibility_testing_callback_.is_null())
 978     return;
 979
 980   for (size_t i = 0; i < params.size(); i++) {
 981     const AccessibilityHostMsg_EventParams& param = params[i];
 982     if (static_cast<int>(param.event_type) < 0)
 983       continue;
 984     if (!ax_tree_for_testing_) {
 985       ax_tree_for_testing_.reset(new ui::AXTree(param.update));
 986     } else {
 987       CHECK(ax_tree_for_testing_->Unserialize(param.update))
 988           << ax_tree_for_testing_->error();
 989     }
 990     accessibility_testing_callback_.Run(param.event_type, param.id);
 991   }
 992 }
 993
 994 void RenderFrameHostImpl::OnAccessibilityLocationChanges(
 995     const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
 996   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 997       render_view_host_->GetView());
 998   if (view &&
 999       RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
1000     AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
1001     if (accessibility_mode & AccessibilityModeFlagPlatform) {
1002       if (!browser_accessibility_manager_) {
1003         browser_accessibility_manager_.reset(
1004             view->CreateBrowserAccessibilityManager(this));
1005       }
1006       if (browser_accessibility_manager_)
1007         browser_accessibility_manager_->OnLocationChanges(params);
1008     }
1009     // TODO(aboxhall): send location change events to web contents observers too
1010   }
1011 }
1012
1013 void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) {
1014   render_view_host_->SetPendingShutdown(on_swap_out);
1015 }
1016
1017 bool RenderFrameHostImpl::CanCommitURL(const GURL& url) {
1018   // TODO(creis): We should also check for WebUI pages here.  Also, when the
1019   // out-of-process iframes implementation is ready, we should check for
1020   // cross-site URLs that are not allowed to commit in this process.
1021
1022   // Give the client a chance to disallow URLs from committing.
1023   return GetContentClient()->browser()->CanCommitURL(GetProcess(), url);
1024 }
1025
1026 void RenderFrameHostImpl::Navigate(const FrameMsg_Navigate_Params& params) {
1027   TRACE_EVENT0("frame_host", "RenderFrameHostImpl::Navigate");
1028   // Browser plugin guests are not allowed to navigate outside web-safe schemes,
1029   // so do not grant them the ability to request additional URLs.
1030   if (!GetProcess()->IsIsolatedGuest()) {
1031     ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
1032         GetProcess()->GetID(), params.url);
1033     if (params.url.SchemeIs(url::kDataScheme) &&
1034         params.base_url_for_data_url.SchemeIs(url::kFileScheme)) {
1035       // If 'data:' is used, and we have a 'file:' base url, grant access to
1036       // local files.
1037       ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
1038           GetProcess()->GetID(), params.base_url_for_data_url);
1039     }
1040   }
1041
1042   // Only send the message if we aren't suspended at the start of a cross-site
1043   // request.
1044   if (navigations_suspended_) {
1045     // Shouldn't be possible to have a second navigation while suspended, since
1046     // navigations will only be suspended during a cross-site request.  If a
1047     // second navigation occurs, RenderFrameHostManager will cancel this pending
1048     // RFH and create a new pending RFH.
1049     DCHECK(!suspended_nav_params_.get());
1050     suspended_nav_params_.reset(new FrameMsg_Navigate_Params(params));
1051   } else {
1052     // Get back to a clean state, in case we start a new navigation without
1053     // completing a RVH swap or unload handler.
1054     render_view_host_->SetState(RenderViewHostImpl::STATE_DEFAULT);
1055
1056     Send(new FrameMsg_Navigate(routing_id_, params));
1057   }
1058
1059   // Force the throbber to start. We do this because Blink's "started
1060   // loading" message will be received asynchronously from the UI of the
1061   // browser. But we want to keep the throbber in sync with what's happening
1062   // in the UI. For example, we want to start throbbing immediately when the
1063   // user naivgates even if the renderer is delayed. There is also an issue
1064   // with the throbber starting because the WebUI (which controls whether the
1065   // favicon is displayed) happens synchronously. If the start loading
1066   // messages was asynchronous, then the default favicon would flash in.
1067   //
1068   // Blink doesn't send throb notifications for JavaScript URLs, so we
1069   // don't want to either.
1070   if (!params.url.SchemeIs(url::kJavaScriptScheme))
1071     delegate_->DidStartLoading(this, true);
1072 }
1073
1074 void RenderFrameHostImpl::NavigateToURL(const GURL& url) {
1075   FrameMsg_Navigate_Params params;
1076   params.page_id = -1;
1077   params.pending_history_list_offset = -1;
1078   params.current_history_list_offset = -1;
1079   params.current_history_list_length = 0;
1080   params.url = url;
1081   params.transition = PAGE_TRANSITION_LINK;
1082   params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
1083   params.browser_navigation_start = base::TimeTicks::Now();
1084   Navigate(params);
1085 }
1086
1087 void RenderFrameHostImpl::DispatchBeforeUnload(bool for_cross_site_transition) {
1088   // TODO(creis): Support subframes.
1089   if (!render_view_host_->IsRenderViewLive() || GetParent()) {
1090     // We don't have a live renderer, so just skip running beforeunload.
1091     render_view_host_->is_waiting_for_beforeunload_ack_ = true;
1092     render_view_host_->unload_ack_is_for_cross_site_transition_ =
1093         for_cross_site_transition;
1094     base::TimeTicks now = base::TimeTicks::Now();
1095     OnBeforeUnloadACK(true, now, now);
1096     return;
1097   }
1098
1099   // This may be called more than once (if the user clicks the tab close button
1100   // several times, or if she clicks the tab close button then the browser close
1101   // button), and we only send the message once.
1102   if (render_view_host_->is_waiting_for_beforeunload_ack_) {
1103     // Some of our close messages could be for the tab, others for cross-site
1104     // transitions. We always want to think it's for closing the tab if any
1105     // of the messages were, since otherwise it might be impossible to close
1106     // (if there was a cross-site "close" request pending when the user clicked
1107     // the close button). We want to keep the "for cross site" flag only if
1108     // both the old and the new ones are also for cross site.
1109     render_view_host_->unload_ack_is_for_cross_site_transition_ =
1110         render_view_host_->unload_ack_is_for_cross_site_transition_ &&
1111         for_cross_site_transition;
1112   } else {
1113     // Start the hang monitor in case the renderer hangs in the beforeunload
1114     // handler.
1115     render_view_host_->is_waiting_for_beforeunload_ack_ = true;
1116     render_view_host_->unload_ack_is_for_cross_site_transition_ =
1117         for_cross_site_transition;
1118     // Increment the in-flight event count, to ensure that input events won't
1119     // cancel the timeout timer.
1120     render_view_host_->increment_in_flight_event_count();
1121     render_view_host_->StartHangMonitorTimeout(
1122         TimeDelta::FromMilliseconds(RenderViewHostImpl::kUnloadTimeoutMS));
1123     send_before_unload_start_time_ = base::TimeTicks::Now();
1124     Send(new FrameMsg_BeforeUnload(routing_id_));
1125   }
1126 }
1127
1128 void RenderFrameHostImpl::ExtendSelectionAndDelete(size_t before,
1129                                                    size_t after) {
1130   Send(new InputMsg_ExtendSelectionAndDelete(routing_id_, before, after));
1131 }
1132
1133 void RenderFrameHostImpl::JavaScriptDialogClosed(
1134     IPC::Message* reply_msg,
1135     bool success,
1136     const base::string16& user_input,
1137     bool dialog_was_suppressed) {
1138   GetProcess()->SetIgnoreInputEvents(false);
1139   bool is_waiting = render_view_host_->is_waiting_for_beforeunload_ack() ||
1140                     render_view_host_->IsWaitingForUnloadACK();
1141
1142   // If we are executing as part of (before)unload event handling, we don't
1143   // want to use the regular hung_renderer_delay_ms_ if the user has agreed to
1144   // leave the current page. In this case, use the regular timeout value used
1145   // during the (before)unload handling.
1146   if (is_waiting) {
1147     render_view_host_->StartHangMonitorTimeout(TimeDelta::FromMilliseconds(
1148         success ? RenderViewHostImpl::kUnloadTimeoutMS
1149                 : render_view_host_->hung_renderer_delay_ms_));
1150   }
1151
1152   FrameHostMsg_RunJavaScriptMessage::WriteReplyParams(reply_msg,
1153                                                       success, user_input);
1154   Send(reply_msg);
1155
1156   // If we are waiting for an unload or beforeunload ack and the user has
1157   // suppressed messages, kill the tab immediately; a page that's spamming
1158   // alerts in onbeforeunload is presumably malicious, so there's no point in
1159   // continuing to run its script and dragging out the process.
1160   // This must be done after sending the reply since RenderView can't close
1161   // correctly while waiting for a response.
1162   if (is_waiting && dialog_was_suppressed)
1163     render_view_host_->delegate_->RendererUnresponsive(
1164         render_view_host_,
1165         render_view_host_->is_waiting_for_beforeunload_ack(),
1166         render_view_host_->IsWaitingForUnloadACK());
1167 }
1168
1169 void RenderFrameHostImpl::NotificationClosed(int notification_id) {
1170   cancel_notification_callbacks_.erase(notification_id);
1171 }
1172
1173 bool RenderFrameHostImpl::HasPendingCrossSiteRequest() {
1174   return CrossSiteRequestManager::GetInstance()->HasPendingCrossSiteRequest(
1175       GetProcess()->GetID(), routing_id_);
1176 }
1177
1178 void RenderFrameHostImpl::SetHasPendingCrossSiteRequest(
1179     bool has_pending_request) {
1180   CrossSiteRequestManager::GetInstance()->SetHasPendingCrossSiteRequest(
1181       GetProcess()->GetID(), routing_id_, has_pending_request);
1182 }
1183
1184 void RenderFrameHostImpl::PlatformNotificationPermissionRequestDone(
1185     int request_id, blink::WebNotificationPermission permission) {
1186   Send(new PlatformNotificationMsg_PermissionRequestComplete(
1187       routing_id_, request_id, permission));
1188 }
1189
1190 void RenderFrameHostImpl::SetAccessibilityMode(AccessibilityMode mode) {
1191   Send(new FrameMsg_SetAccessibilityMode(routing_id_, mode));
1192 }
1193
1194 void RenderFrameHostImpl::SetAccessibilityCallbackForTesting(
1195     const base::Callback<void(ui::AXEvent, int)>& callback) {
1196   accessibility_testing_callback_ = callback;
1197 }
1198
1199 const ui::AXTree* RenderFrameHostImpl::GetAXTreeForTesting() {
1200   return ax_tree_for_testing_.get();
1201 }
1202
1203 BrowserAccessibilityManager*
1204     RenderFrameHostImpl::GetOrCreateBrowserAccessibilityManager() {
1205   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
1206       render_view_host_->GetView());
1207   if (view &&
1208       !browser_accessibility_manager_) {
1209     browser_accessibility_manager_.reset(
1210         view->CreateBrowserAccessibilityManager(this));
1211   }
1212   return browser_accessibility_manager_.get();
1213 }
1214
1215 #if defined(OS_WIN)
1216 void RenderFrameHostImpl::SetParentNativeViewAccessible(
1217     gfx::NativeViewAccessible accessible_parent) {
1218   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
1219       render_view_host_->GetView());
1220   if (view)
1221     view->SetParentNativeViewAccessible(accessible_parent);
1222 }
1223
1224 gfx::NativeViewAccessible
1225 RenderFrameHostImpl::GetParentNativeViewAccessible() const {
1226   return delegate_->GetParentNativeViewAccessible();
1227 }
1228 #endif  // defined(OS_WIN)
1229
1230 void RenderFrameHostImpl::ClearPendingTransitionRequestData() {
1231   BrowserThread::PostTask(
1232       BrowserThread::IO,
1233       FROM_HERE,
1234       base::Bind(
1235           &TransitionRequestManager::ClearPendingTransitionRequestData,
1236           base::Unretained(TransitionRequestManager::GetInstance()),
1237           GetProcess()->GetID(),
1238           routing_id_));
1239 }
1240
1241 void RenderFrameHostImpl::SetNavigationsSuspended(
1242     bool suspend,
1243     const base::TimeTicks& proceed_time) {
1244   // This should only be called to toggle the state.
1245   DCHECK(navigations_suspended_ != suspend);
1246
1247   navigations_suspended_ = suspend;
1248   if (!suspend && suspended_nav_params_) {
1249     // There's navigation message params waiting to be sent. Now that we're not
1250     // suspended anymore, resume navigation by sending them. If we were swapped
1251     // out, we should also stop filtering out the IPC messages now.
1252     render_view_host_->SetState(RenderViewHostImpl::STATE_DEFAULT);
1253
1254     DCHECK(!proceed_time.is_null());
1255     suspended_nav_params_->browser_navigation_start = proceed_time;
1256     Send(new FrameMsg_Navigate(routing_id_, *suspended_nav_params_));
1257     suspended_nav_params_.reset();
1258   }
1259 }
1260
1261 void RenderFrameHostImpl::CancelSuspendedNavigations() {
1262   // Clear any state if a pending navigation is canceled or preempted.
1263   if (suspended_nav_params_)
1264     suspended_nav_params_.reset();
1265   navigations_suspended_ = false;
1266 }
1267
1268 }  // namespace content