content/browser/frame_host/render_frame_host_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/frame_host/render_frame_host_impl.h"
   6
   7 #include "base/bind.h"
   8 #include "base/command_line.h"
   9 #include "base/containers/hash_tables.h"
  10 #include "base/lazy_instance.h"
  11 #include "base/metrics/histogram.h"
  12 #include "base/metrics/user_metrics_action.h"
  13 #include "base/time/time.h"
  14 #include "content/browser/accessibility/accessibility_mode_helper.h"
  15 #include "content/browser/accessibility/browser_accessibility_manager.h"
  16 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
  17 #include "content/browser/child_process_security_policy_impl.h"
  18 #include "content/browser/frame_host/cross_process_frame_connector.h"
  19 #include "content/browser/frame_host/cross_site_transferring_request.h"
  20 #include "content/browser/frame_host/frame_tree.h"
  21 #include "content/browser/frame_host/frame_tree_node.h"
  22 #include "content/browser/frame_host/navigator.h"
  23 #include "content/browser/frame_host/render_frame_host_delegate.h"
  24 #include "content/browser/frame_host/render_frame_proxy_host.h"
  25 #include "content/browser/renderer_host/input/input_router.h"
  26 #include "content/browser/renderer_host/input/timeout_monitor.h"
  27 #include "content/browser/renderer_host/render_process_host_impl.h"
  28 #include "content/browser/renderer_host/render_view_host_delegate.h"
  29 #include "content/browser/renderer_host/render_view_host_delegate_view.h"
  30 #include "content/browser/renderer_host/render_view_host_impl.h"
  31 #include "content/browser/renderer_host/render_widget_host_impl.h"
  32 #include "content/browser/renderer_host/render_widget_host_view_base.h"
  33 #include "content/browser/transition_request_manager.h"
  34 #include "content/common/accessibility_messages.h"
  35 #include "content/common/desktop_notification_messages.h"
  36 #include "content/common/frame_messages.h"
  37 #include "content/common/input_messages.h"
  38 #include "content/common/inter_process_time_ticks_converter.h"
  39 #include "content/common/platform_notification_messages.h"
  40 #include "content/common/render_frame_setup.mojom.h"
  41 #include "content/common/swapped_out_messages.h"
  42 #include "content/public/browser/ax_event_notification_details.h"
  43 #include "content/public/browser/browser_accessibility_state.h"
  44 #include "content/public/browser/browser_thread.h"
  45 #include "content/public/browser/content_browser_client.h"
  46 #include "content/public/browser/desktop_notification_delegate.h"
  47 #include "content/public/browser/render_process_host.h"
  48 #include "content/public/browser/render_widget_host_view.h"
  49 #include "content/public/browser/user_metrics.h"
  50 #include "content/public/common/content_constants.h"
  51 #include "content/public/common/content_switches.h"
  52 #include "content/public/common/url_constants.h"
  53 #include "content/public/common/url_utils.h"
  54 #include "ui/accessibility/ax_tree.h"
  55 #include "url/gurl.h"
  56
  57 #if defined(OS_MACOSX)
  58 #include "content/browser/frame_host/popup_menu_helper_mac.h"
  59 #endif
  60
  61 using base::TimeDelta;
  62
  63 namespace content {
  64
  65 namespace {
  66
  67 // The (process id, routing id) pair that identifies one RenderFrame.
  68 typedef std::pair<int32, int32> RenderFrameHostID;
  69 typedef base::hash_map<RenderFrameHostID, RenderFrameHostImpl*>
  70     RoutingIDFrameMap;
  71 base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
  72     LAZY_INSTANCE_INITIALIZER;
  73
  74 class DesktopNotificationDelegateImpl : public DesktopNotificationDelegate {
  75  public:
  76   DesktopNotificationDelegateImpl(RenderFrameHost* render_frame_host,
  77                                   int notification_id)
  78       : render_process_id_(render_frame_host->GetProcess()->GetID()),
  79         render_frame_id_(render_frame_host->GetRoutingID()),
  80         notification_id_(notification_id) {}
  81
  82   virtual ~DesktopNotificationDelegateImpl() {}
  83
  84   virtual void NotificationDisplayed() OVERRIDE {
  85     RenderFrameHost* rfh =
  86         RenderFrameHost::FromID(render_process_id_, render_frame_id_);
  87     if (!rfh)
  88       return;
  89
  90     rfh->Send(new DesktopNotificationMsg_PostDisplay(
  91         rfh->GetRoutingID(), notification_id_));
  92   }
  93
  94   virtual void NotificationError() OVERRIDE {
  95     RenderFrameHost* rfh =
  96         RenderFrameHost::FromID(render_process_id_, render_frame_id_);
  97     if (!rfh)
  98       return;
  99
 100     rfh->Send(new DesktopNotificationMsg_PostError(
 101         rfh->GetRoutingID(), notification_id_));
 102   }
 103
 104   virtual void NotificationClosed(bool by_user) OVERRIDE {
 105     RenderFrameHost* rfh =
 106         RenderFrameHost::FromID(render_process_id_, render_frame_id_);
 107     if (!rfh)
 108       return;
 109
 110     rfh->Send(new DesktopNotificationMsg_PostClose(
 111         rfh->GetRoutingID(), notification_id_, by_user));
 112     static_cast<RenderFrameHostImpl*>(rfh)->NotificationClosed(
 113         notification_id_);
 114   }
 115
 116   virtual void NotificationClick() OVERRIDE {
 117     RenderFrameHost* rfh =
 118         RenderFrameHost::FromID(render_process_id_, render_frame_id_);
 119     if (!rfh)
 120       return;
 121
 122     rfh->Send(new DesktopNotificationMsg_PostClick(
 123         rfh->GetRoutingID(), notification_id_));
 124   }
 125
 126  private:
 127   int render_process_id_;
 128   int render_frame_id_;
 129   int notification_id_;
 130 };
 131
 132 // Translate a WebKit text direction into a base::i18n one.
 133 base::i18n::TextDirection WebTextDirectionToChromeTextDirection(
 134     blink::WebTextDirection dir) {
 135   switch (dir) {
 136     case blink::WebTextDirectionLeftToRight:
 137       return base::i18n::LEFT_TO_RIGHT;
 138     case blink::WebTextDirectionRightToLeft:
 139       return base::i18n::RIGHT_TO_LEFT;
 140     default:
 141       NOTREACHED();
 142       return base::i18n::UNKNOWN_DIRECTION;
 143   }
 144 }
 145
 146 }  // namespace
 147
 148 RenderFrameHost* RenderFrameHost::FromID(int render_process_id,
 149                                          int render_frame_id) {
 150   return RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
 151 }
 152
 153 // static
 154 RenderFrameHostImpl* RenderFrameHostImpl::FromID(int process_id,
 155                                                  int routing_id) {
 156   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 157   RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer();
 158   RoutingIDFrameMap::iterator it = frames->find(
 159       RenderFrameHostID(process_id, routing_id));
 160   return it == frames->end() ? NULL : it->second;
 161 }
 162
 163 RenderFrameHostImpl::RenderFrameHostImpl(RenderViewHostImpl* render_view_host,
 164                                          RenderFrameHostDelegate* delegate,
 165                                          FrameTree* frame_tree,
 166                                          FrameTreeNode* frame_tree_node,
 167                                          int routing_id,
 168                                          bool is_swapped_out)
 169     : render_view_host_(render_view_host),
 170       delegate_(delegate),
 171       cross_process_frame_connector_(NULL),
 172       render_frame_proxy_host_(NULL),
 173       frame_tree_(frame_tree),
 174       frame_tree_node_(frame_tree_node),
 175       routing_id_(routing_id),
 176       is_swapped_out_(is_swapped_out),
 177       renderer_initialized_(false),
 178       navigations_suspended_(false),
 179       weak_ptr_factory_(this) {
 180   frame_tree_->RegisterRenderFrameHost(this);
 181   GetProcess()->AddRoute(routing_id_, this);
 182   g_routing_id_frame_map.Get().insert(std::make_pair(
 183       RenderFrameHostID(GetProcess()->GetID(), routing_id_),
 184       this));
 185
 186   if (GetProcess()->GetServiceRegistry()) {
 187     RenderFrameSetupPtr setup;
 188     GetProcess()->GetServiceRegistry()->ConnectToRemoteService(&setup);
 189     mojo::ServiceProviderPtr service_provider;
 190     setup->GetServiceProviderForFrame(routing_id_,
 191                                       mojo::Get(&service_provider));
 192     service_registry_.BindRemoteServiceProvider(
 193         service_provider.PassMessagePipe());
 194   }
 195 }
 196
 197 RenderFrameHostImpl::~RenderFrameHostImpl() {
 198   GetProcess()->RemoveRoute(routing_id_);
 199   g_routing_id_frame_map.Get().erase(
 200       RenderFrameHostID(GetProcess()->GetID(), routing_id_));
 201
 202   if (delegate_)
 203     delegate_->RenderFrameDeleted(this);
 204
 205   // Notify the FrameTree that this RFH is going away, allowing it to shut down
 206   // the corresponding RenderViewHost if it is no longer needed.
 207   frame_tree_->UnregisterRenderFrameHost(this);
 208 }
 209
 210 int RenderFrameHostImpl::GetRoutingID() {
 211   return routing_id_;
 212 }
 213
 214 SiteInstance* RenderFrameHostImpl::GetSiteInstance() {
 215   return render_view_host_->GetSiteInstance();
 216 }
 217
 218 RenderProcessHost* RenderFrameHostImpl::GetProcess() {
 219   // TODO(nasko): This should return its own process, once we have working
 220   // cross-process navigation for subframes.
 221   return render_view_host_->GetProcess();
 222 }
 223
 224 RenderFrameHost* RenderFrameHostImpl::GetParent() {
 225   FrameTreeNode* parent_node = frame_tree_node_->parent();
 226   if (!parent_node)
 227     return NULL;
 228   return parent_node->current_frame_host();
 229 }
 230
 231 const std::string& RenderFrameHostImpl::GetFrameName() {
 232   return frame_tree_node_->frame_name();
 233 }
 234
 235 bool RenderFrameHostImpl::IsCrossProcessSubframe() {
 236   FrameTreeNode* parent_node = frame_tree_node_->parent();
 237   if (!parent_node)
 238     return false;
 239   return GetSiteInstance() !=
 240       parent_node->current_frame_host()->GetSiteInstance();
 241 }
 242
 243 GURL RenderFrameHostImpl::GetLastCommittedURL() {
 244   return frame_tree_node_->current_url();
 245 }
 246
 247 gfx::NativeView RenderFrameHostImpl::GetNativeView() {
 248   RenderWidgetHostView* view = render_view_host_->GetView();
 249   if (!view)
 250     return NULL;
 251   return view->GetNativeView();
 252 }
 253
 254 void RenderFrameHostImpl::ExecuteJavaScript(
 255     const base::string16& javascript) {
 256   Send(new FrameMsg_JavaScriptExecuteRequest(routing_id_,
 257                                              javascript,
 258                                              0, false));
 259 }
 260
 261 void RenderFrameHostImpl::ExecuteJavaScript(
 262      const base::string16& javascript,
 263      const JavaScriptResultCallback& callback) {
 264   static int next_id = 1;
 265   int key = next_id++;
 266   Send(new FrameMsg_JavaScriptExecuteRequest(routing_id_,
 267                                              javascript,
 268                                              key, true));
 269   javascript_callbacks_.insert(std::make_pair(key, callback));
 270 }
 271
 272 RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() {
 273   return render_view_host_;
 274 }
 275
 276 ServiceRegistry* RenderFrameHostImpl::GetServiceRegistry() {
 277   static_cast<RenderProcessHostImpl*>(GetProcess())->EnsureMojoActivated();
 278   return &service_registry_;
 279 }
 280
 281 bool RenderFrameHostImpl::Send(IPC::Message* message) {
 282   if (IPC_MESSAGE_ID_CLASS(message->type()) == InputMsgStart) {
 283     return render_view_host_->input_router()->SendInput(
 284         make_scoped_ptr(message));
 285   }
 286
 287   // Route IPCs through the RenderFrameProxyHost when in swapped out state.
 288   // Note: For subframes in --site-per-process mode, we don't use swapped out
 289   // RenderFrameHosts.
 290   if (frame_tree_node_->IsMainFrame() && render_view_host_->IsSwappedOut()) {
 291     DCHECK(render_frame_proxy_host_);
 292     return render_frame_proxy_host_->Send(message);
 293   }
 294
 295   return GetProcess()->Send(message);
 296 }
 297
 298 bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
 299   // Filter out most IPC messages if this renderer is swapped out.
 300   // We still want to handle certain ACKs to keep our state consistent.
 301   // TODO(nasko): Only check RenderViewHost state, as this object's own state
 302   // isn't yet properly updated. Transition this check once the swapped out
 303   // state is correct in RenderFrameHost itself.
 304   if (render_view_host_->IsSwappedOut()) {
 305     if (!SwappedOutMessages::CanHandleWhileSwappedOut(msg)) {
 306       // If this is a synchronous message and we decided not to handle it,
 307       // we must send an error reply, or else the renderer will be stuck
 308       // and won't respond to future requests.
 309       if (msg.is_sync()) {
 310         IPC::Message* reply = IPC::SyncMessage::GenerateReply(&msg);
 311         reply->set_reply_error();
 312         Send(reply);
 313       }
 314       // Don't continue looking for someone to handle it.
 315       return true;
 316     }
 317   }
 318
 319   if (delegate_->OnMessageReceived(this, msg))
 320     return true;
 321
 322   RenderFrameProxyHost* proxy =
 323       frame_tree_node_->render_manager()->GetProxyToParent();
 324   if (proxy && proxy->cross_process_frame_connector() &&
 325       proxy->cross_process_frame_connector()->OnMessageReceived(msg))
 326     return true;
 327
 328   bool handled = true;
 329   IPC_BEGIN_MESSAGE_MAP(RenderFrameHostImpl, msg)
 330     IPC_MESSAGE_HANDLER(FrameHostMsg_AddMessageToConsole, OnAddMessageToConsole)
 331     IPC_MESSAGE_HANDLER(FrameHostMsg_Detach, OnDetach)
 332     IPC_MESSAGE_HANDLER(FrameHostMsg_FrameFocused, OnFrameFocused)
 333     IPC_MESSAGE_HANDLER(FrameHostMsg_DidStartProvisionalLoadForFrame,
 334                         OnDidStartProvisionalLoadForFrame)
 335     IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailProvisionalLoadWithError,
 336                         OnDidFailProvisionalLoadWithError)
 337     IPC_MESSAGE_HANDLER(FrameHostMsg_DidRedirectProvisionalLoad,
 338                         OnDidRedirectProvisionalLoad)
 339     IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailLoadWithError,
 340                         OnDidFailLoadWithError)
 341     IPC_MESSAGE_HANDLER_GENERIC(FrameHostMsg_DidCommitProvisionalLoad,
 342                                 OnNavigate(msg))
 343     IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL)
 344     IPC_MESSAGE_HANDLER(FrameHostMsg_DocumentOnLoadCompleted,
 345                         OnDocumentOnLoadCompleted)
 346     IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK)
 347     IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK)
 348     IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu)
 349     IPC_MESSAGE_HANDLER(FrameHostMsg_JavaScriptExecuteResponse,
 350                         OnJavaScriptExecuteResponse)
 351     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage,
 352                                     OnRunJavaScriptMessage)
 353     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm,
 354                                     OnRunBeforeUnloadConfirm)
 355     IPC_MESSAGE_HANDLER(FrameHostMsg_DidAccessInitialDocument,
 356                         OnDidAccessInitialDocument)
 357     IPC_MESSAGE_HANDLER(FrameHostMsg_DidDisownOpener, OnDidDisownOpener)
 358     IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateTitle, OnUpdateTitle)
 359     IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateEncoding, OnUpdateEncoding)
 360     IPC_MESSAGE_HANDLER(FrameHostMsg_BeginNavigation,
 361                         OnBeginNavigation)
 362     IPC_MESSAGE_HANDLER(PlatformNotificationHostMsg_RequestPermission,
 363                         OnRequestPlatformNotificationPermission)
 364     IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show,
 365                         OnShowDesktopNotification)
 366     IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel,
 367                         OnCancelDesktopNotification)
 368     IPC_MESSAGE_HANDLER(FrameHostMsg_TextSurroundingSelectionResponse,
 369                         OnTextSurroundingSelectionResponse)
 370     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_Events, OnAccessibilityEvents)
 371     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_LocationChanges,
 372                         OnAccessibilityLocationChanges)
 373 #if defined(OS_MACOSX) || defined(OS_ANDROID)
 374     IPC_MESSAGE_HANDLER(FrameHostMsg_ShowPopup, OnShowPopup)
 375     IPC_MESSAGE_HANDLER(FrameHostMsg_HidePopup, OnHidePopup)
 376 #endif
 377   IPC_END_MESSAGE_MAP()
 378
 379   return handled;
 380 }
 381
 382 void RenderFrameHostImpl::AccessibilitySetFocus(int object_id) {
 383   Send(new AccessibilityMsg_SetFocus(routing_id_, object_id));
 384 }
 385
 386 void RenderFrameHostImpl::AccessibilityDoDefaultAction(int object_id) {
 387   Send(new AccessibilityMsg_DoDefaultAction(routing_id_, object_id));
 388 }
 389
 390 void RenderFrameHostImpl::AccessibilityShowMenu(
 391     const gfx::Point& global_point) {
 392   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 393       render_view_host_->GetView());
 394   if (view)
 395     view->AccessibilityShowMenu(global_point);
 396 }
 397
 398 void RenderFrameHostImpl::AccessibilityScrollToMakeVisible(
 399     int acc_obj_id, const gfx::Rect& subfocus) {
 400   Send(new AccessibilityMsg_ScrollToMakeVisible(
 401       routing_id_, acc_obj_id, subfocus));
 402 }
 403
 404 void RenderFrameHostImpl::AccessibilityScrollToPoint(
 405     int acc_obj_id, const gfx::Point& point) {
 406   Send(new AccessibilityMsg_ScrollToPoint(
 407       routing_id_, acc_obj_id, point));
 408 }
 409
 410 void RenderFrameHostImpl::AccessibilitySetTextSelection(
 411     int object_id, int start_offset, int end_offset) {
 412   Send(new AccessibilityMsg_SetTextSelection(
 413       routing_id_, object_id, start_offset, end_offset));
 414 }
 415
 416 bool RenderFrameHostImpl::AccessibilityViewHasFocus() const {
 417   RenderWidgetHostView* view = render_view_host_->GetView();
 418   if (view)
 419     return view->HasFocus();
 420   return false;
 421 }
 422
 423 gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
 424   RenderWidgetHostView* view = render_view_host_->GetView();
 425   if (view)
 426     return view->GetViewBounds();
 427   return gfx::Rect();
 428 }
 429
 430 gfx::Point RenderFrameHostImpl::AccessibilityOriginInScreen(
 431     const gfx::Rect& bounds) const {
 432   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 433       render_view_host_->GetView());
 434   if (view)
 435     return view->AccessibilityOriginInScreen(bounds);
 436   return gfx::Point();
 437 }
 438
 439 void RenderFrameHostImpl::AccessibilityHitTest(const gfx::Point& point) {
 440   Send(new AccessibilityMsg_HitTest(routing_id_, point));
 441 }
 442
 443 void RenderFrameHostImpl::AccessibilityFatalError() {
 444   Send(new AccessibilityMsg_FatalError(routing_id_));
 445   browser_accessibility_manager_.reset(NULL);
 446 }
 447
 448 gfx::AcceleratedWidget
 449     RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
 450   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 451       render_view_host_->GetView());
 452   if (view)
 453     return view->AccessibilityGetAcceleratedWidget();
 454   return gfx::kNullAcceleratedWidget;
 455 }
 456
 457 gfx::NativeViewAccessible
 458     RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
 459   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 460       render_view_host_->GetView());
 461   if (view)
 462     return view->AccessibilityGetNativeViewAccessible();
 463   return NULL;
 464 }
 465
 466 bool RenderFrameHostImpl::CreateRenderFrame(int parent_routing_id) {
 467   TRACE_EVENT0("frame_host", "RenderFrameHostImpl::CreateRenderFrame");
 468   DCHECK(!IsRenderFrameLive()) << "Creating frame twice";
 469
 470   // The process may (if we're sharing a process with another host that already
 471   // initialized it) or may not (we have our own process or the old process
 472   // crashed) have been initialized. Calling Init multiple times will be
 473   // ignored, so this is safe.
 474   if (!GetProcess()->Init())
 475     return false;
 476
 477   DCHECK(GetProcess()->HasConnection());
 478
 479   renderer_initialized_ = true;
 480   Send(new FrameMsg_NewFrame(routing_id_, parent_routing_id));
 481
 482   return true;
 483 }
 484
 485 bool RenderFrameHostImpl::IsRenderFrameLive() {
 486   return GetProcess()->HasConnection() && renderer_initialized_;
 487 }
 488
 489 void RenderFrameHostImpl::Init() {
 490   GetProcess()->ResumeRequestsForView(routing_id_);
 491 }
 492
 493 void RenderFrameHostImpl::OnAddMessageToConsole(
 494     int32 level,
 495     const base::string16& message,
 496     int32 line_no,
 497     const base::string16& source_id) {
 498   if (delegate_->AddMessageToConsole(level, message, line_no, source_id))
 499     return;
 500
 501   // Pass through log level only on WebUI pages to limit console spew.
 502   int32 resolved_level =
 503       HasWebUIScheme(delegate_->GetMainFrameLastCommittedURL()) ? level : 0;
 504
 505   if (resolved_level >= ::logging::GetMinLogLevel()) {
 506     logging::LogMessage("CONSOLE", line_no, resolved_level).stream() << "\"" <<
 507         message << "\", source: " << source_id << " (" << line_no << ")";
 508   }
 509 }
 510
 511 void RenderFrameHostImpl::OnCreateChildFrame(int new_routing_id,
 512                                              const std::string& frame_name) {
 513   RenderFrameHostImpl* new_frame = frame_tree_->AddFrame(
 514       frame_tree_node_, new_routing_id, frame_name);
 515   if (delegate_)
 516     delegate_->RenderFrameCreated(new_frame);
 517 }
 518
 519 void RenderFrameHostImpl::OnDetach() {
 520   frame_tree_->RemoveFrame(frame_tree_node_);
 521 }
 522
 523 void RenderFrameHostImpl::OnFrameFocused() {
 524   frame_tree_->SetFocusedFrame(frame_tree_node_);
 525 }
 526
 527 void RenderFrameHostImpl::OnOpenURL(
 528     const FrameHostMsg_OpenURL_Params& params) {
 529   GURL validated_url(params.url);
 530   GetProcess()->FilterURL(false, &validated_url);
 531
 532   frame_tree_node_->navigator()->RequestOpenURL(
 533       this, validated_url, params.referrer, params.disposition,
 534       params.should_replace_current_entry, params.user_gesture);
 535 }
 536
 537 void RenderFrameHostImpl::OnDocumentOnLoadCompleted() {
 538   // This message is only sent for top-level frames. TODO(avi): when frame tree
 539   // mirroring works correctly, add a check here to enforce it.
 540   delegate_->DocumentOnLoadCompleted(this);
 541 }
 542
 543 void RenderFrameHostImpl::OnDidStartProvisionalLoadForFrame(
 544     const GURL& url,
 545     bool is_transition_navigation) {
 546   frame_tree_node_->navigator()->DidStartProvisionalLoad(
 547       this, url, is_transition_navigation);
 548 }
 549
 550 void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
 551     const FrameHostMsg_DidFailProvisionalLoadWithError_Params& params) {
 552   frame_tree_node_->navigator()->DidFailProvisionalLoadWithError(this, params);
 553 }
 554
 555 void RenderFrameHostImpl::OnDidFailLoadWithError(
 556     const GURL& url,
 557     int error_code,
 558     const base::string16& error_description) {
 559   GURL validated_url(url);
 560   GetProcess()->FilterURL(false, &validated_url);
 561
 562   frame_tree_node_->navigator()->DidFailLoadWithError(
 563       this, validated_url, error_code, error_description);
 564 }
 565
 566 void RenderFrameHostImpl::OnDidRedirectProvisionalLoad(
 567     int32 page_id,
 568     const GURL& source_url,
 569     const GURL& target_url) {
 570   frame_tree_node_->navigator()->DidRedirectProvisionalLoad(
 571       this, page_id, source_url, target_url);
 572 }
 573
 574 // Called when the renderer navigates.  For every frame loaded, we'll get this
 575 // notification containing parameters identifying the navigation.
 576 //
 577 // Subframes are identified by the page transition type.  For subframes loaded
 578 // as part of a wider page load, the page_id will be the same as for the top
 579 // level frame.  If the user explicitly requests a subframe navigation, we will
 580 // get a new page_id because we need to create a new navigation entry for that
 581 // action.
 582 void RenderFrameHostImpl::OnNavigate(const IPC::Message& msg) {
 583   // Read the parameters out of the IPC message directly to avoid making another
 584   // copy when we filter the URLs.
 585   PickleIterator iter(msg);
 586   FrameHostMsg_DidCommitProvisionalLoad_Params validated_params;
 587   if (!IPC::ParamTraits<FrameHostMsg_DidCommitProvisionalLoad_Params>::
 588       Read(&msg, &iter, &validated_params))
 589     return;
 590
 591   // If we're waiting for a cross-site beforeunload ack from this renderer and
 592   // we receive a Navigate message from the main frame, then the renderer was
 593   // navigating already and sent it before hearing the ViewMsg_Stop message.
 594   // We do not want to cancel the pending navigation in this case, since the
 595   // old page will soon be stopped.  Instead, treat this as a beforeunload ack
 596   // to allow the pending navigation to continue.
 597   if (render_view_host_->is_waiting_for_beforeunload_ack_ &&
 598       render_view_host_->unload_ack_is_for_cross_site_transition_ &&
 599       PageTransitionIsMainFrame(validated_params.transition)) {
 600     OnBeforeUnloadACK(true, send_before_unload_start_time_,
 601                       base::TimeTicks::Now());
 602     return;
 603   }
 604
 605   // If we're waiting for an unload ack from this renderer and we receive a
 606   // Navigate message, then the renderer was navigating before it received the
 607   // unload request.  It will either respond to the unload request soon or our
 608   // timer will expire.  Either way, we should ignore this message, because we
 609   // have already committed to closing this renderer.
 610   if (render_view_host_->IsWaitingForUnloadACK())
 611     return;
 612
 613   RenderProcessHost* process = GetProcess();
 614
 615   // Attempts to commit certain off-limits URL should be caught more strictly
 616   // than our FilterURL checks below.  If a renderer violates this policy, it
 617   // should be killed.
 618   if (!CanCommitURL(validated_params.url)) {
 619     VLOG(1) << "Blocked URL " << validated_params.url.spec();
 620     validated_params.url = GURL(url::kAboutBlankURL);
 621     RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled"));
 622     // Kills the process.
 623     process->ReceivedBadMessage();
 624   }
 625
 626   // Without this check, an evil renderer can trick the browser into creating
 627   // a navigation entry for a banned URL.  If the user clicks the back button
 628   // followed by the forward button (or clicks reload, or round-trips through
 629   // session restore, etc), we'll think that the browser commanded the
 630   // renderer to load the URL and grant the renderer the privileges to request
 631   // the URL.  To prevent this attack, we block the renderer from inserting
 632   // banned URLs into the navigation controller in the first place.
 633   process->FilterURL(false, &validated_params.url);
 634   process->FilterURL(true, &validated_params.referrer.url);
 635   for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
 636       it != validated_params.redirects.end(); ++it) {
 637     process->FilterURL(false, &(*it));
 638   }
 639   process->FilterURL(true, &validated_params.searchable_form_url);
 640
 641   // Without this check, the renderer can trick the browser into using
 642   // filenames it can't access in a future session restore.
 643   if (!render_view_host_->CanAccessFilesOfPageState(
 644           validated_params.page_state)) {
 645     GetProcess()->ReceivedBadMessage();
 646     return;
 647   }
 648
 649   frame_tree_node()->navigator()->DidNavigate(this, validated_params);
 650 }
 651
 652 RenderWidgetHostImpl* RenderFrameHostImpl::GetRenderWidgetHost() {
 653   return static_cast<RenderWidgetHostImpl*>(render_view_host_);
 654 }
 655
 656 int RenderFrameHostImpl::GetEnabledBindings() {
 657   return render_view_host_->GetEnabledBindings();
 658 }
 659
 660 void RenderFrameHostImpl::OnCrossSiteResponse(
 661     const GlobalRequestID& global_request_id,
 662     scoped_ptr<CrossSiteTransferringRequest> cross_site_transferring_request,
 663     const std::vector<GURL>& transfer_url_chain,
 664     const Referrer& referrer,
 665     PageTransition page_transition,
 666     bool should_replace_current_entry) {
 667   frame_tree_node_->render_manager()->OnCrossSiteResponse(
 668       this, global_request_id, cross_site_transferring_request.Pass(),
 669       transfer_url_chain, referrer, page_transition,
 670       should_replace_current_entry);
 671 }
 672
 673 void RenderFrameHostImpl::OnDeferredAfterResponseStarted(
 674     const GlobalRequestID& global_request_id,
 675     const TransitionLayerData& transition_data) {
 676   frame_tree_node_->render_manager()->OnDeferredAfterResponseStarted(
 677       global_request_id, this);
 678
 679   if (GetParent() || !delegate_->WillHandleDeferAfterResponseStarted())
 680     frame_tree_node_->render_manager()->ResumeResponseDeferredAtStart();
 681   else
 682     delegate_->DidDeferAfterResponseStarted(transition_data);
 683 }
 684
 685 void RenderFrameHostImpl::SwapOut(RenderFrameProxyHost* proxy) {
 686   // TODO(creis): Move swapped out state to RFH.  Until then, only update it
 687   // when swapping out the main frame.
 688   if (!GetParent()) {
 689     // If this RenderViewHost is not in the default state, it must have already
 690     // gone through this, therefore just return.
 691     if (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT)
 692       return;
 693
 694     render_view_host_->SetState(
 695         RenderViewHostImpl::STATE_PENDING_SWAP_OUT);
 696     render_view_host_->unload_event_monitor_timeout_->Start(
 697         base::TimeDelta::FromMilliseconds(
 698             RenderViewHostImpl::kUnloadTimeoutMS));
 699   }
 700
 701   set_render_frame_proxy_host(proxy);
 702
 703   if (render_view_host_->IsRenderViewLive())
 704     Send(new FrameMsg_SwapOut(routing_id_, proxy->GetRoutingID()));
 705
 706   if (!GetParent())
 707     delegate_->SwappedOut(this);
 708   else
 709     set_swapped_out(true);
 710 }
 711
 712 void RenderFrameHostImpl::OnBeforeUnloadACK(
 713     bool proceed,
 714     const base::TimeTicks& renderer_before_unload_start_time,
 715     const base::TimeTicks& renderer_before_unload_end_time) {
 716   // TODO(creis): Support properly beforeunload on subframes. For now just
 717   // pretend that the handler ran and allowed the navigation to proceed.
 718   if (GetParent()) {
 719     render_view_host_->is_waiting_for_beforeunload_ack_ = false;
 720     frame_tree_node_->render_manager()->OnBeforeUnloadACK(
 721         render_view_host_->unload_ack_is_for_cross_site_transition_, proceed,
 722         renderer_before_unload_end_time);
 723     return;
 724   }
 725
 726   render_view_host_->decrement_in_flight_event_count();
 727   render_view_host_->StopHangMonitorTimeout();
 728   // If this renderer navigated while the beforeunload request was in flight, we
 729   // may have cleared this state in OnNavigate, in which case we can ignore
 730   // this message.
 731   // However renderer might also be swapped out but we still want to proceed
 732   // with navigation, otherwise it would block future navigations. This can
 733   // happen when pending cross-site navigation is canceled by a second one just
 734   // before OnNavigate while current RVH is waiting for commit but second
 735   // navigation is started from the beginning.
 736   if (!render_view_host_->is_waiting_for_beforeunload_ack_) {
 737     return;
 738   }
 739
 740   render_view_host_->is_waiting_for_beforeunload_ack_ = false;
 741
 742   base::TimeTicks before_unload_end_time;
 743   if (!send_before_unload_start_time_.is_null() &&
 744       !renderer_before_unload_start_time.is_null() &&
 745       !renderer_before_unload_end_time.is_null()) {
 746     // When passing TimeTicks across process boundaries, we need to compensate
 747     // for any skew between the processes. Here we are converting the
 748     // renderer's notion of before_unload_end_time to TimeTicks in the browser
 749     // process. See comments in inter_process_time_ticks_converter.h for more.
 750     InterProcessTimeTicksConverter converter(
 751         LocalTimeTicks::FromTimeTicks(send_before_unload_start_time_),
 752         LocalTimeTicks::FromTimeTicks(base::TimeTicks::Now()),
 753         RemoteTimeTicks::FromTimeTicks(renderer_before_unload_start_time),
 754         RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
 755     LocalTimeTicks browser_before_unload_end_time =
 756         converter.ToLocalTimeTicks(
 757             RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
 758     before_unload_end_time = browser_before_unload_end_time.ToTimeTicks();
 759
 760     // Collect UMA on the inter-process skew.
 761     bool is_skew_additive = false;
 762     if (converter.IsSkewAdditiveForMetrics()) {
 763       is_skew_additive = true;
 764       base::TimeDelta skew = converter.GetSkewForMetrics();
 765       if (skew >= base::TimeDelta()) {
 766         UMA_HISTOGRAM_TIMES(
 767             "InterProcessTimeTicks.BrowserBehind_RendererToBrowser", skew);
 768       } else {
 769         UMA_HISTOGRAM_TIMES(
 770             "InterProcessTimeTicks.BrowserAhead_RendererToBrowser", -skew);
 771       }
 772     }
 773     UMA_HISTOGRAM_BOOLEAN(
 774         "InterProcessTimeTicks.IsSkewAdditive_RendererToBrowser",
 775         is_skew_additive);
 776   }
 777   frame_tree_node_->render_manager()->OnBeforeUnloadACK(
 778       render_view_host_->unload_ack_is_for_cross_site_transition_, proceed,
 779       before_unload_end_time);
 780
 781   // If canceled, notify the delegate to cancel its pending navigation entry.
 782   if (!proceed)
 783     render_view_host_->GetDelegate()->DidCancelLoading();
 784 }
 785
 786 void RenderFrameHostImpl::OnSwapOutACK() {
 787   OnSwappedOut(false);
 788 }
 789
 790 void RenderFrameHostImpl::OnSwappedOut(bool timed_out) {
 791   // For now, we only need to update the RVH state machine for top-level swaps.
 792   if (!GetParent())
 793     render_view_host_->OnSwappedOut(timed_out);
 794 }
 795
 796 void RenderFrameHostImpl::OnContextMenu(const ContextMenuParams& params) {
 797   // Validate the URLs in |params|.  If the renderer can't request the URLs
 798   // directly, don't show them in the context menu.
 799   ContextMenuParams validated_params(params);
 800   RenderProcessHost* process = GetProcess();
 801
 802   // We don't validate |unfiltered_link_url| so that this field can be used
 803   // when users want to copy the original link URL.
 804   process->FilterURL(true, &validated_params.link_url);
 805   process->FilterURL(true, &validated_params.src_url);
 806   process->FilterURL(false, &validated_params.page_url);
 807   process->FilterURL(true, &validated_params.frame_url);
 808
 809   delegate_->ShowContextMenu(this, validated_params);
 810 }
 811
 812 void RenderFrameHostImpl::OnJavaScriptExecuteResponse(
 813     int id, const base::ListValue& result) {
 814   const base::Value* result_value;
 815   if (!result.Get(0, &result_value)) {
 816     // Programming error or rogue renderer.
 817     NOTREACHED() << "Got bad arguments for OnJavaScriptExecuteResponse";
 818     return;
 819   }
 820
 821   std::map<int, JavaScriptResultCallback>::iterator it =
 822       javascript_callbacks_.find(id);
 823   if (it != javascript_callbacks_.end()) {
 824     it->second.Run(result_value);
 825     javascript_callbacks_.erase(it);
 826   } else {
 827     NOTREACHED() << "Received script response for unknown request";
 828   }
 829 }
 830
 831 void RenderFrameHostImpl::OnRunJavaScriptMessage(
 832     const base::string16& message,
 833     const base::string16& default_prompt,
 834     const GURL& frame_url,
 835     JavaScriptMessageType type,
 836     IPC::Message* reply_msg) {
 837   // While a JS message dialog is showing, tabs in the same process shouldn't
 838   // process input events.
 839   GetProcess()->SetIgnoreInputEvents(true);
 840   render_view_host_->StopHangMonitorTimeout();
 841   delegate_->RunJavaScriptMessage(this, message, default_prompt,
 842                                   frame_url, type, reply_msg);
 843 }
 844
 845 void RenderFrameHostImpl::OnRunBeforeUnloadConfirm(
 846     const GURL& frame_url,
 847     const base::string16& message,
 848     bool is_reload,
 849     IPC::Message* reply_msg) {
 850   // While a JS before unload dialog is showing, tabs in the same process
 851   // shouldn't process input events.
 852   GetProcess()->SetIgnoreInputEvents(true);
 853   render_view_host_->StopHangMonitorTimeout();
 854   delegate_->RunBeforeUnloadConfirm(this, message, is_reload, reply_msg);
 855 }
 856
 857 void RenderFrameHostImpl::OnRequestPlatformNotificationPermission(
 858     const GURL& origin, int request_id) {
 859   base::Callback<void(blink::WebNotificationPermission)> done_callback =
 860       base::Bind(
 861           &RenderFrameHostImpl::PlatformNotificationPermissionRequestDone,
 862           weak_ptr_factory_.GetWeakPtr(),
 863           request_id);
 864
 865   GetContentClient()->browser()->RequestDesktopNotificationPermission(
 866       origin, this, done_callback);
 867 }
 868
 869 void RenderFrameHostImpl::OnShowDesktopNotification(
 870     int notification_id,
 871     const ShowDesktopNotificationHostMsgParams& params) {
 872   scoped_ptr<DesktopNotificationDelegateImpl> delegate(
 873       new DesktopNotificationDelegateImpl(this, notification_id));
 874
 875   base::Closure cancel_callback;
 876   GetContentClient()->browser()->ShowDesktopNotification(
 877       params,
 878       this,
 879       delegate.PassAs<DesktopNotificationDelegate>(),
 880       &cancel_callback);
 881   cancel_notification_callbacks_[notification_id] = cancel_callback;
 882 }
 883
 884 void RenderFrameHostImpl::OnCancelDesktopNotification(int notification_id) {
 885   if (!cancel_notification_callbacks_.count(notification_id)) {
 886     NOTREACHED();
 887     return;
 888   }
 889   cancel_notification_callbacks_[notification_id].Run();
 890   cancel_notification_callbacks_.erase(notification_id);
 891 }
 892
 893 void RenderFrameHostImpl::OnTextSurroundingSelectionResponse(
 894     const base::string16& content,
 895     size_t start_offset,
 896     size_t end_offset) {
 897   render_view_host_->OnTextSurroundingSelectionResponse(
 898       content, start_offset, end_offset);
 899 }
 900
 901 void RenderFrameHostImpl::OnDidAccessInitialDocument() {
 902   delegate_->DidAccessInitialDocument();
 903 }
 904
 905 void RenderFrameHostImpl::OnDidDisownOpener() {
 906   // This message is only sent for top-level frames. TODO(avi): when frame tree
 907   // mirroring works correctly, add a check here to enforce it.
 908   delegate_->DidDisownOpener(this);
 909 }
 910
 911 void RenderFrameHostImpl::OnUpdateTitle(
 912     int32 page_id,
 913     const base::string16& title,
 914     blink::WebTextDirection title_direction) {
 915   // This message is only sent for top-level frames. TODO(avi): when frame tree
 916   // mirroring works correctly, add a check here to enforce it.
 917   if (title.length() > kMaxTitleChars) {
 918     NOTREACHED() << "Renderer sent too many characters in title.";
 919     return;
 920   }
 921
 922   delegate_->UpdateTitle(this, page_id, title,
 923                          WebTextDirectionToChromeTextDirection(
 924                              title_direction));
 925 }
 926
 927 void RenderFrameHostImpl::OnUpdateEncoding(const std::string& encoding_name) {
 928   // This message is only sent for top-level frames. TODO(avi): when frame tree
 929   // mirroring works correctly, add a check here to enforce it.
 930   delegate_->UpdateEncoding(this, encoding_name);
 931 }
 932
 933 void RenderFrameHostImpl::OnBeginNavigation(
 934     const FrameHostMsg_BeginNavigation_Params& params) {
 935   CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
 936       switches::kEnableBrowserSideNavigation));
 937   frame_tree_node()->render_manager()->OnBeginNavigation(params);
 938 }
 939
 940 void RenderFrameHostImpl::OnAccessibilityEvents(
 941     const std::vector<AccessibilityHostMsg_EventParams>& params) {
 942   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 943       render_view_host_->GetView());
 944
 945   AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
 946   if ((accessibility_mode != AccessibilityModeOff) && view &&
 947       RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
 948     if (accessibility_mode & AccessibilityModeFlagPlatform) {
 949       GetOrCreateBrowserAccessibilityManager();
 950       if (browser_accessibility_manager_)
 951         browser_accessibility_manager_->OnAccessibilityEvents(params);
 952     }
 953
 954     std::vector<AXEventNotificationDetails> details;
 955     details.reserve(params.size());
 956     for (size_t i = 0; i < params.size(); ++i) {
 957       const AccessibilityHostMsg_EventParams& param = params[i];
 958       AXEventNotificationDetails detail(param.update.node_id_to_clear,
 959                                         param.update.nodes,
 960                                         param.event_type,
 961                                         param.id,
 962                                         GetProcess()->GetID(),
 963                                         routing_id_);
 964       details.push_back(detail);
 965     }
 966
 967     delegate_->AccessibilityEventReceived(details);
 968   }
 969
 970   // Always send an ACK or the renderer can be in a bad state.
 971   Send(new AccessibilityMsg_Events_ACK(routing_id_));
 972
 973   // The rest of this code is just for testing; bail out if we're not
 974   // in that mode.
 975   if (accessibility_testing_callback_.is_null())
 976     return;
 977
 978   for (size_t i = 0; i < params.size(); i++) {
 979     const AccessibilityHostMsg_EventParams& param = params[i];
 980     if (static_cast<int>(param.event_type) < 0)
 981       continue;
 982     if (!ax_tree_for_testing_) {
 983       ax_tree_for_testing_.reset(new ui::AXTree(param.update));
 984     } else {
 985       CHECK(ax_tree_for_testing_->Unserialize(param.update))
 986           << ax_tree_for_testing_->error();
 987     }
 988     accessibility_testing_callback_.Run(param.event_type, param.id);
 989   }
 990 }
 991
 992 void RenderFrameHostImpl::OnAccessibilityLocationChanges(
 993     const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
 994   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
 995       render_view_host_->GetView());
 996   if (view &&
 997       RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
 998     AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
 999     if (accessibility_mode & AccessibilityModeFlagPlatform) {
1000       if (!browser_accessibility_manager_) {
1001         browser_accessibility_manager_.reset(
1002             view->CreateBrowserAccessibilityManager(this));
1003       }
1004       if (browser_accessibility_manager_)
1005         browser_accessibility_manager_->OnLocationChanges(params);
1006     }
1007     // TODO(aboxhall): send location change events to web contents observers too
1008   }
1009 }
1010
1011 #if defined(OS_MACOSX) || defined(OS_ANDROID)
1012 void RenderFrameHostImpl::OnShowPopup(
1013     const FrameHostMsg_ShowPopup_Params& params) {
1014   RenderViewHostDelegateView* view =
1015       render_view_host_->delegate_->GetDelegateView();
1016   if (view) {
1017     view->ShowPopupMenu(this,
1018                         params.bounds,
1019                         params.item_height,
1020                         params.item_font_size,
1021                         params.selected_item,
1022                         params.popup_items,
1023                         params.right_aligned,
1024                         params.allow_multiple_selection);
1025   }
1026 }
1027
1028 void RenderFrameHostImpl::OnHidePopup() {
1029   RenderViewHostDelegateView* view =
1030       render_view_host_->delegate_->GetDelegateView();
1031   if (view)
1032     view->HidePopupMenu();
1033 }
1034 #endif
1035
1036 void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) {
1037   render_view_host_->SetPendingShutdown(on_swap_out);
1038 }
1039
1040 bool RenderFrameHostImpl::CanCommitURL(const GURL& url) {
1041   // TODO(creis): We should also check for WebUI pages here.  Also, when the
1042   // out-of-process iframes implementation is ready, we should check for
1043   // cross-site URLs that are not allowed to commit in this process.
1044
1045   // Give the client a chance to disallow URLs from committing.
1046   return GetContentClient()->browser()->CanCommitURL(GetProcess(), url);
1047 }
1048
1049 void RenderFrameHostImpl::Navigate(const FrameMsg_Navigate_Params& params) {
1050   TRACE_EVENT0("frame_host", "RenderFrameHostImpl::Navigate");
1051   // Browser plugin guests are not allowed to navigate outside web-safe schemes,
1052   // so do not grant them the ability to request additional URLs.
1053   if (!GetProcess()->IsIsolatedGuest()) {
1054     ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
1055         GetProcess()->GetID(), params.url);
1056     if (params.url.SchemeIs(url::kDataScheme) &&
1057         params.base_url_for_data_url.SchemeIs(url::kFileScheme)) {
1058       // If 'data:' is used, and we have a 'file:' base url, grant access to
1059       // local files.
1060       ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
1061           GetProcess()->GetID(), params.base_url_for_data_url);
1062     }
1063   }
1064
1065   // Only send the message if we aren't suspended at the start of a cross-site
1066   // request.
1067   if (navigations_suspended_) {
1068     // Shouldn't be possible to have a second navigation while suspended, since
1069     // navigations will only be suspended during a cross-site request.  If a
1070     // second navigation occurs, RenderFrameHostManager will cancel this pending
1071     // RFH and create a new pending RFH.
1072     DCHECK(!suspended_nav_params_.get());
1073     suspended_nav_params_.reset(new FrameMsg_Navigate_Params(params));
1074   } else {
1075     // Get back to a clean state, in case we start a new navigation without
1076     // completing a RVH swap or unload handler.
1077     render_view_host_->SetState(RenderViewHostImpl::STATE_DEFAULT);
1078
1079     Send(new FrameMsg_Navigate(routing_id_, params));
1080   }
1081
1082   // Force the throbber to start. We do this because Blink's "started
1083   // loading" message will be received asynchronously from the UI of the
1084   // browser. But we want to keep the throbber in sync with what's happening
1085   // in the UI. For example, we want to start throbbing immediately when the
1086   // user naivgates even if the renderer is delayed. There is also an issue
1087   // with the throbber starting because the WebUI (which controls whether the
1088   // favicon is displayed) happens synchronously. If the start loading
1089   // messages was asynchronous, then the default favicon would flash in.
1090   //
1091   // Blink doesn't send throb notifications for JavaScript URLs, so we
1092   // don't want to either.
1093   if (!params.url.SchemeIs(url::kJavaScriptScheme))
1094     delegate_->DidStartLoading(this, true);
1095 }
1096
1097 void RenderFrameHostImpl::NavigateToURL(const GURL& url) {
1098   FrameMsg_Navigate_Params params;
1099   params.page_id = -1;
1100   params.pending_history_list_offset = -1;
1101   params.current_history_list_offset = -1;
1102   params.current_history_list_length = 0;
1103   params.url = url;
1104   params.transition = PAGE_TRANSITION_LINK;
1105   params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
1106   params.browser_navigation_start = base::TimeTicks::Now();
1107   Navigate(params);
1108 }
1109
1110 void RenderFrameHostImpl::DispatchBeforeUnload(bool for_cross_site_transition) {
1111   // TODO(creis): Support subframes.
1112   if (!render_view_host_->IsRenderViewLive() || GetParent()) {
1113     // We don't have a live renderer, so just skip running beforeunload.
1114     render_view_host_->is_waiting_for_beforeunload_ack_ = true;
1115     render_view_host_->unload_ack_is_for_cross_site_transition_ =
1116         for_cross_site_transition;
1117     base::TimeTicks now = base::TimeTicks::Now();
1118     OnBeforeUnloadACK(true, now, now);
1119     return;
1120   }
1121
1122   // This may be called more than once (if the user clicks the tab close button
1123   // several times, or if she clicks the tab close button then the browser close
1124   // button), and we only send the message once.
1125   if (render_view_host_->is_waiting_for_beforeunload_ack_) {
1126     // Some of our close messages could be for the tab, others for cross-site
1127     // transitions. We always want to think it's for closing the tab if any
1128     // of the messages were, since otherwise it might be impossible to close
1129     // (if there was a cross-site "close" request pending when the user clicked
1130     // the close button). We want to keep the "for cross site" flag only if
1131     // both the old and the new ones are also for cross site.
1132     render_view_host_->unload_ack_is_for_cross_site_transition_ =
1133         render_view_host_->unload_ack_is_for_cross_site_transition_ &&
1134         for_cross_site_transition;
1135   } else {
1136     // Start the hang monitor in case the renderer hangs in the beforeunload
1137     // handler.
1138     render_view_host_->is_waiting_for_beforeunload_ack_ = true;
1139     render_view_host_->unload_ack_is_for_cross_site_transition_ =
1140         for_cross_site_transition;
1141     // Increment the in-flight event count, to ensure that input events won't
1142     // cancel the timeout timer.
1143     render_view_host_->increment_in_flight_event_count();
1144     render_view_host_->StartHangMonitorTimeout(
1145         TimeDelta::FromMilliseconds(RenderViewHostImpl::kUnloadTimeoutMS));
1146     send_before_unload_start_time_ = base::TimeTicks::Now();
1147     Send(new FrameMsg_BeforeUnload(routing_id_));
1148   }
1149 }
1150
1151 void RenderFrameHostImpl::DisownOpener() {
1152   Send(new FrameMsg_DisownOpener(GetRoutingID()));
1153 }
1154
1155 void RenderFrameHostImpl::ExtendSelectionAndDelete(size_t before,
1156                                                    size_t after) {
1157   Send(new InputMsg_ExtendSelectionAndDelete(routing_id_, before, after));
1158 }
1159
1160 void RenderFrameHostImpl::JavaScriptDialogClosed(
1161     IPC::Message* reply_msg,
1162     bool success,
1163     const base::string16& user_input,
1164     bool dialog_was_suppressed) {
1165   GetProcess()->SetIgnoreInputEvents(false);
1166   bool is_waiting = render_view_host_->is_waiting_for_beforeunload_ack() ||
1167                     render_view_host_->IsWaitingForUnloadACK();
1168
1169   // If we are executing as part of (before)unload event handling, we don't
1170   // want to use the regular hung_renderer_delay_ms_ if the user has agreed to
1171   // leave the current page. In this case, use the regular timeout value used
1172   // during the (before)unload handling.
1173   if (is_waiting) {
1174     render_view_host_->StartHangMonitorTimeout(TimeDelta::FromMilliseconds(
1175         success ? RenderViewHostImpl::kUnloadTimeoutMS
1176                 : render_view_host_->hung_renderer_delay_ms_));
1177   }
1178
1179   FrameHostMsg_RunJavaScriptMessage::WriteReplyParams(reply_msg,
1180                                                       success, user_input);
1181   Send(reply_msg);
1182
1183   // If we are waiting for an unload or beforeunload ack and the user has
1184   // suppressed messages, kill the tab immediately; a page that's spamming
1185   // alerts in onbeforeunload is presumably malicious, so there's no point in
1186   // continuing to run its script and dragging out the process.
1187   // This must be done after sending the reply since RenderView can't close
1188   // correctly while waiting for a response.
1189   if (is_waiting && dialog_was_suppressed)
1190     render_view_host_->delegate_->RendererUnresponsive(
1191         render_view_host_,
1192         render_view_host_->is_waiting_for_beforeunload_ack(),
1193         render_view_host_->IsWaitingForUnloadACK());
1194 }
1195
1196 void RenderFrameHostImpl::NotificationClosed(int notification_id) {
1197   cancel_notification_callbacks_.erase(notification_id);
1198 }
1199
1200 void RenderFrameHostImpl::PlatformNotificationPermissionRequestDone(
1201     int request_id, blink::WebNotificationPermission permission) {
1202   Send(new PlatformNotificationMsg_PermissionRequestComplete(
1203       routing_id_, request_id, permission));
1204 }
1205
1206 void RenderFrameHostImpl::SetAccessibilityMode(AccessibilityMode mode) {
1207   Send(new FrameMsg_SetAccessibilityMode(routing_id_, mode));
1208 }
1209
1210 void RenderFrameHostImpl::SetAccessibilityCallbackForTesting(
1211     const base::Callback<void(ui::AXEvent, int)>& callback) {
1212   accessibility_testing_callback_ = callback;
1213 }
1214
1215 const ui::AXTree* RenderFrameHostImpl::GetAXTreeForTesting() {
1216   return ax_tree_for_testing_.get();
1217 }
1218
1219 BrowserAccessibilityManager*
1220     RenderFrameHostImpl::GetOrCreateBrowserAccessibilityManager() {
1221   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
1222       render_view_host_->GetView());
1223   if (view &&
1224       !browser_accessibility_manager_) {
1225     browser_accessibility_manager_.reset(
1226         view->CreateBrowserAccessibilityManager(this));
1227   }
1228   return browser_accessibility_manager_.get();
1229 }
1230
1231 #if defined(OS_WIN)
1232
1233 void RenderFrameHostImpl::SetParentNativeViewAccessible(
1234     gfx::NativeViewAccessible accessible_parent) {
1235   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
1236       render_view_host_->GetView());
1237   if (view)
1238     view->SetParentNativeViewAccessible(accessible_parent);
1239 }
1240
1241 gfx::NativeViewAccessible
1242 RenderFrameHostImpl::GetParentNativeViewAccessible() const {
1243   return delegate_->GetParentNativeViewAccessible();
1244 }
1245
1246 #elif defined(OS_MACOSX)
1247
1248 void RenderFrameHostImpl::DidSelectPopupMenuItem(int selected_index) {
1249   Send(new FrameMsg_SelectPopupMenuItem(routing_id_, selected_index));
1250 }
1251
1252 void RenderFrameHostImpl::DidCancelPopupMenu() {
1253   Send(new FrameMsg_SelectPopupMenuItem(routing_id_, -1));
1254 }
1255
1256 #elif defined(OS_ANDROID)
1257
1258 void RenderFrameHostImpl::DidSelectPopupMenuItems(
1259     const std::vector<int>& selected_indices) {
1260   Send(new FrameMsg_SelectPopupMenuItems(routing_id_, false, selected_indices));
1261 }
1262
1263 void RenderFrameHostImpl::DidCancelPopupMenu() {
1264   Send(new FrameMsg_SelectPopupMenuItems(
1265       routing_id_, true, std::vector<int>()));
1266 }
1267
1268 #endif
1269
1270 void RenderFrameHostImpl::ClearPendingTransitionRequestData() {
1271   BrowserThread::PostTask(
1272       BrowserThread::IO,
1273       FROM_HERE,
1274       base::Bind(
1275           &TransitionRequestManager::ClearPendingTransitionRequestData,
1276           base::Unretained(TransitionRequestManager::GetInstance()),
1277           GetProcess()->GetID(),
1278           routing_id_));
1279 }
1280
1281 void RenderFrameHostImpl::SetNavigationsSuspended(
1282     bool suspend,
1283     const base::TimeTicks& proceed_time) {
1284   // This should only be called to toggle the state.
1285   DCHECK(navigations_suspended_ != suspend);
1286
1287   navigations_suspended_ = suspend;
1288   if (!suspend && suspended_nav_params_) {
1289     // There's navigation message params waiting to be sent. Now that we're not
1290     // suspended anymore, resume navigation by sending them. If we were swapped
1291     // out, we should also stop filtering out the IPC messages now.
1292     render_view_host_->SetState(RenderViewHostImpl::STATE_DEFAULT);
1293
1294     DCHECK(!proceed_time.is_null());
1295     suspended_nav_params_->browser_navigation_start = proceed_time;
1296     Send(new FrameMsg_Navigate(routing_id_, *suspended_nav_params_));
1297     suspended_nav_params_.reset();
1298   }
1299 }
1300
1301 void RenderFrameHostImpl::CancelSuspendedNavigations() {
1302   // Clear any state if a pending navigation is canceled or preempted.
1303   if (suspended_nav_params_)
1304     suspended_nav_params_.reset();
1305   navigations_suspended_ = false;
1306 }
1307
1308 }  // namespace content