content/renderer/render_frame_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/renderer/render_frame_impl.h"
   6
   7 #include <map>
   8 #include <string>
   9
  10 #include "base/auto_reset.h"
  11 #include "base/command_line.h"
  12 #include "base/debug/alias.h"
  13 #include "base/debug/asan_invalid_access.h"
  14 #include "base/debug/dump_without_crashing.h"
  15 #include "base/i18n/char_iterator.h"
  16 #include "base/metrics/histogram.h"
  17 #include "base/process/kill.h"
  18 #include "base/process/process.h"
  19 #include "base/strings/string16.h"
  20 #include "base/strings/utf_string_conversions.h"
  21 #include "base/time/time.h"
  22 #include "content/child/appcache/appcache_dispatcher.h"
  23 #include "content/child/plugin_messages.h"
  24 #include "content/child/quota_dispatcher.h"
  25 #include "content/child/request_extra_data.h"
  26 #include "content/child/service_worker/service_worker_network_provider.h"
  27 #include "content/child/service_worker/service_worker_provider_context.h"
  28 #include "content/child/service_worker/web_service_worker_provider_impl.h"
  29 #include "content/child/web_socket_stream_handle_impl.h"
  30 #include "content/child/web_url_loader_impl.h"
  31 #include "content/child/web_url_request_util.h"
  32 #include "content/child/webmessageportchannel_impl.h"
  33 #include "content/child/websocket_bridge.h"
  34 #include "content/child/weburlresponse_extradata_impl.h"
  35 #include "content/common/clipboard_messages.h"
  36 #include "content/common/frame_messages.h"
  37 #include "content/common/input_messages.h"
  38 #include "content/common/service_worker/service_worker_types.h"
  39 #include "content/common/socket_stream_handle_data.h"
  40 #include "content/common/swapped_out_messages.h"
  41 #include "content/common/view_messages.h"
  42 #include "content/public/common/bindings_policy.h"
  43 #include "content/public/common/content_constants.h"
  44 #include "content/public/common/content_switches.h"
  45 #include "content/public/common/context_menu_params.h"
  46 #include "content/public/common/page_state.h"
  47 #include "content/public/common/resource_response.h"
  48 #include "content/public/common/url_constants.h"
  49 #include "content/public/common/url_utils.h"
  50 #include "content/public/renderer/browser_plugin_delegate.h"
  51 #include "content/public/renderer/content_renderer_client.h"
  52 #include "content/public/renderer/context_menu_client.h"
  53 #include "content/public/renderer/document_state.h"
  54 #include "content/public/renderer/navigation_state.h"
  55 #include "content/public/renderer/render_frame_observer.h"
  56 #include "content/renderer/accessibility/renderer_accessibility.h"
  57 #include "content/renderer/accessibility/renderer_accessibility_complete.h"
  58 #include "content/renderer/accessibility/renderer_accessibility_focus_only.h"
  59 #include "content/renderer/browser_plugin/browser_plugin.h"
  60 #include "content/renderer/browser_plugin/browser_plugin_manager.h"
  61 #include "content/renderer/child_frame_compositing_helper.h"
  62 #include "content/renderer/context_menu_params_builder.h"
  63 #include "content/renderer/devtools/devtools_agent.h"
  64 #include "content/renderer/dom_automation_controller.h"
  65 #include "content/renderer/dom_utils.h"
  66 #include "content/renderer/external_popup_menu.h"
  67 #include "content/renderer/geolocation_dispatcher.h"
  68 #include "content/renderer/history_controller.h"
  69 #include "content/renderer/history_serialization.h"
  70 #include "content/renderer/image_loading_helper.h"
  71 #include "content/renderer/ime_event_guard.h"
  72 #include "content/renderer/internal_document_state_data.h"
  73 #include "content/renderer/manifest/manifest_manager.h"
  74 #include "content/renderer/media/audio_renderer_mixer_manager.h"
  75 #include "content/renderer/media/crypto/encrypted_media_player_support_impl.h"
  76 #include "content/renderer/media/media_stream_dispatcher.h"
  77 #include "content/renderer/media/media_stream_renderer_factory.h"
  78 #include "content/renderer/media/midi_dispatcher.h"
  79 #include "content/renderer/media/render_media_log.h"
  80 #include "content/renderer/media/user_media_client_impl.h"
  81 #include "content/renderer/media/webcontentdecryptionmodule_impl.h"
  82 #include "content/renderer/media/webmediaplayer_ms.h"
  83 #include "content/renderer/notification_permission_dispatcher.h"
  84 #include "content/renderer/notification_provider.h"
  85 #include "content/renderer/npapi/plugin_channel_host.h"
  86 #include "content/renderer/push_messaging_dispatcher.h"
  87 #include "content/renderer/render_frame_proxy.h"
  88 #include "content/renderer/render_process.h"
  89 #include "content/renderer/render_thread_impl.h"
  90 #include "content/renderer/render_view_impl.h"
  91 #include "content/renderer/render_widget_fullscreen_pepper.h"
  92 #include "content/renderer/renderer_webapplicationcachehost_impl.h"
  93 #include "content/renderer/renderer_webcolorchooser_impl.h"
  94 #include "content/renderer/screen_orientation/screen_orientation_dispatcher.h"
  95 #include "content/renderer/shared_worker_repository.h"
  96 #include "content/renderer/v8_value_converter_impl.h"
  97 #include "content/renderer/websharedworker_proxy.h"
  98 #include "media/base/audio_renderer_mixer_input.h"
  99 #include "media/blink/webmediaplayer_impl.h"
 100 #include "media/blink/webmediaplayer_params.h"
 101 #include "media/filters/gpu_video_accelerator_factories.h"
 102 #include "net/base/data_url.h"
 103 #include "net/base/net_errors.h"
 104 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 105 #include "net/http/http_util.h"
 106 #include "third_party/WebKit/public/platform/WebStorageQuotaCallbacks.h"
 107 #include "third_party/WebKit/public/platform/WebString.h"
 108 #include "third_party/WebKit/public/platform/WebURL.h"
 109 #include "third_party/WebKit/public/platform/WebURLError.h"
 110 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 111 #include "third_party/WebKit/public/platform/WebVector.h"
 112 #include "third_party/WebKit/public/web/WebColorSuggestion.h"
 113 #include "third_party/WebKit/public/web/WebDocument.h"
 114 #include "third_party/WebKit/public/web/WebGlyphCache.h"
 115 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 116 #include "third_party/WebKit/public/web/WebMediaStreamRegistry.h"
 117 #include "third_party/WebKit/public/web/WebNavigationPolicy.h"
 118 #include "third_party/WebKit/public/web/WebPlugin.h"
 119 #include "third_party/WebKit/public/web/WebPluginParams.h"
 120 #include "third_party/WebKit/public/web/WebRange.h"
 121 #include "third_party/WebKit/public/web/WebScriptSource.h"
 122 #include "third_party/WebKit/public/web/WebSearchableFormData.h"
 123 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 124 #include "third_party/WebKit/public/web/WebSecurityPolicy.h"
 125 #include "third_party/WebKit/public/web/WebSurroundingText.h"
 126 #include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
 127 #include "third_party/WebKit/public/web/WebView.h"
 128
 129 #if defined(ENABLE_PLUGINS)
 130 #include "content/renderer/npapi/webplugin_impl.h"
 131 #include "content/renderer/pepper/pepper_browser_connection.h"
 132 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 133 #include "content/renderer/pepper/pepper_webplugin_impl.h"
 134 #include "content/renderer/pepper/plugin_module.h"
 135 #endif
 136
 137 #if defined(ENABLE_WEBRTC)
 138 #include "content/renderer/media/rtc_peer_connection_handler.h"
 139 #endif
 140
 141 #if defined(OS_ANDROID)
 142 #include <cpu-features.h>
 143
 144 #include "content/common/gpu/client/context_provider_command_buffer.h"
 145 #include "content/renderer/android/synchronous_compositor_factory.h"
 146 #include "content/renderer/java/gin_java_bridge_dispatcher.h"
 147 #include "content/renderer/media/android/renderer_media_player_manager.h"
 148 #include "content/renderer/media/android/stream_texture_factory_impl.h"
 149 #include "content/renderer/media/android/webmediaplayer_android.h"
 150 #endif
 151
 152 #if defined(ENABLE_BROWSER_CDMS)
 153 #include "content/renderer/media/crypto/renderer_cdm_manager.h"
 154 #endif
 155
 156 using blink::WebContextMenuData;
 157 using blink::WebData;
 158 using blink::WebDataSource;
 159 using blink::WebDocument;
 160 using blink::WebElement;
 161 using blink::WebExternalPopupMenu;
 162 using blink::WebExternalPopupMenuClient;
 163 using blink::WebFrame;
 164 using blink::WebHistoryItem;
 165 using blink::WebHTTPBody;
 166 using blink::WebLocalFrame;
 167 using blink::WebMediaPlayer;
 168 using blink::WebMediaPlayerClient;
 169 using blink::WebNavigationPolicy;
 170 using blink::WebNavigationType;
 171 using blink::WebNode;
 172 using blink::WebPluginParams;
 173 using blink::WebPopupMenuInfo;
 174 using blink::WebRange;
 175 using blink::WebReferrerPolicy;
 176 using blink::WebScriptSource;
 177 using blink::WebSearchableFormData;
 178 using blink::WebSecurityOrigin;
 179 using blink::WebSecurityPolicy;
 180 using blink::WebServiceWorkerProvider;
 181 using blink::WebStorageQuotaCallbacks;
 182 using blink::WebString;
 183 using blink::WebURL;
 184 using blink::WebURLError;
 185 using blink::WebURLRequest;
 186 using blink::WebURLResponse;
 187 using blink::WebUserGestureIndicator;
 188 using blink::WebVector;
 189 using blink::WebView;
 190 using base::Time;
 191 using base::TimeDelta;
 192
 193 namespace content {
 194
 195 namespace {
 196
 197 const char kDefaultAcceptHeader[] =
 198     "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/"
 199     "*;q=0.8";
 200 const char kAcceptHeader[] = "Accept";
 201
 202 const size_t kExtraCharsBeforeAndAfterSelection = 100;
 203
 204 typedef std::map<int, RenderFrameImpl*> RoutingIDFrameMap;
 205 static base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
 206     LAZY_INSTANCE_INITIALIZER;
 207
 208 typedef std::map<blink::WebFrame*, RenderFrameImpl*> FrameMap;
 209 base::LazyInstance<FrameMap> g_frame_map = LAZY_INSTANCE_INITIALIZER;
 210
 211 int64 ExtractPostId(const WebHistoryItem& item) {
 212   if (item.isNull())
 213     return -1;
 214
 215   if (item.httpBody().isNull())
 216     return -1;
 217
 218   return item.httpBody().identifier();
 219 }
 220
 221 WebURLResponseExtraDataImpl* GetExtraDataFromResponse(
 222     const WebURLResponse& response) {
 223   return static_cast<WebURLResponseExtraDataImpl*>(response.extraData());
 224 }
 225
 226 void GetRedirectChain(WebDataSource* ds, std::vector<GURL>* result) {
 227   // Replace any occurrences of swappedout:// with about:blank.
 228   const WebURL& blank_url = GURL(url::kAboutBlankURL);
 229   WebVector<WebURL> urls;
 230   ds->redirectChain(urls);
 231   result->reserve(urls.size());
 232   for (size_t i = 0; i < urls.size(); ++i) {
 233     if (urls[i] != GURL(kSwappedOutURL))
 234       result->push_back(urls[i]);
 235     else
 236       result->push_back(blank_url);
 237   }
 238 }
 239
 240 // Returns the original request url. If there is no redirect, the original
 241 // url is the same as ds->request()->url(). If the WebDataSource belongs to a
 242 // frame was loaded by loadData, the original url will be ds->unreachableURL()
 243 static GURL GetOriginalRequestURL(WebDataSource* ds) {
 244   // WebDataSource has unreachable URL means that the frame is loaded through
 245   // blink::WebFrame::loadData(), and the base URL will be in the redirect
 246   // chain. However, we never visited the baseURL. So in this case, we should
 247   // use the unreachable URL as the original URL.
 248   if (ds->hasUnreachableURL())
 249     return ds->unreachableURL();
 250
 251   std::vector<GURL> redirects;
 252   GetRedirectChain(ds, &redirects);
 253   if (!redirects.empty())
 254     return redirects.at(0);
 255
 256   return ds->originalRequest().url();
 257 }
 258
 259 NOINLINE static void CrashIntentionally() {
 260   // NOTE(shess): Crash directly rather than using NOTREACHED() so
 261   // that the signature is easier to triage in crash reports.
 262   volatile int* zero = NULL;
 263   *zero = 0;
 264 }
 265
 266 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 267 NOINLINE static void MaybeTriggerAsanError(const GURL& url) {
 268   // NOTE(rogerm): We intentionally perform an invalid heap access here in
 269   //     order to trigger an Address Sanitizer (ASAN) error report.
 270   const char kCrashDomain[] = "crash";
 271   const char kHeapOverflow[] = "/heap-overflow";
 272   const char kHeapUnderflow[] = "/heap-underflow";
 273   const char kUseAfterFree[] = "/use-after-free";
 274 #if defined(SYZYASAN)
 275   const char kCorruptHeapBlock[] = "/corrupt-heap-block";
 276   const char kCorruptHeap[] = "/corrupt-heap";
 277 #endif
 278
 279   if (!url.DomainIs(kCrashDomain, sizeof(kCrashDomain) - 1))
 280     return;
 281
 282   if (!url.has_path())
 283     return;
 284
 285   std::string crash_type(url.path());
 286   if (crash_type == kHeapOverflow) {
 287     base::debug::AsanHeapOverflow();
 288   } else if (crash_type == kHeapUnderflow ) {
 289     base::debug::AsanHeapUnderflow();
 290   } else if (crash_type == kUseAfterFree) {
 291     base::debug::AsanHeapUseAfterFree();
 292 #if defined(SYZYASAN)
 293   } else if (crash_type == kCorruptHeapBlock) {
 294     base::debug::AsanCorruptHeapBlock();
 295   } else if (crash_type == kCorruptHeap) {
 296     base::debug::AsanCorruptHeap();
 297 #endif
 298   }
 299 }
 300 #endif  // ADDRESS_SANITIZER || SYZYASAN
 301
 302 static void MaybeHandleDebugURL(const GURL& url) {
 303   if (!url.SchemeIs(kChromeUIScheme))
 304     return;
 305   if (url == GURL(kChromeUICrashURL)) {
 306     CrashIntentionally();
 307   } else if (url == GURL(kChromeUIDumpURL)) {
 308     // This URL will only correctly create a crash dump file if content is
 309     // hosted in a process that has correctly called
 310     // base::debug::SetDumpWithoutCrashingFunction.  Refer to the documentation
 311     // of base::debug::DumpWithoutCrashing for more details.
 312     base::debug::DumpWithoutCrashing();
 313   } else if (url == GURL(kChromeUIKillURL)) {
 314     base::KillProcess(base::GetCurrentProcessHandle(), 1, false);
 315   } else if (url == GURL(kChromeUIHangURL)) {
 316     for (;;) {
 317       base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1));
 318     }
 319   } else if (url == GURL(kChromeUIShorthangURL)) {
 320     base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(20));
 321   }
 322
 323 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 324   MaybeTriggerAsanError(url);
 325 #endif  // ADDRESS_SANITIZER || SYZYASAN
 326 }
 327
 328 // Returns false unless this is a top-level navigation.
 329 static bool IsTopLevelNavigation(WebFrame* frame) {
 330   return frame->parent() == NULL;
 331 }
 332
 333 // Returns false unless this is a top-level navigation that crosses origins.
 334 static bool IsNonLocalTopLevelNavigation(const GURL& url,
 335                                          WebFrame* frame,
 336                                          WebNavigationType type,
 337                                          bool is_form_post) {
 338   if (!IsTopLevelNavigation(frame))
 339     return false;
 340
 341   // Navigations initiated within Webkit are not sent out to the external host
 342   // in the following cases.
 343   // 1. The url scheme is not http/https
 344   // 2. The origin of the url and the opener is the same in which case the
 345   //    opener relationship is maintained.
 346   // 3. Reloads/form submits/back forward navigations
 347   if (!url.SchemeIs(url::kHttpScheme) && !url.SchemeIs(url::kHttpsScheme))
 348     return false;
 349
 350   if (type != blink::WebNavigationTypeReload &&
 351       type != blink::WebNavigationTypeBackForward && !is_form_post) {
 352     // The opener relationship between the new window and the parent allows the
 353     // new window to script the parent and vice versa. This is not allowed if
 354     // the origins of the two domains are different. This can be treated as a
 355     // top level navigation and routed back to the host.
 356     blink::WebFrame* opener = frame->opener();
 357     if (!opener)
 358       return true;
 359
 360     if (url.GetOrigin() != GURL(opener->document().url()).GetOrigin())
 361       return true;
 362   }
 363   return false;
 364 }
 365
 366 WebURLRequest CreateURLRequestForNavigation(
 367     const CommonNavigationParams& params,
 368     scoped_ptr<StreamOverrideParameters> stream_override,
 369     bool is_view_source_mode_enabled) {
 370   WebURLRequest request(params.url);
 371   if (is_view_source_mode_enabled)
 372     request.setCachePolicy(WebURLRequest::ReturnCacheDataElseLoad);
 373
 374   if (params.referrer.url.is_valid()) {
 375     WebString web_referrer = WebSecurityPolicy::generateReferrerHeader(
 376         params.referrer.policy,
 377         params.url,
 378         WebString::fromUTF8(params.referrer.url.spec()));
 379     if (!web_referrer.isEmpty())
 380       request.setHTTPReferrer(web_referrer, params.referrer.policy);
 381   }
 382
 383   RequestExtraData* extra_data = new RequestExtraData();
 384   extra_data->set_stream_override(stream_override.Pass());
 385   request.setExtraData(extra_data);
 386   return request;
 387 }
 388
 389 void UpdateFrameNavigationTiming(WebFrame* frame,
 390                                  base::TimeTicks browser_navigation_start,
 391                                  base::TimeTicks renderer_navigation_start) {
 392   // The browser provides the navigation_start time to bootstrap the
 393   // Navigation Timing information for the browser-initiated navigations. In
 394   // case of cross-process navigations, this carries over the time of
 395   // finishing the onbeforeunload handler of the previous page.
 396   DCHECK(!browser_navigation_start.is_null());
 397   if (frame->provisionalDataSource()) {
 398     // |browser_navigation_start| is likely before this process existed, so we
 399     // can't use InterProcessTimeTicksConverter. We need at least to ensure
 400     // that the browser-side navigation start we set is not later than the one
 401     // on the renderer side.
 402     base::TimeTicks navigation_start = std::min(
 403         browser_navigation_start, renderer_navigation_start);
 404     double navigation_start_seconds =
 405         (navigation_start - base::TimeTicks()).InSecondsF();
 406     frame->provisionalDataSource()->setNavigationStartTime(
 407         navigation_start_seconds);
 408     // TODO(clamy): We need to provide additional timing values for the
 409     // Navigation Timing API to work with browser-side navigations.
 410   }
 411 }
 412
 413 }  // namespace
 414
 415 static RenderFrameImpl* (*g_create_render_frame_impl)(RenderViewImpl*, int32) =
 416     NULL;
 417
 418 // static
 419 RenderFrameImpl* RenderFrameImpl::Create(RenderViewImpl* render_view,
 420                                          int32 routing_id) {
 421   DCHECK(routing_id != MSG_ROUTING_NONE);
 422
 423   if (g_create_render_frame_impl)
 424     return g_create_render_frame_impl(render_view, routing_id);
 425   else
 426     return new RenderFrameImpl(render_view, routing_id);
 427 }
 428
 429 // static
 430 RenderFrameImpl* RenderFrameImpl::FromRoutingID(int32 routing_id) {
 431   RoutingIDFrameMap::iterator iter =
 432       g_routing_id_frame_map.Get().find(routing_id);
 433   if (iter != g_routing_id_frame_map.Get().end())
 434     return iter->second;
 435   return NULL;
 436 }
 437
 438 // static
 439 void RenderFrameImpl::CreateFrame(int routing_id, int parent_routing_id) {
 440   // TODO(nasko): For now, this message is only sent for subframes, as the
 441   // top level frame is created when the RenderView is created through the
 442   // ViewMsg_New IPC.
 443   CHECK_NE(MSG_ROUTING_NONE, parent_routing_id);
 444
 445   RenderFrameProxy* proxy = RenderFrameProxy::FromRoutingID(parent_routing_id);
 446
 447   // If the browser is sending a valid parent routing id, it should already be
 448   // created and registered.
 449   CHECK(proxy);
 450   blink::WebRemoteFrame* parent_web_frame = proxy->web_frame();
 451
 452   // Create the RenderFrame and WebLocalFrame, linking the two.
 453   RenderFrameImpl* render_frame =
 454       RenderFrameImpl::Create(proxy->render_view(), routing_id);
 455   blink::WebLocalFrame* web_frame =
 456       parent_web_frame->createLocalChild("", render_frame);
 457   render_frame->SetWebFrame(web_frame);
 458   render_frame->Initialize();
 459 }
 460
 461 // static
 462 RenderFrame* RenderFrame::FromWebFrame(blink::WebFrame* web_frame) {
 463   return RenderFrameImpl::FromWebFrame(web_frame);
 464 }
 465
 466 // static
 467 RenderFrameImpl* RenderFrameImpl::FromWebFrame(blink::WebFrame* web_frame) {
 468   FrameMap::iterator iter = g_frame_map.Get().find(web_frame);
 469   if (iter != g_frame_map.Get().end())
 470     return iter->second;
 471   return NULL;
 472 }
 473
 474 // static
 475 void RenderFrameImpl::InstallCreateHook(
 476     RenderFrameImpl* (*create_render_frame_impl)(RenderViewImpl*, int32)) {
 477   CHECK(!g_create_render_frame_impl);
 478   g_create_render_frame_impl = create_render_frame_impl;
 479 }
 480
 481 // RenderFrameImpl ----------------------------------------------------------
 482 RenderFrameImpl::RenderFrameImpl(RenderViewImpl* render_view, int routing_id)
 483     : frame_(NULL),
 484       render_view_(render_view->AsWeakPtr()),
 485       routing_id_(routing_id),
 486       is_swapped_out_(false),
 487       render_frame_proxy_(NULL),
 488       is_detaching_(false),
 489       cookie_jar_(this),
 490       selection_text_offset_(0),
 491       selection_range_(gfx::Range::InvalidRange()),
 492       handling_select_range_(false),
 493       notification_permission_dispatcher_(NULL),
 494       notification_provider_(NULL),
 495       web_user_media_client_(NULL),
 496       midi_dispatcher_(NULL),
 497 #if defined(OS_ANDROID)
 498       media_player_manager_(NULL),
 499 #endif
 500 #if defined(ENABLE_BROWSER_CDMS)
 501       cdm_manager_(NULL),
 502 #endif
 503 #if defined(VIDEO_HOLE)
 504       contains_media_player_(false),
 505 #endif
 506       geolocation_dispatcher_(NULL),
 507       push_messaging_dispatcher_(NULL),
 508       screen_orientation_dispatcher_(NULL),
 509       manifest_manager_(NULL),
 510       accessibility_mode_(AccessibilityModeOff),
 511       renderer_accessibility_(NULL),
 512       weak_factory_(this) {
 513   std::pair<RoutingIDFrameMap::iterator, bool> result =
 514       g_routing_id_frame_map.Get().insert(std::make_pair(routing_id_, this));
 515   CHECK(result.second) << "Inserting a duplicate item.";
 516
 517   RenderThread::Get()->AddRoute(routing_id_, this);
 518
 519   render_view_->RegisterRenderFrame(this);
 520
 521 #if defined(OS_ANDROID)
 522   new GinJavaBridgeDispatcher(this);
 523 #endif
 524
 525 #if defined(ENABLE_NOTIFICATIONS)
 526   notification_provider_ = new NotificationProvider(this);
 527 #endif
 528
 529   manifest_manager_ = new ManifestManager(this);
 530 }
 531
 532 RenderFrameImpl::~RenderFrameImpl() {
 533   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, RenderFrameGone());
 534   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnDestruct());
 535
 536 #if defined(VIDEO_HOLE)
 537   if (contains_media_player_)
 538     render_view_->UnregisterVideoHoleFrame(this);
 539 #endif
 540
 541   render_view_->UnregisterRenderFrame(this);
 542   g_routing_id_frame_map.Get().erase(routing_id_);
 543   RenderThread::Get()->RemoveRoute(routing_id_);
 544 }
 545
 546 void RenderFrameImpl::SetWebFrame(blink::WebLocalFrame* web_frame) {
 547   DCHECK(!frame_);
 548
 549   std::pair<FrameMap::iterator, bool> result = g_frame_map.Get().insert(
 550       std::make_pair(web_frame, this));
 551   CHECK(result.second) << "Inserting a duplicate item.";
 552
 553   frame_ = web_frame;
 554 }
 555
 556 void RenderFrameImpl::Initialize() {
 557 #if defined(ENABLE_PLUGINS)
 558   new PepperBrowserConnection(this);
 559 #endif
 560   new SharedWorkerRepository(this);
 561
 562   if (!frame_->parent())
 563     new ImageLoadingHelper(this);
 564
 565   // We delay calling this until we have the WebFrame so that any observer or
 566   // embedder can call GetWebFrame on any RenderFrame.
 567   GetContentClient()->renderer()->RenderFrameCreated(this);
 568 }
 569
 570 RenderWidget* RenderFrameImpl::GetRenderWidget() {
 571   return render_view_.get();
 572 }
 573
 574 #if defined(ENABLE_PLUGINS)
 575 void RenderFrameImpl::PepperPluginCreated(RendererPpapiHost* host) {
 576   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
 577                     DidCreatePepperPlugin(host));
 578 }
 579
 580 void RenderFrameImpl::PepperDidChangeCursor(
 581     PepperPluginInstanceImpl* instance,
 582     const blink::WebCursorInfo& cursor) {
 583   // Update the cursor appearance immediately if the requesting plugin is the
 584   // one which receives the last mouse event. Otherwise, the new cursor won't be
 585   // picked up until the plugin gets the next input event. That is bad if, e.g.,
 586   // the plugin would like to set an invisible cursor when there isn't any user
 587   // input for a while.
 588   if (instance == render_view_->pepper_last_mouse_event_target())
 589     GetRenderWidget()->didChangeCursor(cursor);
 590 }
 591
 592 void RenderFrameImpl::PepperDidReceiveMouseEvent(
 593     PepperPluginInstanceImpl* instance) {
 594   render_view_->set_pepper_last_mouse_event_target(instance);
 595 }
 596
 597 void RenderFrameImpl::PepperTextInputTypeChanged(
 598     PepperPluginInstanceImpl* instance) {
 599   if (instance != render_view_->focused_pepper_plugin())
 600     return;
 601
 602   GetRenderWidget()->UpdateTextInputState(
 603       RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
 604   if (renderer_accessibility())
 605     renderer_accessibility()->FocusedNodeChanged(WebNode());
 606 }
 607
 608 void RenderFrameImpl::PepperCaretPositionChanged(
 609     PepperPluginInstanceImpl* instance) {
 610   if (instance != render_view_->focused_pepper_plugin())
 611     return;
 612   GetRenderWidget()->UpdateSelectionBounds();
 613 }
 614
 615 void RenderFrameImpl::PepperCancelComposition(
 616     PepperPluginInstanceImpl* instance) {
 617   if (instance != render_view_->focused_pepper_plugin())
 618     return;
 619   Send(new InputHostMsg_ImeCancelComposition(render_view_->GetRoutingID()));;
 620 #if defined(OS_MACOSX) || defined(USE_AURA)
 621   GetRenderWidget()->UpdateCompositionInfo(true);
 622 #endif
 623 }
 624
 625 void RenderFrameImpl::PepperSelectionChanged(
 626     PepperPluginInstanceImpl* instance) {
 627   if (instance != render_view_->focused_pepper_plugin())
 628     return;
 629   SyncSelectionIfRequired();
 630 }
 631
 632 RenderWidgetFullscreenPepper* RenderFrameImpl::CreatePepperFullscreenContainer(
 633     PepperPluginInstanceImpl* plugin) {
 634   GURL active_url;
 635   if (render_view_->webview() && render_view_->webview()->mainFrame())
 636     active_url = GURL(render_view_->webview()->mainFrame()->document().url());
 637   RenderWidgetFullscreenPepper* widget = RenderWidgetFullscreenPepper::Create(
 638       GetRenderWidget()->routing_id(), plugin, active_url,
 639       GetRenderWidget()->screenInfo());
 640   widget->show(blink::WebNavigationPolicyIgnore);
 641   return widget;
 642 }
 643
 644 bool RenderFrameImpl::IsPepperAcceptingCompositionEvents() const {
 645   if (!render_view_->focused_pepper_plugin())
 646     return false;
 647   return render_view_->focused_pepper_plugin()->
 648       IsPluginAcceptingCompositionEvents();
 649 }
 650
 651 void RenderFrameImpl::PluginCrashed(const base::FilePath& plugin_path,
 652                                    base::ProcessId plugin_pid) {
 653   // TODO(jam): dispatch this IPC in RenderFrameHost and switch to use
 654   // routing_id_ as a result.
 655   Send(new FrameHostMsg_PluginCrashed(routing_id_, plugin_path, plugin_pid));
 656 }
 657
 658 void RenderFrameImpl::SimulateImeSetComposition(
 659     const base::string16& text,
 660     const std::vector<blink::WebCompositionUnderline>& underlines,
 661     int selection_start,
 662     int selection_end) {
 663   render_view_->OnImeSetComposition(
 664       text, underlines, selection_start, selection_end);
 665 }
 666
 667 void RenderFrameImpl::SimulateImeConfirmComposition(
 668     const base::string16& text,
 669     const gfx::Range& replacement_range) {
 670   render_view_->OnImeConfirmComposition(text, replacement_range, false);
 671 }
 672
 673
 674 void RenderFrameImpl::OnImeSetComposition(
 675     const base::string16& text,
 676     const std::vector<blink::WebCompositionUnderline>& underlines,
 677     int selection_start,
 678     int selection_end) {
 679   // When a PPAPI plugin has focus, we bypass WebKit.
 680   if (!IsPepperAcceptingCompositionEvents()) {
 681     pepper_composition_text_ = text;
 682   } else {
 683     // TODO(kinaba) currently all composition events are sent directly to
 684     // plugins. Use DOM event mechanism after WebKit is made aware about
 685     // plugins that support composition.
 686     // The code below mimics the behavior of WebCore::Editor::setComposition.
 687
 688     // Empty -> nonempty: composition started.
 689     if (pepper_composition_text_.empty() && !text.empty()) {
 690       render_view_->focused_pepper_plugin()->HandleCompositionStart(
 691           base::string16());
 692     }
 693     // Nonempty -> empty: composition canceled.
 694     if (!pepper_composition_text_.empty() && text.empty()) {
 695       render_view_->focused_pepper_plugin()->HandleCompositionEnd(
 696           base::string16());
 697     }
 698     pepper_composition_text_ = text;
 699     // Nonempty: composition is ongoing.
 700     if (!pepper_composition_text_.empty()) {
 701       render_view_->focused_pepper_plugin()->HandleCompositionUpdate(
 702           pepper_composition_text_, underlines, selection_start,
 703           selection_end);
 704     }
 705   }
 706 }
 707
 708 void RenderFrameImpl::OnImeConfirmComposition(
 709     const base::string16& text,
 710     const gfx::Range& replacement_range,
 711     bool keep_selection) {
 712   // When a PPAPI plugin has focus, we bypass WebKit.
 713   // Here, text.empty() has a special meaning. It means to commit the last
 714   // update of composition text (see
 715   // RenderWidgetHost::ImeConfirmComposition()).
 716   const base::string16& last_text = text.empty() ? pepper_composition_text_
 717                                                  : text;
 718
 719   // last_text is empty only when both text and pepper_composition_text_ is.
 720   // Ignore it.
 721   if (last_text.empty())
 722     return;
 723
 724   if (!IsPepperAcceptingCompositionEvents()) {
 725     base::i18n::UTF16CharIterator iterator(&last_text);
 726     int32 i = 0;
 727     while (iterator.Advance()) {
 728       blink::WebKeyboardEvent char_event;
 729       char_event.type = blink::WebInputEvent::Char;
 730       char_event.timeStampSeconds = base::Time::Now().ToDoubleT();
 731       char_event.modifiers = 0;
 732       char_event.windowsKeyCode = last_text[i];
 733       char_event.nativeKeyCode = last_text[i];
 734
 735       const int32 char_start = i;
 736       for (; i < iterator.array_pos(); ++i) {
 737         char_event.text[i - char_start] = last_text[i];
 738         char_event.unmodifiedText[i - char_start] = last_text[i];
 739       }
 740
 741       if (GetRenderWidget()->webwidget())
 742         GetRenderWidget()->webwidget()->handleInputEvent(char_event);
 743     }
 744   } else {
 745     // Mimics the order of events sent by WebKit.
 746     // See WebCore::Editor::setComposition() for the corresponding code.
 747     render_view_->focused_pepper_plugin()->HandleCompositionEnd(last_text);
 748     render_view_->focused_pepper_plugin()->HandleTextInput(last_text);
 749   }
 750   pepper_composition_text_.clear();
 751 }
 752
 753 #endif  // ENABLE_PLUGINS
 754
 755 MediaStreamDispatcher* RenderFrameImpl::GetMediaStreamDispatcher() {
 756   if (!web_user_media_client_)
 757     InitializeUserMediaClient();
 758   return web_user_media_client_ ?
 759       web_user_media_client_->media_stream_dispatcher() : NULL;
 760 }
 761
 762 bool RenderFrameImpl::Send(IPC::Message* message) {
 763   if (is_detaching_) {
 764     delete message;
 765     return false;
 766   }
 767   if (frame_->parent() == NULL &&
 768       (is_swapped_out_ || render_view_->is_swapped_out())) {
 769     if (!SwappedOutMessages::CanSendWhileSwappedOut(message)) {
 770       delete message;
 771       return false;
 772     }
 773
 774     // In most cases, send IPCs through the proxy when swapped out. In some
 775     // calls the associated RenderViewImpl routing id is used to send
 776     // messages, so don't use the proxy.
 777     if (render_frame_proxy_ && message->routing_id() == routing_id_)
 778       return render_frame_proxy_->Send(message);
 779   }
 780
 781   return RenderThread::Get()->Send(message);
 782 }
 783
 784 #if defined(OS_MACOSX) || defined(OS_ANDROID)
 785 void RenderFrameImpl::DidHideExternalPopupMenu() {
 786   // We need to clear external_popup_menu_ as soon as ExternalPopupMenu::close
 787   // is called. Otherwise, createExternalPopupMenu() for new popup will fail.
 788   external_popup_menu_.reset();
 789 }
 790 #endif
 791
 792 bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
 793   // TODO(kenrb): document() should not be null, but as a transitional step
 794   // we have RenderFrameProxy 'wrapping' a RenderFrameImpl, passing messages
 795   // to this method. This happens for a top-level remote frame, where a
 796   // document-less RenderFrame is replaced by a RenderFrameProxy but kept
 797   // around and is still able to receive messages.
 798   if (!frame_->document().isNull())
 799     GetContentClient()->SetActiveURL(frame_->document().url());
 800
 801   ObserverListBase<RenderFrameObserver>::Iterator it(observers_);
 802   RenderFrameObserver* observer;
 803   while ((observer = it.GetNext()) != NULL) {
 804     if (observer->OnMessageReceived(msg))
 805       return true;
 806   }
 807
 808   bool handled = true;
 809   IPC_BEGIN_MESSAGE_MAP(RenderFrameImpl, msg)
 810     IPC_MESSAGE_HANDLER(FrameMsg_Navigate, OnNavigate)
 811     IPC_MESSAGE_HANDLER(FrameMsg_BeforeUnload, OnBeforeUnload)
 812     IPC_MESSAGE_HANDLER(FrameMsg_SwapOut, OnSwapOut)
 813     IPC_MESSAGE_HANDLER(FrameMsg_Stop, OnStop)
 814     IPC_MESSAGE_HANDLER(FrameMsg_ContextMenuClosed, OnContextMenuClosed)
 815     IPC_MESSAGE_HANDLER(FrameMsg_CustomContextMenuAction,
 816                         OnCustomContextMenuAction)
 817     IPC_MESSAGE_HANDLER(InputMsg_Undo, OnUndo)
 818     IPC_MESSAGE_HANDLER(InputMsg_Redo, OnRedo)
 819     IPC_MESSAGE_HANDLER(InputMsg_Cut, OnCut)
 820     IPC_MESSAGE_HANDLER(InputMsg_Copy, OnCopy)
 821     IPC_MESSAGE_HANDLER(InputMsg_Paste, OnPaste)
 822     IPC_MESSAGE_HANDLER(InputMsg_PasteAndMatchStyle, OnPasteAndMatchStyle)
 823     IPC_MESSAGE_HANDLER(InputMsg_Delete, OnDelete)
 824     IPC_MESSAGE_HANDLER(InputMsg_SelectAll, OnSelectAll)
 825     IPC_MESSAGE_HANDLER(InputMsg_SelectRange, OnSelectRange)
 826     IPC_MESSAGE_HANDLER(InputMsg_Unselect, OnUnselect)
 827     IPC_MESSAGE_HANDLER(InputMsg_Replace, OnReplace)
 828     IPC_MESSAGE_HANDLER(InputMsg_ReplaceMisspelling, OnReplaceMisspelling)
 829     IPC_MESSAGE_HANDLER(InputMsg_ExtendSelectionAndDelete,
 830                         OnExtendSelectionAndDelete)
 831     IPC_MESSAGE_HANDLER(InputMsg_SetCompositionFromExistingText,
 832                         OnSetCompositionFromExistingText)
 833     IPC_MESSAGE_HANDLER(FrameMsg_CSSInsertRequest, OnCSSInsertRequest)
 834     IPC_MESSAGE_HANDLER(FrameMsg_JavaScriptExecuteRequest,
 835                         OnJavaScriptExecuteRequest)
 836     IPC_MESSAGE_HANDLER(FrameMsg_JavaScriptExecuteRequestForTests,
 837                         OnJavaScriptExecuteRequestForTests)
 838     IPC_MESSAGE_HANDLER(FrameMsg_SetEditableSelectionOffsets,
 839                         OnSetEditableSelectionOffsets)
 840     IPC_MESSAGE_HANDLER(FrameMsg_SetupTransitionView, OnSetupTransitionView)
 841     IPC_MESSAGE_HANDLER(FrameMsg_BeginExitTransition, OnBeginExitTransition)
 842     IPC_MESSAGE_HANDLER(FrameMsg_Reload, OnReload)
 843     IPC_MESSAGE_HANDLER(FrameMsg_TextSurroundingSelectionRequest,
 844                         OnTextSurroundingSelectionRequest)
 845     IPC_MESSAGE_HANDLER(FrameMsg_AddStyleSheetByURL,
 846                         OnAddStyleSheetByURL)
 847     IPC_MESSAGE_HANDLER(FrameMsg_SetAccessibilityMode,
 848                         OnSetAccessibilityMode)
 849     IPC_MESSAGE_HANDLER(FrameMsg_DisownOpener, OnDisownOpener)
 850     IPC_MESSAGE_HANDLER(FrameMsg_CommitNavigation, OnCommitNavigation)
 851 #if defined(OS_ANDROID)
 852     IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItems, OnSelectPopupMenuItems)
 853 #elif defined(OS_MACOSX)
 854     IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItem, OnSelectPopupMenuItem)
 855     IPC_MESSAGE_HANDLER(InputMsg_CopyToFindPboard, OnCopyToFindPboard)
 856 #endif
 857   IPC_END_MESSAGE_MAP()
 858
 859   return handled;
 860 }
 861
 862 void RenderFrameImpl::OnNavigate(const FrameMsg_Navigate_Params& params) {
 863   TRACE_EVENT2("navigation", "RenderFrameImpl::OnNavigate",
 864                "id", routing_id_,
 865                "url", params.common_params.url.possibly_invalid_spec());
 866   bool is_reload =
 867       RenderViewImpl::IsReload(params.common_params.navigation_type);
 868   WebURLRequest::CachePolicy cache_policy =
 869       WebURLRequest::UseProtocolCachePolicy;
 870   if (!RenderFrameImpl::PrepareRenderViewForNavigation(
 871       params.common_params.url, params.common_params.navigation_type,
 872       params.commit_params.page_state, true, params.pending_history_list_offset,
 873       params.page_id, &is_reload, &cache_policy)) {
 874     return;
 875   }
 876
 877   int pending_history_list_offset = params.pending_history_list_offset;
 878   int current_history_list_offset = params.current_history_list_offset;
 879   int current_history_list_length = params.current_history_list_length;
 880   if (params.should_clear_history_list) {
 881     CHECK_EQ(pending_history_list_offset, -1);
 882     CHECK_EQ(current_history_list_offset, -1);
 883     CHECK_EQ(current_history_list_length, 0);
 884   }
 885   render_view_->history_list_offset_ = current_history_list_offset;
 886   render_view_->history_list_length_ = current_history_list_length;
 887   if (render_view_->history_list_length_ >= 0) {
 888     render_view_->history_page_ids_.resize(
 889         render_view_->history_list_length_, -1);
 890   }
 891   if (pending_history_list_offset >= 0 &&
 892       pending_history_list_offset < render_view_->history_list_length_) {
 893     render_view_->history_page_ids_[pending_history_list_offset] =
 894         params.page_id;
 895   }
 896
 897   GetContentClient()->SetActiveURL(params.common_params.url);
 898
 899   WebFrame* frame = frame_;
 900   if (!params.frame_to_navigate.empty()) {
 901     // TODO(nasko): Move this lookup to the browser process.
 902     frame = render_view_->webview()->findFrameByName(
 903         WebString::fromUTF8(params.frame_to_navigate));
 904     CHECK(frame) << "Invalid frame name passed: " << params.frame_to_navigate;
 905   }
 906
 907   if (is_reload && !render_view_->history_controller()->GetCurrentEntry()) {
 908     // We cannot reload if we do not have any history state.  This happens, for
 909     // example, when recovering from a crash.
 910     is_reload = false;
 911     cache_policy = WebURLRequest::ReloadIgnoringCacheData;
 912   }
 913
 914   render_view_->pending_navigation_params_.reset(
 915       new FrameMsg_Navigate_Params(params));
 916
 917   // If we are reloading, then WebKit will use the history state of the current
 918   // page, so we should just ignore any given history state.  Otherwise, if we
 919   // have history state, then we need to navigate to it, which corresponds to a
 920   // back/forward navigation event.
 921   if (is_reload) {
 922     bool reload_original_url =
 923         (params.common_params.navigation_type ==
 924          FrameMsg_Navigate_Type::RELOAD_ORIGINAL_REQUEST_URL);
 925     bool ignore_cache = (params.common_params.navigation_type ==
 926                          FrameMsg_Navigate_Type::RELOAD_IGNORING_CACHE);
 927
 928     if (reload_original_url)
 929       frame->reloadWithOverrideURL(params.common_params.url, true);
 930     else
 931       frame->reload(ignore_cache);
 932   } else if (params.commit_params.page_state.IsValid()) {
 933     // We must know the page ID of the page we are navigating back to.
 934     DCHECK_NE(params.page_id, -1);
 935     scoped_ptr<HistoryEntry> entry =
 936         PageStateToHistoryEntry(params.commit_params.page_state);
 937     if (entry) {
 938       // Ensure we didn't save the swapped out URL in UpdateState, since the
 939       // browser should never be telling us to navigate to swappedout://.
 940       CHECK(entry->root().urlString() != WebString::fromUTF8(kSwappedOutURL));
 941       render_view_->history_controller()->GoToEntry(entry.Pass(), cache_policy);
 942     }
 943   } else if (!params.base_url_for_data_url.is_empty()) {
 944     // A loadData request with a specified base URL.
 945     std::string mime_type, charset, data;
 946     if (net::DataURL::Parse(
 947             params.common_params.url, &mime_type, &charset, &data)) {
 948       frame->loadData(
 949           WebData(data.c_str(), data.length()),
 950           WebString::fromUTF8(mime_type),
 951           WebString::fromUTF8(charset),
 952           params.base_url_for_data_url,
 953           params.history_url_for_data_url,
 954           false);
 955     } else {
 956       CHECK(false) << "Invalid URL passed: "
 957                    << params.common_params.url.possibly_invalid_spec();
 958     }
 959   } else {
 960     // Navigate to the given URL.
 961     WebURLRequest request = CreateURLRequestForNavigation(
 962         params.common_params, scoped_ptr<StreamOverrideParameters>(),
 963         frame->isViewSourceModeEnabled());
 964
 965     // A session history navigation should have been accompanied by state.
 966     CHECK_EQ(params.page_id, -1);
 967
 968     if (!params.request_params.extra_headers.empty()) {
 969       for (net::HttpUtil::HeadersIterator i(
 970                params.request_params.extra_headers.begin(),
 971                params.request_params.extra_headers.end(),
 972                "\n");
 973            i.GetNext();) {
 974         request.addHTTPHeaderField(WebString::fromUTF8(i.name()),
 975                                    WebString::fromUTF8(i.values()));
 976       }
 977     }
 978
 979     if (params.request_params.is_post) {
 980       request.setHTTPMethod(WebString::fromUTF8("POST"));
 981
 982       // Set post data.
 983       WebHTTPBody http_body;
 984       http_body.initialize();
 985       const char* data = NULL;
 986       if (params.request_params.browser_initiated_post_data.size()) {
 987         data = reinterpret_cast<const char*>(
 988             &params.request_params.browser_initiated_post_data.front());
 989       }
 990       http_body.appendData(WebData(
 991           data, params.request_params.browser_initiated_post_data.size()));
 992       request.setHTTPBody(http_body);
 993     }
 994
 995     // Record this before starting the load, we need a lower bound of this time
 996     // to sanitize the navigationStart override set below.
 997     base::TimeTicks renderer_navigation_start = base::TimeTicks::Now();
 998     frame->loadRequest(request);
 999
1000     UpdateFrameNavigationTiming(
1001         frame, params.commit_params.browser_navigation_start,
1002         renderer_navigation_start);
1003   }
1004
1005   // In case LoadRequest failed before DidCreateDataSource was called.
1006   render_view_->pending_navigation_params_.reset();
1007 }
1008
1009 void RenderFrameImpl::BindServiceRegistry(
1010     mojo::ScopedMessagePipeHandle service_provider_handle) {
1011   service_registry_.BindRemoteServiceProvider(service_provider_handle.Pass());
1012 }
1013
1014 ManifestManager* RenderFrameImpl::manifest_manager() {
1015   return manifest_manager_;
1016 }
1017
1018 void RenderFrameImpl::OnBeforeUnload() {
1019   TRACE_EVENT1("navigation", "RenderFrameImpl::OnBeforeUnload",
1020                "id", routing_id_);
1021   // TODO(creis): Right now, this is only called on the main frame.  Make the
1022   // browser process send dispatchBeforeUnloadEvent to every frame that needs
1023   // it.
1024   CHECK(!frame_->parent());
1025
1026   base::TimeTicks before_unload_start_time = base::TimeTicks::Now();
1027   bool proceed = frame_->dispatchBeforeUnloadEvent();
1028   base::TimeTicks before_unload_end_time = base::TimeTicks::Now();
1029   Send(new FrameHostMsg_BeforeUnload_ACK(routing_id_, proceed,
1030                                          before_unload_start_time,
1031                                          before_unload_end_time));
1032 }
1033
1034 void RenderFrameImpl::OnSwapOut(int proxy_routing_id) {
1035   TRACE_EVENT1("navigation", "RenderFrameImpl::OnSwapOut", "id", routing_id_);
1036   RenderFrameProxy* proxy = NULL;
1037   bool is_site_per_process =
1038       CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess);
1039   bool is_main_frame = !frame_->parent();
1040
1041   // Only run unload if we're not swapped out yet, but send the ack either way.
1042   if (!is_swapped_out_ || !render_view_->is_swapped_out_) {
1043     // Swap this RenderFrame out so the frame can navigate to a page rendered by
1044     // a different process.  This involves running the unload handler and
1045     // clearing the page.  We also allow this process to exit if there are no
1046     // other active RenderFrames in it.
1047
1048     // Send an UpdateState message before we get swapped out.
1049     render_view_->SyncNavigationState();
1050
1051     // If we need a proxy to replace this, create it now so its routing id is
1052     // registered for receiving IPC messages.
1053     if (proxy_routing_id != MSG_ROUTING_NONE) {
1054       proxy = RenderFrameProxy::CreateProxyToReplaceFrame(this,
1055                                                           proxy_routing_id);
1056     }
1057
1058     // Synchronously run the unload handler before sending the ACK.
1059     // TODO(creis): Call dispatchUnloadEvent unconditionally here to support
1060     // unload on subframes as well.
1061     if (is_main_frame)
1062       frame_->dispatchUnloadEvent();
1063
1064     // Swap out and stop sending any IPC messages that are not ACKs.
1065     // TODO(nasko): Do we need RenderFrameImpl::is_swapped_out_ anymore?
1066     if (is_main_frame)
1067       render_view_->SetSwappedOut(true);
1068     is_swapped_out_ = true;
1069
1070     // Now that we're swapped out and filtering IPC messages, stop loading to
1071     // ensure that no other in-progress navigation continues.  We do this here
1072     // to avoid sending a DidStopLoading message to the browser process.
1073     // TODO(creis): Should we be stopping all frames here and using
1074     // StopAltErrorPageFetcher with RenderView::OnStop, or just stopping this
1075     // frame?
1076     OnStop();
1077
1078     // Transfer settings such as initial drawing parameters to the remote frame,
1079     // if one is created, that will replace this frame.
1080     if (!is_main_frame && proxy)
1081       proxy->web_frame()->initializeFromFrame(frame_);
1082
1083     // Replace the page with a blank dummy URL. The unload handler will not be
1084     // run a second time, thanks to a check in FrameLoader::stopLoading.
1085     // TODO(creis): Need to add a better way to do this that avoids running the
1086     // beforeunload handler. For now, we just run it a second time silently.
1087     if (!is_site_per_process || is_main_frame)
1088       render_view_->NavigateToSwappedOutURL(frame_);
1089
1090     // Let WebKit know that this view is hidden so it can drop resources and
1091     // stop compositing.
1092     // TODO(creis): Support this for subframes as well.
1093     if (is_main_frame) {
1094       render_view_->webview()->setVisibilityState(
1095           blink::WebPageVisibilityStateHidden, false);
1096     }
1097   }
1098
1099   // It is now safe to show modal dialogs again.
1100   // TODO(creis): Deal with modal dialogs from subframes.
1101   if (is_main_frame)
1102     render_view_->suppress_dialogs_until_swap_out_ = false;
1103
1104   Send(new FrameHostMsg_SwapOut_ACK(routing_id_));
1105
1106   // Now that all of the cleanup is complete and the browser side is notified,
1107   // start using the RenderFrameProxy, if one is created.
1108   if (proxy) {
1109     if (!is_main_frame) {
1110       frame_->swap(proxy->web_frame());
1111       if (is_site_per_process) {
1112         // TODO(nasko): delete the frame here, since we've replaced it with a
1113         // proxy.
1114       }
1115     } else {
1116       set_render_frame_proxy(proxy);
1117     }
1118   }
1119
1120   // Safe to exit if no one else is using the process.
1121   if (is_main_frame)
1122     render_view_->WasSwappedOut();
1123 }
1124
1125 void RenderFrameImpl::OnContextMenuClosed(
1126     const CustomContextMenuContext& custom_context) {
1127   if (custom_context.request_id) {
1128     // External request, should be in our map.
1129     ContextMenuClient* client =
1130         pending_context_menus_.Lookup(custom_context.request_id);
1131     if (client) {
1132       client->OnMenuClosed(custom_context.request_id);
1133       pending_context_menus_.Remove(custom_context.request_id);
1134     }
1135   } else {
1136     if (custom_context.link_followed.is_valid()) {
1137         frame_->sendPings(
1138             DomUtils::ExtractParentAnchorNode(context_menu_node_),
1139             custom_context.link_followed);
1140     }
1141     // Internal request, forward to WebKit.
1142     context_menu_node_.reset();
1143   }
1144 }
1145
1146 void RenderFrameImpl::OnCustomContextMenuAction(
1147     const CustomContextMenuContext& custom_context,
1148     unsigned action) {
1149   if (custom_context.request_id) {
1150     // External context menu request, look in our map.
1151     ContextMenuClient* client =
1152         pending_context_menus_.Lookup(custom_context.request_id);
1153     if (client)
1154       client->OnMenuAction(custom_context.request_id, action);
1155   } else {
1156     // Internal request, forward to WebKit.
1157     render_view_->webview()->performCustomContextMenuAction(action);
1158   }
1159 }
1160
1161 void RenderFrameImpl::OnUndo() {
1162   frame_->executeCommand(WebString::fromUTF8("Undo"), GetFocusedElement());
1163 }
1164
1165 void RenderFrameImpl::OnRedo() {
1166   frame_->executeCommand(WebString::fromUTF8("Redo"), GetFocusedElement());
1167 }
1168
1169 void RenderFrameImpl::OnCut() {
1170   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1171   frame_->executeCommand(WebString::fromUTF8("Cut"), GetFocusedElement());
1172 }
1173
1174 void RenderFrameImpl::OnCopy() {
1175   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1176   WebNode current_node = context_menu_node_.isNull() ?
1177       GetFocusedElement() : context_menu_node_;
1178   frame_->executeCommand(WebString::fromUTF8("Copy"), current_node);
1179 }
1180
1181 void RenderFrameImpl::OnPaste() {
1182   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1183   frame_->executeCommand(WebString::fromUTF8("Paste"), GetFocusedElement());
1184 }
1185
1186 void RenderFrameImpl::OnPasteAndMatchStyle() {
1187   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1188   frame_->executeCommand(
1189       WebString::fromUTF8("PasteAndMatchStyle"), GetFocusedElement());
1190 }
1191
1192 #if defined(OS_MACOSX)
1193 void RenderFrameImpl::OnCopyToFindPboard() {
1194   // Since the find pasteboard supports only plain text, this can be simpler
1195   // than the |OnCopy()| case.
1196   if (frame_->hasSelection()) {
1197     base::string16 selection = frame_->selectionAsText();
1198     RenderThread::Get()->Send(
1199         new ClipboardHostMsg_FindPboardWriteStringAsync(selection));
1200   }
1201 }
1202 #endif
1203
1204 void RenderFrameImpl::OnDelete() {
1205   frame_->executeCommand(WebString::fromUTF8("Delete"), GetFocusedElement());
1206 }
1207
1208 void RenderFrameImpl::OnSelectAll() {
1209   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1210   frame_->executeCommand(WebString::fromUTF8("SelectAll"), GetFocusedElement());
1211 }
1212
1213 void RenderFrameImpl::OnSelectRange(const gfx::Point& start,
1214                                     const gfx::Point& end) {
1215   // This IPC is dispatched by RenderWidgetHost, so use its routing id.
1216   Send(new ViewHostMsg_SelectRange_ACK(GetRenderWidget()->routing_id()));
1217
1218   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1219   frame_->selectRange(start, end);
1220 }
1221
1222 void RenderFrameImpl::OnUnselect() {
1223   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1224   frame_->executeCommand(WebString::fromUTF8("Unselect"), GetFocusedElement());
1225 }
1226
1227 void RenderFrameImpl::OnReplace(const base::string16& text) {
1228   if (!frame_->hasSelection())
1229     frame_->selectWordAroundCaret();
1230
1231   frame_->replaceSelection(text);
1232 }
1233
1234 void RenderFrameImpl::OnReplaceMisspelling(const base::string16& text) {
1235   if (!frame_->hasSelection())
1236     return;
1237
1238   frame_->replaceMisspelledRange(text);
1239 }
1240
1241 void RenderFrameImpl::OnCSSInsertRequest(const std::string& css) {
1242   frame_->document().insertStyleSheet(WebString::fromUTF8(css));
1243 }
1244
1245 void RenderFrameImpl::OnJavaScriptExecuteRequest(
1246     const base::string16& jscript,
1247     int id,
1248     bool notify_result) {
1249   TRACE_EVENT_INSTANT0("test_tracing", "OnJavaScriptExecuteRequest",
1250                        TRACE_EVENT_SCOPE_THREAD);
1251
1252   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
1253   v8::Handle<v8::Value> result =
1254       frame_->executeScriptAndReturnValue(WebScriptSource(jscript));
1255
1256   HandleJavascriptExecutionResult(jscript, id, notify_result, result);
1257 }
1258
1259 void RenderFrameImpl::OnJavaScriptExecuteRequestForTests(
1260     const base::string16& jscript,
1261     int id,
1262     bool notify_result) {
1263   TRACE_EVENT_INSTANT0("test_tracing", "OnJavaScriptExecuteRequestForTests",
1264                        TRACE_EVENT_SCOPE_THREAD);
1265
1266   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
1267   v8::Handle<v8::Value> result =
1268       frame_->executeScriptAndReturnValueForTests(WebScriptSource(jscript));
1269
1270   HandleJavascriptExecutionResult(jscript, id, notify_result, result);
1271 }
1272
1273 void RenderFrameImpl::HandleJavascriptExecutionResult(
1274     const base::string16& jscript,
1275     int id,
1276     bool notify_result,
1277     v8::Handle<v8::Value> result) {
1278   if (notify_result) {
1279     base::ListValue list;
1280     if (!result.IsEmpty()) {
1281       v8::Local<v8::Context> context = frame_->mainWorldScriptContext();
1282       v8::Context::Scope context_scope(context);
1283       V8ValueConverterImpl converter;
1284       converter.SetDateAllowed(true);
1285       converter.SetRegExpAllowed(true);
1286       base::Value* result_value = converter.FromV8Value(result, context);
1287       list.Set(0, result_value ? result_value : base::Value::CreateNullValue());
1288     } else {
1289       list.Set(0, base::Value::CreateNullValue());
1290     }
1291     Send(new FrameHostMsg_JavaScriptExecuteResponse(routing_id_, id, list));
1292   }
1293 }
1294
1295 void RenderFrameImpl::OnSetEditableSelectionOffsets(int start, int end) {
1296   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1297   if (!GetRenderWidget()->ShouldHandleImeEvent())
1298     return;
1299   ImeEventGuard guard(GetRenderWidget());
1300   frame_->setEditableSelectionOffsets(start, end);
1301 }
1302
1303 void RenderFrameImpl::OnSetCompositionFromExistingText(
1304     int start, int end,
1305     const std::vector<blink::WebCompositionUnderline>& underlines) {
1306   if (!GetRenderWidget()->ShouldHandleImeEvent())
1307     return;
1308   ImeEventGuard guard(GetRenderWidget());
1309   frame_->setCompositionFromExistingText(start, end, underlines);
1310 }
1311
1312 void RenderFrameImpl::OnExtendSelectionAndDelete(int before, int after) {
1313   if (!GetRenderWidget()->ShouldHandleImeEvent())
1314     return;
1315   ImeEventGuard guard(GetRenderWidget());
1316   frame_->extendSelectionAndDelete(before, after);
1317 }
1318
1319 void RenderFrameImpl::OnSetAccessibilityMode(AccessibilityMode new_mode) {
1320   if (accessibility_mode_ == new_mode)
1321     return;
1322   accessibility_mode_ = new_mode;
1323   if (renderer_accessibility_) {
1324     delete renderer_accessibility_;
1325     renderer_accessibility_ = NULL;
1326   }
1327   if (accessibility_mode_ == AccessibilityModeOff)
1328     return;
1329
1330   if (accessibility_mode_ & AccessibilityModeFlagFullTree)
1331     renderer_accessibility_ = new RendererAccessibilityComplete(this);
1332 #if !defined(OS_ANDROID)
1333   else
1334     renderer_accessibility_ = new RendererAccessibilityFocusOnly(this);
1335 #endif
1336 }
1337
1338 void RenderFrameImpl::OnDisownOpener() {
1339   // TODO(creis): We should only see this for main frames for now.  To support
1340   // disowning the opener on subframes, we will need to move WebContentsImpl's
1341   // opener_ to FrameTreeNode.
1342   CHECK(!frame_->parent());
1343
1344   if (frame_->opener())
1345     frame_->setOpener(NULL);
1346 }
1347
1348 #if defined(OS_ANDROID)
1349 void RenderFrameImpl::OnSelectPopupMenuItems(
1350     bool canceled,
1351     const std::vector<int>& selected_indices) {
1352   // It is possible to receive more than one of these calls if the user presses
1353   // a select faster than it takes for the show-select-popup IPC message to make
1354   // it to the browser UI thread. Ignore the extra-messages.
1355   // TODO(jcivelli): http:/b/5793321 Implement a better fix, as detailed in bug.
1356   if (!external_popup_menu_)
1357     return;
1358
1359   external_popup_menu_->DidSelectItems(canceled, selected_indices);
1360   external_popup_menu_.reset();
1361 }
1362 #endif
1363
1364 #if defined(OS_MACOSX)
1365 void RenderFrameImpl::OnSelectPopupMenuItem(int selected_index) {
1366   if (external_popup_menu_ == NULL)
1367     return;
1368   external_popup_menu_->DidSelectItem(selected_index);
1369   external_popup_menu_.reset();
1370 }
1371 #endif
1372
1373 void RenderFrameImpl::OnReload(bool ignore_cache) {
1374   frame_->reload(ignore_cache);
1375 }
1376
1377 void RenderFrameImpl::OnTextSurroundingSelectionRequest(size_t max_length) {
1378   blink::WebSurroundingText surroundingText;
1379   surroundingText.initialize(frame_->selectionRange(), max_length);
1380
1381   if (surroundingText.isNull()) {
1382     // |surroundingText| might not be correctly initialized, for example if
1383     // |frame_->selectionRange().isNull()|, in other words, if there was no
1384     // selection.
1385     Send(new FrameHostMsg_TextSurroundingSelectionResponse(
1386         routing_id_, base::string16(), 0, 0));
1387     return;
1388   }
1389
1390   Send(new FrameHostMsg_TextSurroundingSelectionResponse(
1391       routing_id_,
1392       surroundingText.textContent(),
1393       surroundingText.startOffsetInTextContent(),
1394       surroundingText.endOffsetInTextContent()));
1395 }
1396
1397 void RenderFrameImpl::OnAddStyleSheetByURL(const std::string& url) {
1398   frame_->addStyleSheetByURL(WebString::fromUTF8(url));
1399 }
1400
1401 void RenderFrameImpl::OnSetupTransitionView(const std::string& markup) {
1402   frame_->document().setIsTransitionDocument();
1403   frame_->navigateToSandboxedMarkup(WebData(markup.data(), markup.length()));
1404 }
1405
1406 void RenderFrameImpl::OnBeginExitTransition(const std::string& css_selector) {
1407   frame_->document().setIsTransitionDocument();
1408   frame_->document().beginExitTransition(WebString::fromUTF8(css_selector));
1409 }
1410
1411 bool RenderFrameImpl::RunJavaScriptMessage(JavaScriptMessageType type,
1412                                            const base::string16& message,
1413                                            const base::string16& default_value,
1414                                            const GURL& frame_url,
1415                                            base::string16* result) {
1416   // Don't allow further dialogs if we are waiting to swap out, since the
1417   // PageGroupLoadDeferrer in our stack prevents it.
1418   if (render_view()->suppress_dialogs_until_swap_out_)
1419     return false;
1420
1421   bool success = false;
1422   base::string16 result_temp;
1423   if (!result)
1424     result = &result_temp;
1425
1426   render_view()->SendAndRunNestedMessageLoop(
1427       new FrameHostMsg_RunJavaScriptMessage(
1428         routing_id_, message, default_value, frame_url, type, &success,
1429         result));
1430   return success;
1431 }
1432
1433 void RenderFrameImpl::LoadNavigationErrorPage(
1434     const WebURLRequest& failed_request,
1435     const WebURLError& error,
1436     bool replace) {
1437   std::string error_html;
1438   GetContentClient()->renderer()->GetNavigationErrorStrings(
1439       render_view(), frame_, failed_request, error, &error_html, NULL);
1440
1441   frame_->loadHTMLString(error_html,
1442                          GURL(kUnreachableWebDataURL),
1443                          error.unreachableURL,
1444                          replace);
1445 }
1446
1447 void RenderFrameImpl::DidCommitCompositorFrame() {
1448   FOR_EACH_OBSERVER(
1449       RenderFrameObserver, observers_, DidCommitCompositorFrame());
1450 }
1451
1452 RenderView* RenderFrameImpl::GetRenderView() {
1453   return render_view_.get();
1454 }
1455
1456 int RenderFrameImpl::GetRoutingID() {
1457   return routing_id_;
1458 }
1459
1460 blink::WebLocalFrame* RenderFrameImpl::GetWebFrame() {
1461   DCHECK(frame_);
1462   return frame_;
1463 }
1464
1465 WebPreferences& RenderFrameImpl::GetWebkitPreferences() {
1466   return render_view_->GetWebkitPreferences();
1467 }
1468
1469 int RenderFrameImpl::ShowContextMenu(ContextMenuClient* client,
1470                                      const ContextMenuParams& params) {
1471   DCHECK(client);  // A null client means "internal" when we issue callbacks.
1472   ContextMenuParams our_params(params);
1473   our_params.custom_context.request_id = pending_context_menus_.Add(client);
1474   Send(new FrameHostMsg_ContextMenu(routing_id_, our_params));
1475   return our_params.custom_context.request_id;
1476 }
1477
1478 void RenderFrameImpl::CancelContextMenu(int request_id) {
1479   DCHECK(pending_context_menus_.Lookup(request_id));
1480   pending_context_menus_.Remove(request_id);
1481 }
1482
1483 blink::WebNode RenderFrameImpl::GetContextMenuNode() const {
1484   return context_menu_node_;
1485 }
1486
1487 blink::WebPlugin* RenderFrameImpl::CreatePlugin(
1488     blink::WebFrame* frame,
1489     const WebPluginInfo& info,
1490     const blink::WebPluginParams& params) {
1491   DCHECK_EQ(frame_, frame);
1492 #if defined(ENABLE_PLUGINS)
1493   bool pepper_plugin_was_registered = false;
1494   scoped_refptr<PluginModule> pepper_module(PluginModule::Create(
1495       this, info, &pepper_plugin_was_registered));
1496   if (pepper_plugin_was_registered) {
1497     if (pepper_module.get()) {
1498       return new PepperWebPluginImpl(pepper_module.get(), params, this);
1499     }
1500   }
1501 #if defined(OS_CHROMEOS)
1502   LOG(WARNING) << "Pepper module/plugin creation failed.";
1503   return NULL;
1504 #else
1505   // TODO(jam): change to take RenderFrame.
1506   return new WebPluginImpl(frame, params, info.path, render_view_, this);
1507 #endif
1508 #else
1509   return NULL;
1510 #endif
1511 }
1512
1513 void RenderFrameImpl::LoadURLExternally(blink::WebLocalFrame* frame,
1514                                         const blink::WebURLRequest& request,
1515                                         blink::WebNavigationPolicy policy) {
1516   DCHECK(!frame_ || frame_ == frame);
1517   loadURLExternally(frame, request, policy, WebString());
1518 }
1519
1520 void RenderFrameImpl::ExecuteJavaScript(const base::string16& javascript) {
1521   OnJavaScriptExecuteRequest(javascript, 0, false);
1522 }
1523
1524 ServiceRegistry* RenderFrameImpl::GetServiceRegistry() {
1525   return &service_registry_;
1526 }
1527
1528 bool RenderFrameImpl::IsFTPDirectoryListing() {
1529   WebURLResponseExtraDataImpl* extra_data =
1530       GetExtraDataFromResponse(frame_->dataSource()->response());
1531   return extra_data ? extra_data->is_ftp_directory_listing() : false;
1532 }
1533
1534 void RenderFrameImpl::AttachGuest(int element_instance_id) {
1535   render_view_->GetBrowserPluginManager()->Attach(element_instance_id);
1536 }
1537
1538 void RenderFrameImpl::SetSelectedText(const base::string16& selection_text,
1539                                       size_t offset,
1540                                       const gfx::Range& range) {
1541   // Use the routing id of Render Widget Host.
1542   Send(new ViewHostMsg_SelectionChanged(GetRenderWidget()->routing_id(),
1543                                         selection_text,
1544                                         offset,
1545                                         range));
1546 }
1547
1548 // blink::WebFrameClient implementation ----------------------------------------
1549
1550 blink::WebPlugin* RenderFrameImpl::createPlugin(
1551     blink::WebLocalFrame* frame,
1552     const blink::WebPluginParams& params) {
1553   DCHECK_EQ(frame_, frame);
1554   blink::WebPlugin* plugin = NULL;
1555   if (GetContentClient()->renderer()->OverrideCreatePlugin(
1556           this, frame, params, &plugin)) {
1557     return plugin;
1558   }
1559
1560   if (base::UTF16ToUTF8(params.mimeType) == kBrowserPluginMimeType) {
1561     scoped_ptr<BrowserPluginDelegate> browser_plugin_delegate(
1562         GetContentClient()->renderer()->CreateBrowserPluginDelegate(
1563             this, std::string()));
1564     return render_view_->GetBrowserPluginManager()->CreateBrowserPlugin(
1565         render_view_.get(), frame, browser_plugin_delegate.Pass());
1566   }
1567
1568 #if defined(ENABLE_PLUGINS)
1569   WebPluginInfo info;
1570   std::string mime_type;
1571   bool found = false;
1572   Send(new FrameHostMsg_GetPluginInfo(
1573       routing_id_, params.url, frame->top()->document().url(),
1574       params.mimeType.utf8(), &found, &info, &mime_type));
1575   if (!found)
1576     return NULL;
1577
1578   if (info.type == content::WebPluginInfo::PLUGIN_TYPE_BROWSER_PLUGIN) {
1579     scoped_ptr<BrowserPluginDelegate> browser_plugin_delegate(
1580         GetContentClient()->renderer()->CreateBrowserPluginDelegate(
1581             this, base::UTF16ToUTF8(params.mimeType)));
1582     return render_view_->GetBrowserPluginManager()->CreateBrowserPlugin(
1583         render_view_.get(), frame, browser_plugin_delegate.Pass());
1584   }
1585
1586
1587   WebPluginParams params_to_use = params;
1588   params_to_use.mimeType = WebString::fromUTF8(mime_type);
1589   return CreatePlugin(frame, info, params_to_use);
1590 #else
1591   return NULL;
1592 #endif  // defined(ENABLE_PLUGINS)
1593 }
1594
1595 blink::WebMediaPlayer* RenderFrameImpl::createMediaPlayer(
1596     blink::WebLocalFrame* frame,
1597     const blink::WebURL& url,
1598     blink::WebMediaPlayerClient* client) {
1599   return createMediaPlayer(frame, url, client, NULL);
1600 }
1601
1602 blink::WebMediaPlayer* RenderFrameImpl::createMediaPlayer(
1603     blink::WebLocalFrame* frame,
1604     const blink::WebURL& url,
1605     blink::WebMediaPlayerClient* client,
1606     blink::WebContentDecryptionModule* initial_cdm) {
1607 #if defined(VIDEO_HOLE)
1608   if (!contains_media_player_) {
1609     render_view_->RegisterVideoHoleFrame(this);
1610     contains_media_player_ = true;
1611   }
1612 #endif  // defined(VIDEO_HOLE)
1613
1614   blink::WebMediaStream web_stream(
1615       blink::WebMediaStreamRegistry::lookupMediaStreamDescriptor(url));
1616   if (!web_stream.isNull())
1617     return CreateWebMediaPlayerForMediaStream(url, client);
1618
1619 #if defined(OS_ANDROID)
1620   return CreateAndroidWebMediaPlayer(url, client, initial_cdm);
1621 #else
1622   RenderThreadImpl* render_thread = RenderThreadImpl::current();
1623   media::WebMediaPlayerParams params(
1624       base::Bind(&ContentRendererClient::DeferMediaLoad,
1625                  base::Unretained(GetContentClient()->renderer()),
1626                  static_cast<RenderFrame*>(this)),
1627       render_thread->GetAudioRendererMixerManager()->CreateInput(
1628           render_view_->routing_id_, routing_id_),
1629       *render_thread->GetAudioHardwareConfig(),
1630       new RenderMediaLog(),
1631       render_thread->GetGpuFactories(),
1632       render_thread->GetMediaThreadTaskRunner(),
1633       render_thread->compositor_message_loop_proxy(),
1634       base::Bind(&EncryptedMediaPlayerSupportImpl::Create),
1635       initial_cdm);
1636   return new media::WebMediaPlayerImpl(frame,
1637                                        client,
1638                                        weak_factory_.GetWeakPtr(),
1639                                        params);
1640 #endif  // defined(OS_ANDROID)
1641 }
1642
1643 blink::WebContentDecryptionModule*
1644 RenderFrameImpl::createContentDecryptionModule(
1645     blink::WebLocalFrame* frame,
1646     const blink::WebSecurityOrigin& security_origin,
1647     const blink::WebString& key_system) {
1648   DCHECK(!frame_ || frame_ == frame);
1649   return WebContentDecryptionModuleImpl::Create(
1650 #if defined(ENABLE_PEPPER_CDMS)
1651       frame,
1652 #elif defined(ENABLE_BROWSER_CDMS)
1653       GetCdmManager(),
1654 #endif
1655       security_origin,
1656       key_system);
1657 }
1658
1659 blink::WebApplicationCacheHost* RenderFrameImpl::createApplicationCacheHost(
1660     blink::WebLocalFrame* frame,
1661     blink::WebApplicationCacheHostClient* client) {
1662   if (!frame || !frame->view())
1663     return NULL;
1664   DCHECK(!frame_ || frame_ == frame);
1665   return new RendererWebApplicationCacheHostImpl(
1666       RenderViewImpl::FromWebView(frame->view()), client,
1667       RenderThreadImpl::current()->appcache_dispatcher()->backend_proxy());
1668 }
1669
1670 blink::WebWorkerPermissionClientProxy*
1671 RenderFrameImpl::createWorkerPermissionClientProxy(
1672     blink::WebLocalFrame* frame) {
1673   if (!frame || !frame->view())
1674     return NULL;
1675   DCHECK(!frame_ || frame_ == frame);
1676   return GetContentClient()->renderer()->CreateWorkerPermissionClientProxy(
1677       this, frame);
1678 }
1679
1680 WebExternalPopupMenu* RenderFrameImpl::createExternalPopupMenu(
1681     const WebPopupMenuInfo& popup_menu_info,
1682     WebExternalPopupMenuClient* popup_menu_client) {
1683 #if defined(OS_MACOSX) || defined(OS_ANDROID)
1684   // An IPC message is sent to the browser to build and display the actual
1685   // popup. The user could have time to click a different select by the time
1686   // the popup is shown. In that case external_popup_menu_ is non NULL.
1687   // By returning NULL in that case, we instruct Blink to cancel that new
1688   // popup. So from the user perspective, only the first one will show, and
1689   // will have to close the first one before another one can be shown.
1690   if (external_popup_menu_)
1691     return NULL;
1692   external_popup_menu_.reset(
1693       new ExternalPopupMenu(this, popup_menu_info, popup_menu_client));
1694   if (render_view_->screen_metrics_emulator_) {
1695     render_view_->SetExternalPopupOriginAdjustmentsForEmulation(
1696         external_popup_menu_.get(),
1697         render_view_->screen_metrics_emulator_.get());
1698   }
1699   return external_popup_menu_.get();
1700 #else
1701   return NULL;
1702 #endif
1703 }
1704
1705 blink::WebCookieJar* RenderFrameImpl::cookieJar(blink::WebLocalFrame* frame) {
1706   DCHECK(!frame_ || frame_ == frame);
1707   return &cookie_jar_;
1708 }
1709
1710 blink::WebServiceWorkerProvider* RenderFrameImpl::createServiceWorkerProvider(
1711     blink::WebLocalFrame* frame) {
1712   DCHECK(!frame_ || frame_ == frame);
1713   // At this point we should have non-null data source.
1714   DCHECK(frame->dataSource());
1715   if (!ChildThread::current())
1716     return NULL;  // May be null in some tests.
1717   ServiceWorkerNetworkProvider* provider =
1718       ServiceWorkerNetworkProvider::FromDocumentState(
1719           DocumentState::FromDataSource(frame->dataSource()));
1720   return new WebServiceWorkerProviderImpl(
1721       ChildThread::current()->thread_safe_sender(),
1722       provider ? provider->context() : NULL);
1723 }
1724
1725 void RenderFrameImpl::didAccessInitialDocument(blink::WebLocalFrame* frame) {
1726   DCHECK(!frame_ || frame_ == frame);
1727   // Notify the browser process that it is no longer safe to show the pending
1728   // URL of the main frame, since a URL spoof is now possible.
1729   if (!frame->parent() && render_view_->page_id_ == -1)
1730     Send(new FrameHostMsg_DidAccessInitialDocument(routing_id_));
1731 }
1732
1733 blink::WebFrame* RenderFrameImpl::createChildFrame(
1734     blink::WebLocalFrame* parent,
1735     const blink::WebString& name) {
1736   // Synchronously notify the browser of a child frame creation to get the
1737   // routing_id for the RenderFrame.
1738   int child_routing_id = MSG_ROUTING_NONE;
1739   Send(new FrameHostMsg_CreateChildFrame(routing_id_,
1740                                          base::UTF16ToUTF8(name),
1741                                          &child_routing_id));
1742   // Allocation of routing id failed, so we can't create a child frame. This can
1743   // happen if this RenderFrameImpl's IPCs are being filtered when in swapped
1744   // out state.
1745   if (child_routing_id == MSG_ROUTING_NONE) {
1746 #if !defined(OS_LINUX)
1747     // DumpWithoutCrashing() crashes on Linux in renderer processes when
1748     // breakpad and sandboxing are enabled: crbug.com/349600
1749     base::debug::Alias(parent);
1750     base::debug::Alias(&routing_id_);
1751     bool render_view_is_swapped_out = GetRenderWidget()->is_swapped_out();
1752     base::debug::Alias(&render_view_is_swapped_out);
1753     bool render_view_is_closing = GetRenderWidget()->closing();
1754     base::debug::Alias(&render_view_is_closing);
1755     base::debug::Alias(&is_swapped_out_);
1756     base::debug::DumpWithoutCrashing();
1757 #endif
1758     return NULL;
1759   }
1760
1761   // Create the RenderFrame and WebLocalFrame, linking the two.
1762   RenderFrameImpl* child_render_frame = RenderFrameImpl::Create(
1763       render_view_.get(), child_routing_id);
1764   blink::WebLocalFrame* web_frame = WebLocalFrame::create(child_render_frame);
1765   child_render_frame->SetWebFrame(web_frame);
1766
1767   // Add the frame to the frame tree and initialize it.
1768   parent->appendChild(web_frame);
1769   child_render_frame->Initialize();
1770
1771   return web_frame;
1772 }
1773
1774 void RenderFrameImpl::didDisownOpener(blink::WebLocalFrame* frame) {
1775   DCHECK(!frame_ || frame_ == frame);
1776   // We only need to notify the browser if the active, top-level frame clears
1777   // its opener.  We can ignore cases where a swapped out frame clears its
1778   // opener after hearing about it from the browser, and the browser does not
1779   // (yet) care about subframe openers.
1780   if (render_view_->is_swapped_out_ || frame->parent())
1781     return;
1782
1783   // Notify WebContents and all its swapped out RenderViews.
1784   Send(new FrameHostMsg_DidDisownOpener(routing_id_));
1785 }
1786
1787 void RenderFrameImpl::frameDetached(blink::WebFrame* frame) {
1788   // NOTE: This function is called on the frame that is being detached and not
1789   // the parent frame.  This is different from createChildFrame() which is
1790   // called on the parent frame.
1791   CHECK(!is_detaching_);
1792   DCHECK(!frame_ || frame_ == frame);
1793
1794   bool is_subframe = !!frame->parent();
1795
1796   Send(new FrameHostMsg_Detach(routing_id_));
1797
1798   // The |is_detaching_| flag disables Send(). FrameHostMsg_Detach must be
1799   // sent before setting |is_detaching_| to true. In contrast, Observers
1800   // should only be notified afterwards so they cannot call back into here and
1801   // have IPCs fired off.
1802   is_detaching_ = true;
1803
1804   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1805                     FrameDetached(frame));
1806
1807   // We need to clean up subframes by removing them from the map and deleting
1808   // the RenderFrameImpl.  In contrast, the main frame is owned by its
1809   // containing RenderViewHost (so that they have the same lifetime), so only
1810   // removal from the map is needed and no deletion.
1811   FrameMap::iterator it = g_frame_map.Get().find(frame);
1812   CHECK(it != g_frame_map.Get().end());
1813   CHECK_EQ(it->second, this);
1814   g_frame_map.Get().erase(it);
1815
1816   if (is_subframe)
1817     frame->parent()->removeChild(frame);
1818
1819   // |frame| is invalid after here.
1820   frame->close();
1821
1822   if (is_subframe) {
1823     delete this;
1824     // Object is invalid after this point.
1825   }
1826 }
1827
1828 void RenderFrameImpl::frameFocused() {
1829   Send(new FrameHostMsg_FrameFocused(routing_id_));
1830 }
1831
1832 void RenderFrameImpl::willClose(blink::WebFrame* frame) {
1833   DCHECK(!frame_ || frame_ == frame);
1834
1835   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, FrameWillClose());
1836   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1837                     FrameWillClose(frame));
1838 }
1839
1840 void RenderFrameImpl::didChangeName(blink::WebLocalFrame* frame,
1841                                     const blink::WebString& name) {
1842   DCHECK(!frame_ || frame_ == frame);
1843   if (!render_view_->renderer_preferences_.report_frame_name_changes)
1844     return;
1845
1846   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidChangeName(name));
1847 }
1848
1849 void RenderFrameImpl::didMatchCSS(
1850     blink::WebLocalFrame* frame,
1851     const blink::WebVector<blink::WebString>& newly_matching_selectors,
1852     const blink::WebVector<blink::WebString>& stopped_matching_selectors) {
1853   DCHECK(!frame_ || frame_ == frame);
1854
1855   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1856                     DidMatchCSS(frame,
1857                                 newly_matching_selectors,
1858                                 stopped_matching_selectors));
1859 }
1860
1861 bool RenderFrameImpl::shouldReportDetailedMessageForSource(
1862     const blink::WebString& source) {
1863   return GetContentClient()->renderer()->ShouldReportDetailedMessageForSource(
1864       source);
1865 }
1866
1867 void RenderFrameImpl::didAddMessageToConsole(
1868     const blink::WebConsoleMessage& message,
1869     const blink::WebString& source_name,
1870     unsigned source_line,
1871     const blink::WebString& stack_trace) {
1872   logging::LogSeverity log_severity = logging::LOG_VERBOSE;
1873   switch (message.level) {
1874     case blink::WebConsoleMessage::LevelDebug:
1875       log_severity = logging::LOG_VERBOSE;
1876       break;
1877     case blink::WebConsoleMessage::LevelLog:
1878     case blink::WebConsoleMessage::LevelInfo:
1879       log_severity = logging::LOG_INFO;
1880       break;
1881     case blink::WebConsoleMessage::LevelWarning:
1882       log_severity = logging::LOG_WARNING;
1883       break;
1884     case blink::WebConsoleMessage::LevelError:
1885       log_severity = logging::LOG_ERROR;
1886       break;
1887     default:
1888       NOTREACHED();
1889   }
1890
1891   if (shouldReportDetailedMessageForSource(source_name)) {
1892     FOR_EACH_OBSERVER(
1893         RenderFrameObserver, observers_,
1894         DetailedConsoleMessageAdded(message.text,
1895                                     source_name,
1896                                     stack_trace,
1897                                     source_line,
1898                                     static_cast<int32>(log_severity)));
1899   }
1900
1901   Send(new FrameHostMsg_AddMessageToConsole(routing_id_,
1902                                             static_cast<int32>(log_severity),
1903                                             message.text,
1904                                             static_cast<int32>(source_line),
1905                                             source_name));
1906 }
1907
1908 void RenderFrameImpl::loadURLExternally(
1909     blink::WebLocalFrame* frame,
1910     const blink::WebURLRequest& request,
1911     blink::WebNavigationPolicy policy,
1912     const blink::WebString& suggested_name) {
1913   DCHECK(!frame_ || frame_ == frame);
1914   Referrer referrer(RenderViewImpl::GetReferrerFromRequest(frame, request));
1915   if (policy == blink::WebNavigationPolicyDownload) {
1916     render_view_->Send(new ViewHostMsg_DownloadUrl(render_view_->GetRoutingID(),
1917                                                    request.url(), referrer,
1918                                                    suggested_name));
1919   } else {
1920     OpenURL(frame, request.url(), referrer, policy);
1921   }
1922 }
1923
1924 blink::WebNavigationPolicy RenderFrameImpl::decidePolicyForNavigation(
1925     const NavigationPolicyInfo& info) {
1926   DCHECK(!frame_ || frame_ == info.frame);
1927   return DecidePolicyForNavigation(this, info);
1928 }
1929
1930 blink::WebHistoryItem RenderFrameImpl::historyItemForNewChildFrame(
1931     blink::WebFrame* frame) {
1932   DCHECK(!frame_ || frame_ == frame);
1933   return render_view_->history_controller()->GetItemForNewChildFrame(this);
1934 }
1935
1936 void RenderFrameImpl::willSendSubmitEvent(blink::WebLocalFrame* frame,
1937                                           const blink::WebFormElement& form) {
1938   DCHECK(!frame_ || frame_ == frame);
1939
1940   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1941                     WillSendSubmitEvent(frame, form));
1942 }
1943
1944 void RenderFrameImpl::willSubmitForm(blink::WebLocalFrame* frame,
1945                                      const blink::WebFormElement& form) {
1946   DCHECK(!frame_ || frame_ == frame);
1947   DocumentState* document_state =
1948       DocumentState::FromDataSource(frame->provisionalDataSource());
1949   NavigationState* navigation_state = document_state->navigation_state();
1950   InternalDocumentStateData* internal_data =
1951       InternalDocumentStateData::FromDocumentState(document_state);
1952
1953   if (ui::PageTransitionCoreTypeIs(navigation_state->transition_type(),
1954                                    ui::PAGE_TRANSITION_LINK)) {
1955     navigation_state->set_transition_type(ui::PAGE_TRANSITION_FORM_SUBMIT);
1956   }
1957
1958   // Save these to be processed when the ensuing navigation is committed.
1959   WebSearchableFormData web_searchable_form_data(form);
1960   internal_data->set_searchable_form_url(web_searchable_form_data.url());
1961   internal_data->set_searchable_form_encoding(
1962       web_searchable_form_data.encoding().utf8());
1963
1964   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1965                     WillSubmitForm(frame, form));
1966 }
1967
1968 void RenderFrameImpl::didCreateDataSource(blink::WebLocalFrame* frame,
1969                                           blink::WebDataSource* datasource) {
1970   DCHECK(!frame_ || frame_ == frame);
1971
1972   // TODO(nasko): Move implementation here. Needed state:
1973   // * pending_navigation_params_
1974   // * webview
1975   // Needed methods:
1976   // * PopulateDocumentStateFromPending
1977   // * CreateNavigationStateFromPending
1978   render_view_->didCreateDataSource(frame, datasource);
1979
1980   // Create the serviceworker's per-document network observing object.
1981   scoped_ptr<ServiceWorkerNetworkProvider>
1982       network_provider(new ServiceWorkerNetworkProvider());
1983   ServiceWorkerNetworkProvider::AttachToDocumentState(
1984       DocumentState::FromDataSource(datasource),
1985       network_provider.Pass());
1986 }
1987
1988 void RenderFrameImpl::didStartProvisionalLoad(blink::WebLocalFrame* frame,
1989                                               bool is_transition_navigation) {
1990   DCHECK(!frame_ || frame_ == frame);
1991   WebDataSource* ds = frame->provisionalDataSource();
1992
1993   // In fast/loader/stop-provisional-loads.html, we abort the load before this
1994   // callback is invoked.
1995   if (!ds)
1996     return;
1997
1998   TRACE_EVENT2("navigation", "RenderFrameImpl::didStartProvisionalLoad",
1999                "id", routing_id_, "url", ds->request().url().string().utf8());
2000   DocumentState* document_state = DocumentState::FromDataSource(ds);
2001
2002   // We should only navigate to swappedout:// when is_swapped_out_ is true.
2003   CHECK((ds->request().url() != GURL(kSwappedOutURL)) ||
2004         is_swapped_out_ ||
2005         render_view_->is_swapped_out()) <<
2006         "Heard swappedout:// when not swapped out.";
2007
2008   // Update the request time if WebKit has better knowledge of it.
2009   if (document_state->request_time().is_null()) {
2010     double event_time = ds->triggeringEventTime();
2011     if (event_time != 0.0)
2012       document_state->set_request_time(Time::FromDoubleT(event_time));
2013   }
2014
2015   // Start time is only set after request time.
2016   document_state->set_start_load_time(Time::Now());
2017
2018   bool is_top_most = !frame->parent();
2019   if (is_top_most) {
2020     render_view_->set_navigation_gesture(
2021         WebUserGestureIndicator::isProcessingUserGesture() ?
2022             NavigationGestureUser : NavigationGestureAuto);
2023   } else if (ds->replacesCurrentHistoryItem()) {
2024     // Subframe navigations that don't add session history items must be
2025     // marked with AUTO_SUBFRAME. See also didFailProvisionalLoad for how we
2026     // handle loading of error pages.
2027     document_state->navigation_state()->set_transition_type(
2028         ui::PAGE_TRANSITION_AUTO_SUBFRAME);
2029   }
2030
2031   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2032                     DidStartProvisionalLoad(frame));
2033   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidStartProvisionalLoad());
2034
2035   Send(new FrameHostMsg_DidStartProvisionalLoadForFrame(
2036        routing_id_, ds->request().url(), is_transition_navigation));
2037 }
2038
2039 void RenderFrameImpl::didReceiveServerRedirectForProvisionalLoad(
2040     blink::WebLocalFrame* frame) {
2041   DCHECK(!frame_ || frame_ == frame);
2042   render_view_->history_controller()->RemoveChildrenForRedirect(this);
2043 }
2044
2045 void RenderFrameImpl::didFailProvisionalLoad(blink::WebLocalFrame* frame,
2046                                              const blink::WebURLError& error) {
2047   TRACE_EVENT1("navigation", "RenderFrameImpl::didFailProvisionalLoad",
2048                "id", routing_id_);
2049   DCHECK(!frame_ || frame_ == frame);
2050   WebDataSource* ds = frame->provisionalDataSource();
2051   DCHECK(ds);
2052
2053   const WebURLRequest& failed_request = ds->request();
2054
2055   // Notify the browser that we failed a provisional load with an error.
2056   //
2057   // Note: It is important this notification occur before DidStopLoading so the
2058   //       SSL manager can react to the provisional load failure before being
2059   //       notified the load stopped.
2060   //
2061   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2062                     DidFailProvisionalLoad(frame, error));
2063   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
2064                     DidFailProvisionalLoad(error));
2065
2066   bool show_repost_interstitial =
2067       (error.reason == net::ERR_CACHE_MISS &&
2068        EqualsASCII(failed_request.httpMethod(), "POST"));
2069
2070   FrameHostMsg_DidFailProvisionalLoadWithError_Params params;
2071   params.error_code = error.reason;
2072   GetContentClient()->renderer()->GetNavigationErrorStrings(
2073       render_view_.get(),
2074       frame,
2075       failed_request,
2076       error,
2077       NULL,
2078       &params.error_description);
2079   params.url = error.unreachableURL;
2080   params.showing_repost_interstitial = show_repost_interstitial;
2081   Send(new FrameHostMsg_DidFailProvisionalLoadWithError(
2082       routing_id_, params));
2083
2084   // Don't display an error page if this is simply a cancelled load.  Aside
2085   // from being dumb, WebCore doesn't expect it and it will cause a crash.
2086   if (error.reason == net::ERR_ABORTED)
2087     return;
2088
2089   // Don't display "client blocked" error page if browser has asked us not to.
2090   if (error.reason == net::ERR_BLOCKED_BY_CLIENT &&
2091       render_view_->renderer_preferences_.disable_client_blocked_error_page) {
2092     return;
2093   }
2094
2095   // Allow the embedder to suppress an error page.
2096   if (GetContentClient()->renderer()->ShouldSuppressErrorPage(this,
2097           error.unreachableURL)) {
2098     return;
2099   }
2100
2101   if (RenderThreadImpl::current() &&
2102       RenderThreadImpl::current()->layout_test_mode()) {
2103     return;
2104   }
2105
2106   // Make sure we never show errors in view source mode.
2107   frame->enableViewSourceMode(false);
2108
2109   DocumentState* document_state = DocumentState::FromDataSource(ds);
2110   NavigationState* navigation_state = document_state->navigation_state();
2111
2112   // If this is a failed back/forward/reload navigation, then we need to do a
2113   // 'replace' load.  This is necessary to avoid messing up session history.
2114   // Otherwise, we do a normal load, which simulates a 'go' navigation as far
2115   // as session history is concerned.
2116   //
2117   // AUTO_SUBFRAME loads should always be treated as loads that do not advance
2118   // the page id.
2119   //
2120   // TODO(davidben): This should also take the failed navigation's replacement
2121   // state into account, if a location.replace() failed.
2122   bool replace =
2123       navigation_state->pending_page_id() != -1 ||
2124       ui::PageTransitionCoreTypeIs(navigation_state->transition_type(),
2125                                ui::PAGE_TRANSITION_AUTO_SUBFRAME);
2126
2127   // If we failed on a browser initiated request, then make sure that our error
2128   // page load is regarded as the same browser initiated request.
2129   if (!navigation_state->is_content_initiated()) {
2130     render_view_->pending_navigation_params_.reset(
2131         new FrameMsg_Navigate_Params);
2132     render_view_->pending_navigation_params_->page_id =
2133         navigation_state->pending_page_id();
2134     render_view_->pending_navigation_params_->pending_history_list_offset =
2135         navigation_state->pending_history_list_offset();
2136     render_view_->pending_navigation_params_->should_clear_history_list =
2137         navigation_state->history_list_was_cleared();
2138     render_view_->pending_navigation_params_->common_params.transition =
2139         navigation_state->transition_type();
2140     render_view_->pending_navigation_params_->request_time =
2141         document_state->request_time();
2142     render_view_->pending_navigation_params_->should_replace_current_entry =
2143         replace;
2144   }
2145
2146   // Load an error page.
2147   LoadNavigationErrorPage(failed_request, error, replace);
2148 }
2149
2150 void RenderFrameImpl::didCommitProvisionalLoad(
2151     blink::WebLocalFrame* frame,
2152     const blink::WebHistoryItem& item,
2153     blink::WebHistoryCommitType commit_type) {
2154   TRACE_EVENT2("navigation", "RenderFrameImpl::didCommitProvisionalLoad",
2155                "id", routing_id_,
2156                "url", GetLoadingUrl().possibly_invalid_spec());
2157   DCHECK(!frame_ || frame_ == frame);
2158   DocumentState* document_state =
2159       DocumentState::FromDataSource(frame->dataSource());
2160   NavigationState* navigation_state = document_state->navigation_state();
2161
2162   // When we perform a new navigation, we need to update the last committed
2163   // session history entry with state for the page we are leaving. Do this
2164   // before updating the HistoryController state.
2165   render_view_->UpdateSessionHistory(frame);
2166
2167   render_view_->history_controller()->UpdateForCommit(this, item, commit_type,
2168       navigation_state->was_within_same_page());
2169
2170   InternalDocumentStateData* internal_data =
2171       InternalDocumentStateData::FromDocumentState(document_state);
2172
2173   if (document_state->commit_load_time().is_null())
2174     document_state->set_commit_load_time(Time::Now());
2175
2176   if (internal_data->must_reset_scroll_and_scale_state()) {
2177     render_view_->webview()->resetScrollAndScaleState();
2178     internal_data->set_must_reset_scroll_and_scale_state(false);
2179   }
2180   internal_data->set_use_error_page(false);
2181
2182   bool is_new_navigation = commit_type == blink::WebStandardCommit;
2183   if (is_new_navigation) {
2184     // We bump our Page ID to correspond with the new session history entry.
2185     render_view_->page_id_ = render_view_->next_page_id_++;
2186
2187     // Don't update history_page_ids_ (etc) for kSwappedOutURL, since
2188     // we don't want to forget the entry that was there, and since we will
2189     // never come back to kSwappedOutURL.  Note that we have to call
2190     // UpdateSessionHistory and update page_id_ even in this case, so that
2191     // the current entry gets a state update and so that we don't send a
2192     // state update to the wrong entry when we swap back in.
2193     if (GetLoadingUrl() != GURL(kSwappedOutURL)) {
2194       // Advance our offset in session history, applying the length limit.
2195       // There is now no forward history.
2196       render_view_->history_list_offset_++;
2197       if (render_view_->history_list_offset_ >= kMaxSessionHistoryEntries)
2198         render_view_->history_list_offset_ = kMaxSessionHistoryEntries - 1;
2199       render_view_->history_list_length_ =
2200           render_view_->history_list_offset_ + 1;
2201       render_view_->history_page_ids_.resize(
2202           render_view_->history_list_length_, -1);
2203       render_view_->history_page_ids_[render_view_->history_list_offset_] =
2204           render_view_->page_id_;
2205     }
2206   } else {
2207     // Inspect the navigation_state on this frame to see if the navigation
2208     // corresponds to a session history navigation...  Note: |frame| may or
2209     // may not be the toplevel frame, but for the case of capturing session
2210     // history, the first committed frame suffices.  We keep track of whether
2211     // we've seen this commit before so that only capture session history once
2212     // per navigation.
2213     //
2214     // Note that we need to check if the page ID changed. In the case of a
2215     // reload, the page ID doesn't change, and UpdateSessionHistory gets the
2216     // previous URL and the current page ID, which would be wrong.
2217     if (navigation_state->pending_page_id() != -1 &&
2218         navigation_state->pending_page_id() != render_view_->page_id_ &&
2219         !navigation_state->request_committed()) {
2220       // This is a successful session history navigation!
2221       render_view_->page_id_ = navigation_state->pending_page_id();
2222
2223       render_view_->history_list_offset_ =
2224           navigation_state->pending_history_list_offset();
2225
2226       // If the history list is valid, our list of page IDs should be correct.
2227       DCHECK(render_view_->history_list_length_ <= 0 ||
2228              render_view_->history_list_offset_ < 0 ||
2229              render_view_->history_list_offset_ >=
2230                  render_view_->history_list_length_ ||
2231              render_view_->history_page_ids_[render_view_->history_list_offset_]
2232                   == render_view_->page_id_);
2233     }
2234   }
2235
2236   Send(new FrameHostMsg_DidAssignPageId(routing_id_, render_view_->page_id_));
2237
2238   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers_,
2239                     DidCommitProvisionalLoad(frame, is_new_navigation));
2240   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
2241                     DidCommitProvisionalLoad(is_new_navigation));
2242
2243   if (!frame->parent()) {  // Only for top frames.
2244     RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
2245     if (render_thread_impl) {  // Can be NULL in tests.
2246       render_thread_impl->histogram_customizer()->
2247           RenderViewNavigatedToHost(GURL(GetLoadingUrl()).host(),
2248                                     RenderViewImpl::GetRenderViewCount());
2249     }
2250   }
2251
2252   // Remember that we've already processed this request, so we don't update
2253   // the session history again.  We do this regardless of whether this is
2254   // a session history navigation, because if we attempted a session history
2255   // navigation without valid HistoryItem state, WebCore will think it is a
2256   // new navigation.
2257   navigation_state->set_request_committed(true);
2258
2259   SendDidCommitProvisionalLoad(frame);
2260
2261   // Check whether we have new encoding name.
2262   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2263 }
2264
2265 void RenderFrameImpl::didClearWindowObject(blink::WebLocalFrame* frame) {
2266   DCHECK(!frame_ || frame_ == frame);
2267   // TODO(nasko): Move implementation here. Needed state:
2268   // * enabled_bindings_
2269   // * dom_automation_controller_
2270   // * stats_collection_controller_
2271
2272   render_view_->didClearWindowObject(frame);
2273
2274   if (render_view_->GetEnabledBindings() & BINDINGS_POLICY_DOM_AUTOMATION)
2275     DomAutomationController::Install(this, frame);
2276
2277   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidClearWindowObject());
2278 }
2279
2280 void RenderFrameImpl::didCreateDocumentElement(blink::WebLocalFrame* frame) {
2281   DCHECK(!frame_ || frame_ == frame);
2282
2283   // Notify the browser about non-blank documents loading in the top frame.
2284   GURL url = frame->document().url();
2285   if (url.is_valid() && url.spec() != url::kAboutBlankURL) {
2286     // TODO(nasko): Check if webview()->mainFrame() is the same as the
2287     // frame->tree()->top().
2288     blink::WebFrame* main_frame = render_view_->webview()->mainFrame();
2289     if (frame == main_frame) {
2290       // For now, don't remember plugin zoom values.  We don't want to mix them
2291       // with normal web content (i.e. a fixed layout plugin would usually want
2292       // them different).
2293       render_view_->Send(new ViewHostMsg_DocumentAvailableInMainFrame(
2294           render_view_->GetRoutingID(),
2295           main_frame->document().isPluginDocument()));
2296     }
2297   }
2298
2299   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2300                     DidCreateDocumentElement(frame));
2301 }
2302
2303 void RenderFrameImpl::didReceiveTitle(blink::WebLocalFrame* frame,
2304                                       const blink::WebString& title,
2305                                       blink::WebTextDirection direction) {
2306   DCHECK(!frame_ || frame_ == frame);
2307   // Ignore all but top level navigations.
2308   if (!frame->parent()) {
2309     base::string16 title16 = title;
2310     base::debug::TraceLog::GetInstance()->UpdateProcessLabel(
2311         routing_id_, base::UTF16ToUTF8(title16));
2312
2313     base::string16 shortened_title = title16.substr(0, kMaxTitleChars);
2314     Send(new FrameHostMsg_UpdateTitle(routing_id_,
2315                                       render_view_->page_id_,
2316                                       shortened_title, direction));
2317   }
2318
2319   // Also check whether we have new encoding name.
2320   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2321 }
2322
2323 void RenderFrameImpl::didChangeIcon(blink::WebLocalFrame* frame,
2324                                     blink::WebIconURL::Type icon_type) {
2325   DCHECK(!frame_ || frame_ == frame);
2326   // TODO(nasko): Investigate wheather implementation should move here.
2327   render_view_->didChangeIcon(frame, icon_type);
2328 }
2329
2330 void RenderFrameImpl::didFinishDocumentLoad(blink::WebLocalFrame* frame) {
2331   TRACE_EVENT1("navigation", "RenderFrameImpl::didFinishDocumentLoad",
2332                "id", routing_id_);
2333   DCHECK(!frame_ || frame_ == frame);
2334   WebDataSource* ds = frame->dataSource();
2335   DocumentState* document_state = DocumentState::FromDataSource(ds);
2336   document_state->set_finish_document_load_time(Time::Now());
2337
2338   Send(new FrameHostMsg_DidFinishDocumentLoad(routing_id_));
2339
2340   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2341                     DidFinishDocumentLoad(frame));
2342   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishDocumentLoad());
2343
2344   // Check whether we have new encoding name.
2345   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2346 }
2347
2348 void RenderFrameImpl::didHandleOnloadEvents(blink::WebLocalFrame* frame) {
2349   DCHECK(!frame_ || frame_ == frame);
2350   if (!frame->parent())
2351     Send(new FrameHostMsg_DocumentOnLoadCompleted(routing_id_));
2352 }
2353
2354 void RenderFrameImpl::didFailLoad(blink::WebLocalFrame* frame,
2355                                   const blink::WebURLError& error) {
2356   TRACE_EVENT1("navigation", "RenderFrameImpl::didFailLoad",
2357                "id", routing_id_);
2358   DCHECK(!frame_ || frame_ == frame);
2359   // TODO(nasko): Move implementation here. No state needed.
2360   WebDataSource* ds = frame->dataSource();
2361   DCHECK(ds);
2362
2363   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2364                     DidFailLoad(frame, error));
2365
2366   const WebURLRequest& failed_request = ds->request();
2367   base::string16 error_description;
2368   GetContentClient()->renderer()->GetNavigationErrorStrings(
2369       render_view_.get(),
2370       frame,
2371       failed_request,
2372       error,
2373       NULL,
2374       &error_description);
2375   Send(new FrameHostMsg_DidFailLoadWithError(routing_id_,
2376                                              failed_request.url(),
2377                                              error.reason,
2378                                              error_description));
2379 }
2380
2381 void RenderFrameImpl::didFinishLoad(blink::WebLocalFrame* frame) {
2382   TRACE_EVENT1("navigation", "RenderFrameImpl::didFinishLoad",
2383                "id", routing_id_);
2384   DCHECK(!frame_ || frame_ == frame);
2385   WebDataSource* ds = frame->dataSource();
2386   DocumentState* document_state = DocumentState::FromDataSource(ds);
2387   if (document_state->finish_load_time().is_null()) {
2388     if (!frame->parent()) {
2389       TRACE_EVENT_INSTANT0("WebCore", "LoadFinished",
2390                            TRACE_EVENT_SCOPE_PROCESS);
2391     }
2392     document_state->set_finish_load_time(Time::Now());
2393   }
2394
2395   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2396                     DidFinishLoad(frame));
2397   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishLoad());
2398
2399   // Don't send this message while the frame is swapped out.
2400   if (is_swapped_out())
2401     return;
2402
2403   Send(new FrameHostMsg_DidFinishLoad(routing_id_,
2404                                       ds->request().url()));
2405 }
2406
2407 void RenderFrameImpl::didNavigateWithinPage(blink::WebLocalFrame* frame,
2408     const blink::WebHistoryItem& item,
2409     blink::WebHistoryCommitType commit_type) {
2410   TRACE_EVENT1("navigation", "RenderFrameImpl::didNavigateWithinPage",
2411                "id", routing_id_);
2412   DCHECK(!frame_ || frame_ == frame);
2413   // If this was a reference fragment navigation that we initiated, then we
2414   // could end up having a non-null pending navigation params.  We just need to
2415   // update the ExtraData on the datasource so that others who read the
2416   // ExtraData will get the new NavigationState.  Similarly, if we did not
2417   // initiate this navigation, then we need to take care to reset any pre-
2418   // existing navigation state to a content-initiated navigation state.
2419   // DidCreateDataSource conveniently takes care of this for us.
2420   didCreateDataSource(frame, frame->dataSource());
2421
2422   DocumentState* document_state =
2423       DocumentState::FromDataSource(frame->dataSource());
2424   NavigationState* new_state = document_state->navigation_state();
2425   new_state->set_was_within_same_page(true);
2426
2427   didCommitProvisionalLoad(frame, item, commit_type);
2428 }
2429
2430 void RenderFrameImpl::didUpdateCurrentHistoryItem(blink::WebLocalFrame* frame) {
2431   DCHECK(!frame_ || frame_ == frame);
2432   // TODO(nasko): Move implementation here. Needed methods:
2433   // * StartNavStateSyncTimerIfNecessary
2434   render_view_->didUpdateCurrentHistoryItem(frame);
2435 }
2436
2437 void RenderFrameImpl::addNavigationTransitionData(
2438     const blink::WebString& allowed_destination_host_pattern,
2439     const blink::WebString& selector,
2440     const blink::WebString& markup) {
2441   Send(new FrameHostMsg_AddNavigationTransitionData(
2442       routing_id_, allowed_destination_host_pattern.utf8(), selector.utf8(),
2443       markup.utf8()));
2444 }
2445
2446 void RenderFrameImpl::didChangeThemeColor() {
2447   if (frame_->parent())
2448     return;
2449
2450   Send(new FrameHostMsg_DidChangeThemeColor(
2451       routing_id_, frame_->document().themeColor()));
2452 }
2453
2454 void RenderFrameImpl::requestNotificationPermission(
2455     const blink::WebSecurityOrigin& origin,
2456     blink::WebNotificationPermissionCallback* callback) {
2457   if (!notification_permission_dispatcher_) {
2458     notification_permission_dispatcher_ =
2459         new NotificationPermissionDispatcher(this);
2460   }
2461
2462   notification_permission_dispatcher_->RequestPermission(origin, callback);
2463 }
2464
2465 blink::WebNotificationPresenter* RenderFrameImpl::notificationPresenter() {
2466   return notification_provider_;
2467 }
2468
2469 void RenderFrameImpl::didChangeSelection(bool is_empty_selection) {
2470   if (!GetRenderWidget()->handling_input_event() && !handling_select_range_)
2471     return;
2472
2473   if (is_empty_selection)
2474     selection_text_.clear();
2475
2476   // UpdateTextInputState should be called before SyncSelectionIfRequired.
2477   // UpdateTextInputState may send TextInputStateChanged to notify the focus
2478   // was changed, and SyncSelectionIfRequired may send SelectionChanged
2479   // to notify the selection was changed.  Focus change should be notified
2480   // before selection change.
2481   GetRenderWidget()->UpdateTextInputState(
2482       RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
2483   SyncSelectionIfRequired();
2484 }
2485
2486 blink::WebColorChooser* RenderFrameImpl::createColorChooser(
2487     blink::WebColorChooserClient* client,
2488     const blink::WebColor& initial_color,
2489     const blink::WebVector<blink::WebColorSuggestion>& suggestions) {
2490   RendererWebColorChooserImpl* color_chooser =
2491       new RendererWebColorChooserImpl(this, client);
2492   std::vector<content::ColorSuggestion> color_suggestions;
2493   for (size_t i = 0; i < suggestions.size(); i++) {
2494     color_suggestions.push_back(content::ColorSuggestion(suggestions[i]));
2495   }
2496   color_chooser->Open(static_cast<SkColor>(initial_color), color_suggestions);
2497   return color_chooser;
2498 }
2499
2500 void RenderFrameImpl::runModalAlertDialog(const blink::WebString& message) {
2501   RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_ALERT,
2502                        message,
2503                        base::string16(),
2504                        frame_->document().url(),
2505                        NULL);
2506 }
2507
2508 bool RenderFrameImpl::runModalConfirmDialog(const blink::WebString& message) {
2509   return RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_CONFIRM,
2510                               message,
2511                               base::string16(),
2512                               frame_->document().url(),
2513                               NULL);
2514 }
2515
2516 bool RenderFrameImpl::runModalPromptDialog(
2517     const blink::WebString& message,
2518     const blink::WebString& default_value,
2519     blink::WebString* actual_value) {
2520   base::string16 result;
2521   bool ok = RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_PROMPT,
2522                                  message,
2523                                  default_value,
2524                                  frame_->document().url(),
2525                                  &result);
2526   if (ok)
2527     actual_value->assign(result);
2528   return ok;
2529 }
2530
2531 bool RenderFrameImpl::runModalBeforeUnloadDialog(
2532     bool is_reload,
2533     const blink::WebString& message) {
2534   // If we are swapping out, we have already run the beforeunload handler.
2535   // TODO(creis): Fix OnSwapOut to clear the frame without running beforeunload
2536   // at all, to avoid running it twice.
2537   if (render_view()->is_swapped_out_)
2538     return true;
2539
2540   // Don't allow further dialogs if we are waiting to swap out, since the
2541   // PageGroupLoadDeferrer in our stack prevents it.
2542   if (render_view()->suppress_dialogs_until_swap_out_)
2543     return false;
2544
2545   bool success = false;
2546   // This is an ignored return value, but is included so we can accept the same
2547   // response as RunJavaScriptMessage.
2548   base::string16 ignored_result;
2549   render_view()->SendAndRunNestedMessageLoop(
2550       new FrameHostMsg_RunBeforeUnloadConfirm(
2551           routing_id_, frame_->document().url(), message, is_reload,
2552           &success, &ignored_result));
2553   return success;
2554 }
2555
2556 void RenderFrameImpl::showContextMenu(const blink::WebContextMenuData& data) {
2557   ContextMenuParams params = ContextMenuParamsBuilder::Build(data);
2558   params.source_type = GetRenderWidget()->context_menu_source_type();
2559   GetRenderWidget()->OnShowHostContextMenu(&params);
2560   if (GetRenderWidget()->has_host_context_menu_location()) {
2561     params.x = GetRenderWidget()->host_context_menu_location().x();
2562     params.y = GetRenderWidget()->host_context_menu_location().y();
2563   }
2564
2565   // Serializing a GURL longer than kMaxURLChars will fail, so don't do
2566   // it.  We replace it with an empty GURL so the appropriate items are disabled
2567   // in the context menu.
2568   // TODO(jcivelli): http://crbug.com/45160 This prevents us from saving large
2569   //                 data encoded images.  We should have a way to save them.
2570   if (params.src_url.spec().size() > GetMaxURLChars())
2571     params.src_url = GURL();
2572   context_menu_node_ = data.node;
2573
2574 #if defined(OS_ANDROID)
2575   gfx::Rect start_rect;
2576   gfx::Rect end_rect;
2577   GetRenderWidget()->GetSelectionBounds(&start_rect, &end_rect);
2578   params.selection_start = gfx::Point(start_rect.x(), start_rect.bottom());
2579   params.selection_end = gfx::Point(end_rect.right(), end_rect.bottom());
2580 #endif
2581
2582   Send(new FrameHostMsg_ContextMenu(routing_id_, params));
2583 }
2584
2585 void RenderFrameImpl::clearContextMenu() {
2586   context_menu_node_.reset();
2587 }
2588
2589 void RenderFrameImpl::willSendRequest(
2590     blink::WebLocalFrame* frame,
2591     unsigned identifier,
2592     blink::WebURLRequest& request,
2593     const blink::WebURLResponse& redirect_response) {
2594   DCHECK(!frame_ || frame_ == frame);
2595   // The request my be empty during tests.
2596   if (request.url().isEmpty())
2597     return;
2598
2599   // Set the first party for cookies url if it has not been set yet (new
2600   // requests). For redirects, it is updated by WebURLLoaderImpl.
2601   if (request.firstPartyForCookies().isEmpty()) {
2602     if (request.frameType() == blink::WebURLRequest::FrameTypeTopLevel) {
2603       request.setFirstPartyForCookies(request.url());
2604     } else {
2605       // TODO(nasko): When the top-level frame is remote, there is no document.
2606       // This is broken and should be fixed to propagate the first party.
2607       WebFrame* top = frame->top();
2608       if (top->isWebLocalFrame()) {
2609         request.setFirstPartyForCookies(
2610             frame->top()->document().firstPartyForCookies());
2611       }
2612     }
2613   }
2614
2615   WebFrame* top_frame = frame->top();
2616   // TODO(nasko): Hack around asking about top-frame data source. This means
2617   // for out-of-process iframes we are treating the current frame as the
2618   // top-level frame, which is wrong.
2619   if (!top_frame || top_frame->isWebRemoteFrame())
2620     top_frame = frame;
2621   WebDataSource* provisional_data_source = top_frame->provisionalDataSource();
2622   WebDataSource* top_data_source = top_frame->dataSource();
2623   WebDataSource* data_source =
2624       provisional_data_source ? provisional_data_source : top_data_source;
2625
2626   ui::PageTransition transition_type = ui::PAGE_TRANSITION_LINK;
2627   DocumentState* document_state = DocumentState::FromDataSource(data_source);
2628   DCHECK(document_state);
2629   InternalDocumentStateData* internal_data =
2630       InternalDocumentStateData::FromDocumentState(document_state);
2631   NavigationState* navigation_state = document_state->navigation_state();
2632   transition_type = navigation_state->transition_type();
2633
2634   GURL request_url(request.url());
2635   GURL new_url;
2636   if (GetContentClient()->renderer()->WillSendRequest(
2637           frame,
2638           transition_type,
2639           request_url,
2640           request.firstPartyForCookies(),
2641           &new_url)) {
2642     request.setURL(WebURL(new_url));
2643   }
2644
2645   if (internal_data->is_cache_policy_override_set())
2646     request.setCachePolicy(internal_data->cache_policy_override());
2647
2648   // The request's extra data may indicate that we should set a custom user
2649   // agent. This needs to be done here, after WebKit is through with setting the
2650   // user agent on its own. Similarly, it may indicate that we should set an
2651   // X-Requested-With header. This must be done here to avoid breaking CORS
2652   // checks.
2653   // PlzNavigate: there may also be a stream url associated with the request.
2654   WebString custom_user_agent;
2655   WebString requested_with;
2656   scoped_ptr<StreamOverrideParameters> stream_override;
2657   if (request.extraData()) {
2658     RequestExtraData* old_extra_data =
2659         static_cast<RequestExtraData*>(request.extraData());
2660
2661     custom_user_agent = old_extra_data->custom_user_agent();
2662     if (!custom_user_agent.isNull()) {
2663       if (custom_user_agent.isEmpty())
2664         request.clearHTTPHeaderField("User-Agent");
2665       else
2666         request.setHTTPHeaderField("User-Agent", custom_user_agent);
2667     }
2668
2669     requested_with = old_extra_data->requested_with();
2670     if (!requested_with.isNull()) {
2671       if (requested_with.isEmpty())
2672         request.clearHTTPHeaderField("X-Requested-With");
2673       else
2674         request.setHTTPHeaderField("X-Requested-With", requested_with);
2675     }
2676     stream_override = old_extra_data->TakeStreamOverrideOwnership();
2677   }
2678
2679   // Add the default accept header for frame request if it has not been set
2680   // already.
2681   if ((request.frameType() == blink::WebURLRequest::FrameTypeTopLevel ||
2682        request.frameType() == blink::WebURLRequest::FrameTypeNested) &&
2683       request.httpHeaderField(WebString::fromUTF8(kAcceptHeader)).isEmpty()) {
2684     request.setHTTPHeaderField(WebString::fromUTF8(kAcceptHeader),
2685                                WebString::fromUTF8(kDefaultAcceptHeader));
2686   }
2687
2688   // Add an empty HTTP origin header for non GET methods if none is currently
2689   // present.
2690   request.addHTTPOriginIfNeeded(WebString());
2691
2692   // Attach |should_replace_current_entry| state to requests so that, should
2693   // this navigation later require a request transfer, all state is preserved
2694   // when it is re-created in the new process.
2695   bool should_replace_current_entry = false;
2696   if (navigation_state->is_content_initiated()) {
2697     should_replace_current_entry = data_source->replacesCurrentHistoryItem();
2698   } else {
2699     // If the navigation is browser-initiated, the NavigationState contains the
2700     // correct value instead of the WebDataSource.
2701     //
2702     // TODO(davidben): Avoid this awkward duplication of state. See comment on
2703     // NavigationState::should_replace_current_entry().
2704     should_replace_current_entry =
2705         navigation_state->should_replace_current_entry();
2706   }
2707
2708   int provider_id = kInvalidServiceWorkerProviderId;
2709   if (request.frameType() == blink::WebURLRequest::FrameTypeTopLevel ||
2710       request.frameType() == blink::WebURLRequest::FrameTypeNested) {
2711     // |provisionalDataSource| may be null in some content::ResourceFetcher
2712     // use cases, we don't hook those requests.
2713     if (frame->provisionalDataSource()) {
2714       ServiceWorkerNetworkProvider* provider =
2715           ServiceWorkerNetworkProvider::FromDocumentState(
2716               DocumentState::FromDataSource(frame->provisionalDataSource()));
2717       provider_id = provider->provider_id();
2718     }
2719   } else if (frame->dataSource()) {
2720     ServiceWorkerNetworkProvider* provider =
2721         ServiceWorkerNetworkProvider::FromDocumentState(
2722             DocumentState::FromDataSource(frame->dataSource()));
2723     provider_id = provider->provider_id();
2724   }
2725
2726   WebFrame* parent = frame->parent();
2727   int parent_routing_id = MSG_ROUTING_NONE;
2728   if (!parent) {
2729     parent_routing_id = -1;
2730   } else if (parent->isWebLocalFrame()) {
2731     parent_routing_id = FromWebFrame(parent)->GetRoutingID();
2732   } else {
2733     parent_routing_id = RenderFrameProxy::FromWebFrame(parent)->routing_id();
2734   }
2735
2736   RequestExtraData* extra_data = new RequestExtraData();
2737   extra_data->set_visibility_state(render_view_->visibilityState());
2738   extra_data->set_custom_user_agent(custom_user_agent);
2739   extra_data->set_requested_with(requested_with);
2740   extra_data->set_render_frame_id(routing_id_);
2741   extra_data->set_is_main_frame(frame == top_frame);
2742   extra_data->set_frame_origin(
2743       GURL(frame->document().securityOrigin().toString()));
2744   extra_data->set_parent_is_main_frame(frame->parent() == top_frame);
2745   extra_data->set_parent_render_frame_id(parent_routing_id);
2746   extra_data->set_allow_download(navigation_state->allow_download());
2747   extra_data->set_transition_type(transition_type);
2748   extra_data->set_should_replace_current_entry(should_replace_current_entry);
2749   extra_data->set_transferred_request_child_id(
2750       navigation_state->transferred_request_child_id());
2751   extra_data->set_transferred_request_request_id(
2752       navigation_state->transferred_request_request_id());
2753   extra_data->set_service_worker_provider_id(provider_id);
2754   extra_data->set_stream_override(stream_override.Pass());
2755   request.setExtraData(extra_data);
2756
2757   DocumentState* top_document_state =
2758       DocumentState::FromDataSource(top_data_source);
2759   if (top_document_state) {
2760     // TODO(gavinp): separate out prefetching and prerender field trials
2761     // if the rel=prerender rel type is sticking around.
2762     if (request.requestContext() == WebURLRequest::RequestContextPrefetch)
2763       top_document_state->set_was_prefetcher(true);
2764   }
2765
2766   // This is an instance where we embed a copy of the routing id
2767   // into the data portion of the message. This can cause problems if we
2768   // don't register this id on the browser side, since the download manager
2769   // expects to find a RenderViewHost based off the id.
2770   request.setRequestorID(render_view_->GetRoutingID());
2771   request.setHasUserGesture(WebUserGestureIndicator::isProcessingUserGesture());
2772
2773   if (!navigation_state->extra_headers().empty()) {
2774     for (net::HttpUtil::HeadersIterator i(
2775         navigation_state->extra_headers().begin(),
2776         navigation_state->extra_headers().end(), "\n");
2777         i.GetNext(); ) {
2778       if (LowerCaseEqualsASCII(i.name(), "referer")) {
2779         WebString referrer = WebSecurityPolicy::generateReferrerHeader(
2780             blink::WebReferrerPolicyDefault,
2781             request.url(),
2782             WebString::fromUTF8(i.values()));
2783         request.setHTTPReferrer(referrer, blink::WebReferrerPolicyDefault);
2784       } else {
2785         request.setHTTPHeaderField(WebString::fromUTF8(i.name()),
2786                                    WebString::fromUTF8(i.values()));
2787       }
2788     }
2789   }
2790
2791   if (!render_view_->renderer_preferences_.enable_referrers)
2792     request.setHTTPReferrer(WebString(), blink::WebReferrerPolicyDefault);
2793 }
2794
2795 void RenderFrameImpl::didReceiveResponse(
2796     blink::WebLocalFrame* frame,
2797     unsigned identifier,
2798     const blink::WebURLResponse& response) {
2799   DCHECK(!frame_ || frame_ == frame);
2800   // Only do this for responses that correspond to a provisional data source
2801   // of the top-most frame.  If we have a provisional data source, then we
2802   // can't have any sub-resources yet, so we know that this response must
2803   // correspond to a frame load.
2804   if (!frame->provisionalDataSource() || frame->parent())
2805     return;
2806
2807   // If we are in view source mode, then just let the user see the source of
2808   // the server's error page.
2809   if (frame->isViewSourceModeEnabled())
2810     return;
2811
2812   DocumentState* document_state =
2813       DocumentState::FromDataSource(frame->provisionalDataSource());
2814   int http_status_code = response.httpStatusCode();
2815
2816   // Record page load flags.
2817   WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
2818   if (extra_data) {
2819     document_state->set_was_fetched_via_spdy(
2820         extra_data->was_fetched_via_spdy());
2821     document_state->set_was_npn_negotiated(
2822         extra_data->was_npn_negotiated());
2823     document_state->set_npn_negotiated_protocol(
2824         extra_data->npn_negotiated_protocol());
2825     document_state->set_was_alternate_protocol_available(
2826         extra_data->was_alternate_protocol_available());
2827     document_state->set_connection_info(
2828         extra_data->connection_info());
2829     document_state->set_was_fetched_via_proxy(
2830         extra_data->was_fetched_via_proxy());
2831   }
2832   InternalDocumentStateData* internal_data =
2833       InternalDocumentStateData::FromDocumentState(document_state);
2834   internal_data->set_http_status_code(http_status_code);
2835   // Whether or not the http status code actually corresponds to an error is
2836   // only checked when the page is done loading, if |use_error_page| is
2837   // still true.
2838   internal_data->set_use_error_page(true);
2839 }
2840
2841 void RenderFrameImpl::didFinishResourceLoad(blink::WebLocalFrame* frame,
2842                                             unsigned identifier) {
2843   DCHECK(!frame_ || frame_ == frame);
2844   InternalDocumentStateData* internal_data =
2845       InternalDocumentStateData::FromDataSource(frame->dataSource());
2846   if (!internal_data->use_error_page())
2847     return;
2848
2849   // Do not show error page when DevTools is attached.
2850   if (render_view_->devtools_agent_->IsAttached())
2851     return;
2852
2853   // Display error page, if appropriate.
2854   std::string error_domain = "http";
2855   int http_status_code = internal_data->http_status_code();
2856   if (GetContentClient()->renderer()->HasErrorPage(
2857           http_status_code, &error_domain)) {
2858     WebURLError error;
2859     error.unreachableURL = frame->document().url();
2860     error.domain = WebString::fromUTF8(error_domain);
2861     error.reason = http_status_code;
2862     LoadNavigationErrorPage(frame->dataSource()->request(), error, true);
2863   }
2864 }
2865
2866 void RenderFrameImpl::didLoadResourceFromMemoryCache(
2867     blink::WebLocalFrame* frame,
2868     const blink::WebURLRequest& request,
2869     const blink::WebURLResponse& response) {
2870   DCHECK(!frame_ || frame_ == frame);
2871   // The recipients of this message have no use for data: URLs: they don't
2872   // affect the page's insecure content list and are not in the disk cache. To
2873   // prevent large (1M+) data: URLs from crashing in the IPC system, we simply
2874   // filter them out here.
2875   GURL url(request.url());
2876   if (url.SchemeIs(url::kDataScheme))
2877     return;
2878
2879   // Let the browser know we loaded a resource from the memory cache.  This
2880   // message is needed to display the correct SSL indicators.
2881   render_view_->Send(new ViewHostMsg_DidLoadResourceFromMemoryCache(
2882       render_view_->GetRoutingID(),
2883       url,
2884       response.securityInfo(),
2885       request.httpMethod().utf8(),
2886       response.mimeType().utf8(),
2887       WebURLRequestToResourceType(request)));
2888 }
2889
2890 void RenderFrameImpl::didDisplayInsecureContent(blink::WebLocalFrame* frame) {
2891   DCHECK(!frame_ || frame_ == frame);
2892   render_view_->Send(new ViewHostMsg_DidDisplayInsecureContent(
2893       render_view_->GetRoutingID()));
2894 }
2895
2896 void RenderFrameImpl::didRunInsecureContent(
2897     blink::WebLocalFrame* frame,
2898     const blink::WebSecurityOrigin& origin,
2899     const blink::WebURL& target) {
2900   DCHECK(!frame_ || frame_ == frame);
2901   render_view_->Send(new ViewHostMsg_DidRunInsecureContent(
2902       render_view_->GetRoutingID(),
2903       origin.toString().utf8(),
2904       target));
2905 }
2906
2907 void RenderFrameImpl::didAbortLoading(blink::WebLocalFrame* frame) {
2908   DCHECK(!frame_ || frame_ == frame);
2909 #if defined(ENABLE_PLUGINS)
2910   if (frame != render_view_->webview()->mainFrame())
2911     return;
2912   PluginChannelHost::Broadcast(
2913       new PluginHostMsg_DidAbortLoading(render_view_->GetRoutingID()));
2914 #endif
2915 }
2916
2917 void RenderFrameImpl::didCreateScriptContext(blink::WebLocalFrame* frame,
2918                                              v8::Handle<v8::Context> context,
2919                                              int extension_group,
2920                                              int world_id) {
2921   DCHECK(!frame_ || frame_ == frame);
2922   GetContentClient()->renderer()->DidCreateScriptContext(
2923       frame, context, extension_group, world_id);
2924 }
2925
2926 void RenderFrameImpl::willReleaseScriptContext(blink::WebLocalFrame* frame,
2927                                                v8::Handle<v8::Context> context,
2928                                                int world_id) {
2929   DCHECK(!frame_ || frame_ == frame);
2930
2931   FOR_EACH_OBSERVER(RenderFrameObserver,
2932                     observers_,
2933                     WillReleaseScriptContext(context, world_id));
2934 }
2935
2936 void RenderFrameImpl::didFirstVisuallyNonEmptyLayout(
2937     blink::WebLocalFrame* frame) {
2938   DCHECK(!frame_ || frame_ == frame);
2939   if (frame->parent())
2940     return;
2941
2942   InternalDocumentStateData* data =
2943       InternalDocumentStateData::FromDataSource(frame->dataSource());
2944   data->set_did_first_visually_non_empty_layout(true);
2945
2946 #if defined(OS_ANDROID)
2947   GetRenderWidget()->DidChangeBodyBackgroundColor(
2948       render_view_->webwidget_->backgroundColor());
2949 #endif
2950
2951   GetRenderWidget()->QueueMessage(
2952       new FrameHostMsg_DidFirstVisuallyNonEmptyPaint(routing_id_),
2953       MESSAGE_DELIVERY_POLICY_WITH_VISUAL_STATE);
2954 }
2955
2956 void RenderFrameImpl::didChangeScrollOffset(blink::WebLocalFrame* frame) {
2957   DCHECK(!frame_ || frame_ == frame);
2958   // TODO(nasko): Move implementation here. Needed methods:
2959   // * StartNavStateSyncTimerIfNecessary
2960   render_view_->didChangeScrollOffset(frame);
2961 }
2962
2963 void RenderFrameImpl::willInsertBody(blink::WebLocalFrame* frame) {
2964   DCHECK(!frame_ || frame_ == frame);
2965   if (!frame->parent()) {
2966     render_view_->Send(new ViewHostMsg_WillInsertBody(
2967         render_view_->GetRoutingID()));
2968   }
2969 }
2970
2971 void RenderFrameImpl::reportFindInPageMatchCount(int request_id,
2972                                                  int count,
2973                                                  bool final_update) {
2974   int active_match_ordinal = -1;  // -1 = don't update active match ordinal
2975   if (!count)
2976     active_match_ordinal = 0;
2977
2978   render_view_->Send(new ViewHostMsg_Find_Reply(
2979       render_view_->GetRoutingID(), request_id, count,
2980       gfx::Rect(), active_match_ordinal, final_update));
2981 }
2982
2983 void RenderFrameImpl::reportFindInPageSelection(
2984     int request_id,
2985     int active_match_ordinal,
2986     const blink::WebRect& selection_rect) {
2987   render_view_->Send(new ViewHostMsg_Find_Reply(
2988       render_view_->GetRoutingID(), request_id, -1, selection_rect,
2989       active_match_ordinal, false));
2990 }
2991
2992 void RenderFrameImpl::requestStorageQuota(
2993     blink::WebLocalFrame* frame,
2994     blink::WebStorageQuotaType type,
2995     unsigned long long requested_size,
2996     blink::WebStorageQuotaCallbacks callbacks) {
2997   DCHECK(!frame_ || frame_ == frame);
2998   WebSecurityOrigin origin = frame->document().securityOrigin();
2999   if (origin.isUnique()) {
3000     // Unique origins cannot store persistent state.
3001     callbacks.didFail(blink::WebStorageQuotaErrorAbort);
3002     return;
3003   }
3004   ChildThread::current()->quota_dispatcher()->RequestStorageQuota(
3005       render_view_->GetRoutingID(),
3006       GURL(origin.toString()),
3007       static_cast<storage::StorageType>(type),
3008       requested_size,
3009       QuotaDispatcher::CreateWebStorageQuotaCallbacksWrapper(callbacks));
3010 }
3011
3012 void RenderFrameImpl::willOpenSocketStream(
3013     blink::WebSocketStreamHandle* handle) {
3014   WebSocketStreamHandleImpl* impl =
3015       static_cast<WebSocketStreamHandleImpl*>(handle);
3016   impl->SetUserData(handle, new SocketStreamHandleData(routing_id_));
3017 }
3018
3019 void RenderFrameImpl::willOpenWebSocket(blink::WebSocketHandle* handle) {
3020   WebSocketBridge* impl = static_cast<WebSocketBridge*>(handle);
3021   impl->set_render_frame_id(routing_id_);
3022 }
3023
3024 blink::WebGeolocationClient* RenderFrameImpl::geolocationClient() {
3025   if (!geolocation_dispatcher_)
3026     geolocation_dispatcher_ = new GeolocationDispatcher(this);
3027   return geolocation_dispatcher_;
3028 }
3029
3030 blink::WebPushClient* RenderFrameImpl::pushClient() {
3031   if (!push_messaging_dispatcher_)
3032     push_messaging_dispatcher_ = new PushMessagingDispatcher(this);
3033   return push_messaging_dispatcher_;
3034 }
3035
3036 void RenderFrameImpl::willStartUsingPeerConnectionHandler(
3037     blink::WebLocalFrame* frame,
3038     blink::WebRTCPeerConnectionHandler* handler) {
3039   DCHECK(!frame_ || frame_ == frame);
3040 #if defined(ENABLE_WEBRTC)
3041   static_cast<RTCPeerConnectionHandler*>(handler)->associateWithFrame(frame);
3042 #endif
3043 }
3044
3045 blink::WebUserMediaClient* RenderFrameImpl::userMediaClient() {
3046   if (!web_user_media_client_)
3047     InitializeUserMediaClient();
3048   return web_user_media_client_;
3049 }
3050
3051 blink::WebMIDIClient* RenderFrameImpl::webMIDIClient() {
3052   if (!midi_dispatcher_)
3053     midi_dispatcher_ = new MidiDispatcher(this);
3054   return midi_dispatcher_;
3055 }
3056
3057 bool RenderFrameImpl::willCheckAndDispatchMessageEvent(
3058     blink::WebLocalFrame* source_frame,
3059     blink::WebFrame* target_frame,
3060     blink::WebSecurityOrigin target_origin,
3061     blink::WebDOMMessageEvent event) {
3062   DCHECK(!frame_ || frame_ == target_frame);
3063
3064   if (!render_view_->is_swapped_out_)
3065     return false;
3066
3067   ViewMsg_PostMessage_Params params;
3068   params.is_data_raw_string = false;
3069   params.data = event.data().toString();
3070   params.source_origin = event.origin();
3071   if (!target_origin.isNull())
3072     params.target_origin = target_origin.toString();
3073
3074   blink::WebMessagePortChannelArray channels = event.releaseChannels();
3075   if (!channels.isEmpty()) {
3076     std::vector<int> message_port_ids(channels.size());
3077      // Extract the port IDs from the channel array.
3078      for (size_t i = 0; i < channels.size(); ++i) {
3079        WebMessagePortChannelImpl* webchannel =
3080            static_cast<WebMessagePortChannelImpl*>(channels[i]);
3081        message_port_ids[i] = webchannel->message_port_id();
3082        webchannel->QueueMessages();
3083        DCHECK_NE(message_port_ids[i], MSG_ROUTING_NONE);
3084      }
3085      params.message_port_ids = message_port_ids;
3086   }
3087
3088   // Include the routing ID for the source frame (if one exists), which the
3089   // browser process will translate into the routing ID for the equivalent
3090   // frame in the target process.
3091   params.source_routing_id = MSG_ROUTING_NONE;
3092   if (source_frame) {
3093     RenderViewImpl* source_view =
3094         RenderViewImpl::FromWebView(source_frame->view());
3095     if (source_view)
3096       params.source_routing_id = source_view->routing_id();
3097   }
3098
3099   Send(new ViewHostMsg_RouteMessageEvent(render_view_->routing_id_, params));
3100   return true;
3101 }
3102
3103 blink::WebString RenderFrameImpl::userAgentOverride(blink::WebLocalFrame* frame,
3104                                                     const blink::WebURL& url) {
3105   DCHECK(!frame_ || frame_ == frame);
3106   std::string user_agent_override_for_url =
3107       GetContentClient()->renderer()->GetUserAgentOverrideForURL(GURL(url));
3108   if (!user_agent_override_for_url.empty())
3109     return WebString::fromUTF8(user_agent_override_for_url);
3110
3111   if (!render_view_->webview() || !render_view_->webview()->mainFrame() ||
3112       render_view_->renderer_preferences_.user_agent_override.empty()) {
3113     return blink::WebString();
3114   }
3115
3116   // If we're in the middle of committing a load, the data source we need
3117   // will still be provisional.
3118   WebFrame* main_frame = render_view_->webview()->mainFrame();
3119   WebDataSource* data_source = NULL;
3120   if (main_frame->provisionalDataSource())
3121     data_source = main_frame->provisionalDataSource();
3122   else
3123     data_source = main_frame->dataSource();
3124
3125   InternalDocumentStateData* internal_data = data_source ?
3126       InternalDocumentStateData::FromDataSource(data_source) : NULL;
3127   if (internal_data && internal_data->is_overriding_user_agent())
3128     return WebString::fromUTF8(
3129         render_view_->renderer_preferences_.user_agent_override);
3130   return blink::WebString();
3131 }
3132
3133 blink::WebString RenderFrameImpl::doNotTrackValue(blink::WebLocalFrame* frame) {
3134   DCHECK(!frame_ || frame_ == frame);
3135   if (render_view_->renderer_preferences_.enable_do_not_track)
3136     return WebString::fromUTF8("1");
3137   return WebString();
3138 }
3139
3140 bool RenderFrameImpl::allowWebGL(blink::WebLocalFrame* frame,
3141                                  bool default_value) {
3142   DCHECK(!frame_ || frame_ == frame);
3143   if (!default_value)
3144     return false;
3145
3146   bool blocked = true;
3147   render_view_->Send(new ViewHostMsg_Are3DAPIsBlocked(
3148       render_view_->GetRoutingID(),
3149       GURL(frame->top()->document().securityOrigin().toString()),
3150       THREE_D_API_TYPE_WEBGL,
3151       &blocked));
3152   return !blocked;
3153 }
3154
3155 void RenderFrameImpl::didLoseWebGLContext(blink::WebLocalFrame* frame,
3156                                           int arb_robustness_status_code) {
3157   DCHECK(!frame_ || frame_ == frame);
3158   render_view_->Send(new ViewHostMsg_DidLose3DContext(
3159       GURL(frame->top()->document().securityOrigin().toString()),
3160       THREE_D_API_TYPE_WEBGL,
3161       arb_robustness_status_code));
3162 }
3163
3164 void RenderFrameImpl::forwardInputEvent(const blink::WebInputEvent* event) {
3165   Send(new FrameHostMsg_ForwardInputEvent(routing_id_, event));
3166 }
3167
3168 blink::WebScreenOrientationClient*
3169     RenderFrameImpl::webScreenOrientationClient() {
3170   if (!screen_orientation_dispatcher_)
3171     screen_orientation_dispatcher_ = new ScreenOrientationDispatcher(this);
3172   return screen_orientation_dispatcher_;
3173 }
3174
3175 bool RenderFrameImpl::isControlledByServiceWorker(WebDataSource& data_source) {
3176   ServiceWorkerNetworkProvider* provider =
3177       ServiceWorkerNetworkProvider::FromDocumentState(
3178           DocumentState::FromDataSource(&data_source));
3179   return provider->context()->controller_handle_id() !=
3180       kInvalidServiceWorkerHandleId;
3181 }
3182
3183 void RenderFrameImpl::postAccessibilityEvent(const blink::WebAXObject& obj,
3184                                              blink::WebAXEvent event) {
3185   HandleWebAccessibilityEvent(obj, event);
3186 }
3187
3188 void RenderFrameImpl::didChangeManifest(blink::WebLocalFrame* frame)
3189 {
3190   DCHECK(!frame_ || frame_ == frame);
3191
3192   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidChangeManifest());
3193 }
3194
3195 void RenderFrameImpl::DidPlay(blink::WebMediaPlayer* player) {
3196   Send(new FrameHostMsg_MediaPlayingNotification(
3197       routing_id_, reinterpret_cast<int64>(player), player->hasVideo(),
3198       player->hasAudio()));
3199 }
3200
3201 void RenderFrameImpl::DidPause(blink::WebMediaPlayer* player) {
3202   Send(new FrameHostMsg_MediaPausedNotification(
3203       routing_id_, reinterpret_cast<int64>(player)));
3204 }
3205
3206 void RenderFrameImpl::PlayerGone(blink::WebMediaPlayer* player) {
3207   DidPause(player);
3208 }
3209
3210 void RenderFrameImpl::AddObserver(RenderFrameObserver* observer) {
3211   observers_.AddObserver(observer);
3212 }
3213
3214 void RenderFrameImpl::RemoveObserver(RenderFrameObserver* observer) {
3215   observer->RenderFrameGone();
3216   observers_.RemoveObserver(observer);
3217 }
3218
3219 void RenderFrameImpl::OnStop() {
3220   DCHECK(frame_);
3221   frame_->stopLoading();
3222   if (!frame_->parent())
3223     FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers_, OnStop());
3224
3225   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnStop());
3226 }
3227
3228 void RenderFrameImpl::WasHidden() {
3229   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WasHidden());
3230 }
3231
3232 void RenderFrameImpl::WasShown() {
3233   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WasShown());
3234 }
3235
3236 bool RenderFrameImpl::IsHidden() {
3237   return GetRenderWidget()->is_hidden();
3238 }
3239
3240 // Tell the embedding application that the URL of the active page has changed.
3241 void RenderFrameImpl::SendDidCommitProvisionalLoad(blink::WebFrame* frame) {
3242   DCHECK(!frame_ || frame_ == frame);
3243   WebDataSource* ds = frame->dataSource();
3244   DCHECK(ds);
3245
3246   const WebURLRequest& request = ds->request();
3247   const WebURLResponse& response = ds->response();
3248
3249   DocumentState* document_state = DocumentState::FromDataSource(ds);
3250   NavigationState* navigation_state = document_state->navigation_state();
3251   InternalDocumentStateData* internal_data =
3252       InternalDocumentStateData::FromDocumentState(document_state);
3253
3254   FrameHostMsg_DidCommitProvisionalLoad_Params params;
3255   params.http_status_code = response.httpStatusCode();
3256   params.url_is_unreachable = ds->hasUnreachableURL();
3257   params.is_post = false;
3258   params.post_id = -1;
3259   params.page_id = render_view_->page_id_;
3260   // We need to track the RenderViewHost routing_id because of downstream
3261   // dependencies (crbug.com/392171 DownloadRequestHandle, SaveFileManager,
3262   // ResourceDispatcherHostImpl, MediaStreamUIProxy,
3263   // SpeechRecognitionDispatcherHost and possibly others). They look up the view
3264   // based on the ID stored in the resource requests. Once those dependencies
3265   // are unwound or moved to RenderFrameHost (crbug.com/304341) we can move the
3266   // client to be based on the routing_id of the RenderFrameHost.
3267   params.render_view_routing_id = render_view_->routing_id();
3268   params.socket_address.set_host(response.remoteIPAddress().utf8());
3269   params.socket_address.set_port(response.remotePort());
3270   WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
3271   if (extra_data)
3272     params.was_fetched_via_proxy = extra_data->was_fetched_via_proxy();
3273   params.was_within_same_page = navigation_state->was_within_same_page();
3274   params.security_info = response.securityInfo();
3275
3276   // Set the URL to be displayed in the browser UI to the user.
3277   params.url = GetLoadingUrl();
3278   DCHECK(!is_swapped_out_ || params.url == GURL(kSwappedOutURL));
3279
3280   if (frame->document().baseURL() != params.url)
3281     params.base_url = frame->document().baseURL();
3282
3283   GetRedirectChain(ds, &params.redirects);
3284   params.should_update_history = !ds->hasUnreachableURL() &&
3285       !response.isMultipartPayload() && (response.httpStatusCode() != 404);
3286
3287   params.searchable_form_url = internal_data->searchable_form_url();
3288   params.searchable_form_encoding = internal_data->searchable_form_encoding();
3289
3290   params.gesture = render_view_->navigation_gesture_;
3291   render_view_->navigation_gesture_ = NavigationGestureUnknown;
3292
3293   // Make navigation state a part of the DidCommitProvisionalLoad message so
3294   // that commited entry has it at all times.
3295   HistoryEntry* entry = render_view_->history_controller()->GetCurrentEntry();
3296   if (entry)
3297     params.page_state = HistoryEntryToPageState(entry);
3298   else
3299     params.page_state = PageState::CreateFromURL(request.url());
3300
3301   if (!frame->parent()) {
3302     // Top-level navigation.
3303
3304     // Reset the zoom limits in case a plugin had changed them previously. This
3305     // will also call us back which will cause us to send a message to
3306     // update WebContentsImpl.
3307     render_view_->webview()->zoomLimitsChanged(
3308         ZoomFactorToZoomLevel(kMinimumZoomFactor),
3309         ZoomFactorToZoomLevel(kMaximumZoomFactor));
3310
3311     // Set zoom level, but don't do it for full-page plugin since they don't use
3312     // the same zoom settings.
3313     HostZoomLevels::iterator host_zoom =
3314         render_view_->host_zoom_levels_.find(GURL(request.url()));
3315     if (render_view_->webview()->mainFrame()->document().isPluginDocument()) {
3316       // Reset the zoom levels for plugins.
3317       render_view_->webview()->setZoomLevel(0);
3318     } else {
3319       if (host_zoom != render_view_->host_zoom_levels_.end())
3320         render_view_->webview()->setZoomLevel(host_zoom->second);
3321     }
3322
3323     if (host_zoom != render_view_->host_zoom_levels_.end()) {
3324       // This zoom level was merely recorded transiently for this load.  We can
3325       // erase it now.  If at some point we reload this page, the browser will
3326       // send us a new, up-to-date zoom level.
3327       render_view_->host_zoom_levels_.erase(host_zoom);
3328     }
3329
3330     // Update contents MIME type for main frame.
3331     params.contents_mime_type = ds->response().mimeType().utf8();
3332
3333     params.transition = navigation_state->transition_type();
3334     if (!ui::PageTransitionIsMainFrame(params.transition)) {
3335       // If the main frame does a load, it should not be reported as a subframe
3336       // navigation.  This can occur in the following case:
3337       // 1. You're on a site with frames.
3338       // 2. You do a subframe navigation.  This is stored with transition type
3339       //    MANUAL_SUBFRAME.
3340       // 3. You navigate to some non-frame site, say, google.com.
3341       // 4. You navigate back to the page from step 2.  Since it was initially
3342       //    MANUAL_SUBFRAME, it will be that same transition type here.
3343       // We don't want that, because any navigation that changes the toplevel
3344       // frame should be tracked as a toplevel navigation (this allows us to
3345       // update the URL bar, etc).
3346       params.transition = ui::PAGE_TRANSITION_LINK;
3347     }
3348
3349     // If the page contained a client redirect (meta refresh, document.loc...),
3350     // set the referrer and transition appropriately.
3351     if (ds->isClientRedirect()) {
3352       params.referrer =
3353           Referrer(params.redirects[0], ds->request().referrerPolicy());
3354       params.transition = ui::PageTransitionFromInt(
3355           params.transition | ui::PAGE_TRANSITION_CLIENT_REDIRECT);
3356     } else {
3357       params.referrer = RenderViewImpl::GetReferrerFromRequest(
3358           frame, ds->request());
3359     }
3360
3361     base::string16 method = request.httpMethod();
3362     if (EqualsASCII(method, "POST")) {
3363       params.is_post = true;
3364       params.post_id = ExtractPostId(entry->root());
3365     }
3366
3367     // Send the user agent override back.
3368     params.is_overriding_user_agent = internal_data->is_overriding_user_agent();
3369
3370     // Track the URL of the original request.  We use the first entry of the
3371     // redirect chain if it exists because the chain may have started in another
3372     // process.
3373     params.original_request_url = GetOriginalRequestURL(ds);
3374
3375     params.history_list_was_cleared =
3376         navigation_state->history_list_was_cleared();
3377
3378     // Save some histogram data so we can compute the average memory used per
3379     // page load of the glyphs.
3380     UMA_HISTOGRAM_COUNTS_10000("Memory.GlyphPagesPerLoad",
3381                                blink::WebGlyphCache::pageCount());
3382
3383     // This message needs to be sent before any of allowScripts(),
3384     // allowImages(), allowPlugins() is called for the new page, so that when
3385     // these functions send a ViewHostMsg_ContentBlocked message, it arrives
3386     // after the FrameHostMsg_DidCommitProvisionalLoad message.
3387     Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
3388   } else {
3389     // Subframe navigation: the type depends on whether this navigation
3390     // generated a new session history entry. When they do generate a session
3391     // history entry, it means the user initiated the navigation and we should
3392     // mark it as such. This test checks if this is the first time
3393     // SendDidCommitProvisionalLoad has been called since WillNavigateToURL was
3394     // called to initiate the load.
3395     if (render_view_->page_id_ > render_view_->last_page_id_sent_to_browser_)
3396       params.transition = ui::PAGE_TRANSITION_MANUAL_SUBFRAME;
3397     else
3398       params.transition = ui::PAGE_TRANSITION_AUTO_SUBFRAME;
3399
3400     DCHECK(!navigation_state->history_list_was_cleared());
3401     params.history_list_was_cleared = false;
3402
3403     // Don't send this message while the subframe is swapped out.
3404     if (!is_swapped_out())
3405       Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
3406   }
3407
3408   render_view_->last_page_id_sent_to_browser_ =
3409       std::max(render_view_->last_page_id_sent_to_browser_,
3410                render_view_->page_id_);
3411
3412   // If we end up reusing this WebRequest (for example, due to a #ref click),
3413   // we don't want the transition type to persist.  Just clear it.
3414   navigation_state->set_transition_type(ui::PAGE_TRANSITION_LINK);
3415 }
3416
3417 WebElement RenderFrameImpl::GetFocusedElement() {
3418   WebDocument doc = frame_->document();
3419   if (!doc.isNull())
3420     return doc.focusedElement();
3421
3422   return WebElement();
3423 }
3424
3425 void RenderFrameImpl::didStartLoading(bool to_different_document) {
3426   TRACE_EVENT1("navigation", "RenderFrameImpl::didStartLoading",
3427                "id", routing_id_);
3428   render_view_->FrameDidStartLoading(frame_);
3429   Send(new FrameHostMsg_DidStartLoading(routing_id_, to_different_document));
3430 }
3431
3432 void RenderFrameImpl::didStopLoading() {
3433   TRACE_EVENT1("navigation", "RenderFrameImpl::didStopLoading",
3434                "id", routing_id_);
3435   render_view_->FrameDidStopLoading(frame_);
3436   Send(new FrameHostMsg_DidStopLoading(routing_id_));
3437 }
3438
3439 void RenderFrameImpl::didChangeLoadProgress(double load_progress) {
3440   Send(new FrameHostMsg_DidChangeLoadProgress(routing_id_, load_progress));
3441 }
3442
3443 void RenderFrameImpl::HandleWebAccessibilityEvent(
3444     const blink::WebAXObject& obj, blink::WebAXEvent event) {
3445   if (renderer_accessibility_)
3446     renderer_accessibility_->HandleWebAccessibilityEvent(obj, event);
3447 }
3448
3449 void RenderFrameImpl::FocusedNodeChanged(const WebNode& node) {
3450   if (renderer_accessibility_)
3451     renderer_accessibility_->FocusedNodeChanged(node);
3452 }
3453
3454 // PlzNavigate
3455 void RenderFrameImpl::OnCommitNavigation(
3456     const ResourceResponseHead& response,
3457     const GURL& stream_url,
3458     const CommonNavigationParams& common_params,
3459     const CommitNavigationParams& commit_params) {
3460   CHECK(CommandLine::ForCurrentProcess()->HasSwitch(
3461       switches::kEnableBrowserSideNavigation));
3462   bool is_reload = false;
3463   WebURLRequest::CachePolicy cache_policy =
3464       WebURLRequest::UseProtocolCachePolicy;
3465   if (!RenderFrameImpl::PrepareRenderViewForNavigation(
3466       common_params.url, common_params.navigation_type,
3467       commit_params.page_state, false, -1, -1, &is_reload, &cache_policy)) {
3468     return;
3469   }
3470
3471   GetContentClient()->SetActiveURL(common_params.url);
3472
3473   // Create a WebURLRequest that blink can use to get access to the body of the
3474   // response through a stream in the browser. Blink will then commit the
3475   // navigation.
3476   // TODO(clamy): Have the navigation commit directly, without going through
3477   // loading a WebURLRequest.
3478   scoped_ptr<StreamOverrideParameters> stream_override(
3479       new StreamOverrideParameters());
3480   stream_override->stream_url = stream_url;
3481   stream_override->response = response;
3482   WebURLRequest request = CreateURLRequestForNavigation(
3483       common_params, stream_override.Pass(), frame_->isViewSourceModeEnabled());
3484
3485   // Record this before starting the load. A lower bound of this time is needed
3486   // to sanitize the navigationStart override set below.
3487   base::TimeTicks renderer_navigation_start = base::TimeTicks::Now();
3488   frame_->loadRequest(request);
3489   UpdateFrameNavigationTiming(
3490       frame_, commit_params.browser_navigation_start,
3491       renderer_navigation_start);
3492 }
3493
3494 WebNavigationPolicy RenderFrameImpl::DecidePolicyForNavigation(
3495     RenderFrame* render_frame,
3496     const NavigationPolicyInfo& info) {
3497 #ifdef OS_ANDROID
3498   // The handlenavigation API is deprecated and will be removed once
3499   // crbug.com/325351 is resolved.
3500   if (info.urlRequest.url() != GURL(kSwappedOutURL) &&
3501       GetContentClient()->renderer()->HandleNavigation(
3502           render_frame,
3503           static_cast<DocumentState*>(info.extraData),
3504           render_view_->opener_id_,
3505           info.frame,
3506           info.urlRequest,
3507           info.navigationType,
3508           info.defaultPolicy,
3509           info.isRedirect)) {
3510     return blink::WebNavigationPolicyIgnore;
3511   }
3512 #endif
3513
3514   Referrer referrer(RenderViewImpl::GetReferrerFromRequest(info.frame,
3515                                                            info.urlRequest));
3516   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
3517
3518   bool is_subframe = !!info.frame->parent();
3519
3520   if (command_line.HasSwitch(switches::kSitePerProcess) && is_subframe) {
3521     // There's no reason to ignore navigations on subframes, since the swap out
3522     // logic no longer applies.
3523   } else {
3524     if (is_swapped_out_ || render_view_->is_swapped_out()) {
3525       if (info.urlRequest.url() != GURL(kSwappedOutURL)) {
3526         // Targeted links may try to navigate a swapped out frame.  Allow the
3527         // browser process to navigate the tab instead.  Note that it is also
3528         // possible for non-targeted navigations (from this view) to arrive
3529         // here just after we are swapped out.  It's ok to send them to the
3530         // browser, as long as they're for the top level frame.
3531         // TODO(creis): Ensure this supports targeted form submissions when
3532         // fixing http://crbug.com/101395.
3533         if (info.frame->parent() == NULL) {
3534           OpenURL(info.frame, info.urlRequest.url(), referrer,
3535                   info.defaultPolicy);
3536           return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
3537         }
3538
3539         // We should otherwise ignore in-process iframe navigations, if they
3540         // arrive just after we are swapped out.
3541         return blink::WebNavigationPolicyIgnore;
3542       }
3543
3544       // Allow kSwappedOutURL to complete.
3545       return info.defaultPolicy;
3546     }
3547   }
3548
3549   // Webkit is asking whether to navigate to a new URL.
3550   // This is fine normally, except if we're showing UI from one security
3551   // context and they're trying to navigate to a different context.
3552   const GURL& url = info.urlRequest.url();
3553
3554   // A content initiated navigation may have originated from a link-click,
3555   // script, drag-n-drop operation, etc.
3556   bool is_content_initiated = static_cast<DocumentState*>(info.extraData)->
3557           navigation_state()->is_content_initiated();
3558
3559   // Experimental:
3560   // If --enable-strict-site-isolation is enabled, send all top-level
3561   // navigations to the browser to let it swap processes when crossing site
3562   // boundaries.  This is currently expected to break some script calls and
3563   // navigations, such as form submissions.
3564   bool force_swap_due_to_flag =
3565       command_line.HasSwitch(switches::kEnableStrictSiteIsolation);
3566   if (force_swap_due_to_flag &&
3567       !info.frame->parent() && (is_content_initiated || info.isRedirect)) {
3568     WebString origin_str = info.frame->document().securityOrigin().toString();
3569     GURL frame_url(origin_str.utf8().data());
3570     // TODO(cevans): revisit whether this site check is still necessary once
3571     // crbug.com/101395 is fixed.
3572     bool same_domain_or_host =
3573         net::registry_controlled_domains::SameDomainOrHost(
3574             frame_url,
3575             url,
3576             net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
3577     // Only keep same-site (domain + scheme) and data URLs in the same process.
3578     bool is_same_site =
3579         (same_domain_or_host && frame_url.scheme() == url.scheme()) ||
3580         url.SchemeIs(url::kDataScheme);
3581     if (!is_same_site) {
3582       OpenURL(info.frame, url, referrer, info.defaultPolicy);
3583       return blink::WebNavigationPolicyIgnore;
3584     }
3585   }
3586
3587   // If the browser is interested, then give it a chance to look at the request.
3588   if (is_content_initiated) {
3589     bool is_form_post =
3590         ((info.navigationType == blink::WebNavigationTypeFormSubmitted) ||
3591             (info.navigationType == blink::WebNavigationTypeFormResubmitted)) &&
3592         EqualsASCII(info.urlRequest.httpMethod(), "POST");
3593     bool browser_handles_request =
3594         render_view_->renderer_preferences_
3595             .browser_handles_non_local_top_level_requests
3596         && IsNonLocalTopLevelNavigation(url, info.frame, info.navigationType,
3597                                         is_form_post);
3598     if (!browser_handles_request) {
3599       browser_handles_request = IsTopLevelNavigation(info.frame) &&
3600           render_view_->renderer_preferences_
3601               .browser_handles_all_top_level_requests;
3602     }
3603
3604     if (browser_handles_request) {
3605       OpenURL(info.frame, url, referrer, info.defaultPolicy);
3606       return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
3607     }
3608   }
3609
3610   // Use the frame's original request's URL rather than the document's URL for
3611   // subsequent checks.  For a popup, the document's URL may become the opener
3612   // window's URL if the opener has called document.write().
3613   // See http://crbug.com/93517.
3614   GURL old_url(info.frame->dataSource()->request().url());
3615
3616   // Detect when we're crossing a permission-based boundary (e.g. into or out of
3617   // an extension or app origin, leaving a WebUI page, etc). We only care about
3618   // top-level navigations (not iframes). But we sometimes navigate to
3619   // about:blank to clear a tab, and we want to still allow that.
3620   //
3621   // Note: this is known to break POST submissions when crossing process
3622   // boundaries until http://crbug.com/101395 is fixed.  This is better for
3623   // security than loading a WebUI, extension or app page in the wrong process.
3624   // POST requests don't work because this mechanism does not preserve form
3625   // POST data. We will need to send the request's httpBody data up to the
3626   // browser process, and issue a special POST navigation in WebKit (via
3627   // FrameLoader::loadFrameRequest). See ResourceDispatcher and WebURLLoaderImpl
3628   // for examples of how to send the httpBody data.
3629   if (!info.frame->parent() && is_content_initiated &&
3630       !url.SchemeIs(url::kAboutScheme)) {
3631     bool send_referrer = false;
3632
3633     // All navigations to or from WebUI URLs or within WebUI-enabled
3634     // RenderProcesses must be handled by the browser process so that the
3635     // correct bindings and data sources can be registered.
3636     // Similarly, navigations to view-source URLs or within ViewSource mode
3637     // must be handled by the browser process (except for reloads - those are
3638     // safe to leave within the renderer).
3639     // Lastly, access to file:// URLs from non-file:// URL pages must be
3640     // handled by the browser so that ordinary renderer processes don't get
3641     // blessed with file permissions.
3642     int cumulative_bindings = RenderProcess::current()->GetEnabledBindings();
3643     bool is_initial_navigation = render_view_->page_id_ == -1;
3644     bool should_fork = HasWebUIScheme(url) || HasWebUIScheme(old_url) ||
3645         (cumulative_bindings & BINDINGS_POLICY_WEB_UI) ||
3646         url.SchemeIs(kViewSourceScheme) ||
3647         (info.frame->isViewSourceModeEnabled() &&
3648             info.navigationType != blink::WebNavigationTypeReload);
3649
3650     if (!should_fork && url.SchemeIs(url::kFileScheme)) {
3651       // Fork non-file to file opens.  Check the opener URL if this is the
3652       // initial navigation in a newly opened window.
3653       GURL source_url(old_url);
3654       if (is_initial_navigation && source_url.is_empty() &&
3655           info.frame->opener())
3656         source_url = info.frame->opener()->top()->document().url();
3657       DCHECK(!source_url.is_empty());
3658       should_fork = !source_url.SchemeIs(url::kFileScheme);
3659     }
3660
3661     if (!should_fork) {
3662       // Give the embedder a chance.
3663       should_fork = GetContentClient()->renderer()->ShouldFork(
3664           info.frame, url, info.urlRequest.httpMethod().utf8(),
3665           is_initial_navigation, info.isRedirect, &send_referrer);
3666     }
3667
3668     if (should_fork) {
3669       OpenURL(info.frame, url, send_referrer ? referrer : Referrer(),
3670               info.defaultPolicy);
3671       return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
3672     }
3673   }
3674
3675   // Detect when a page is "forking" a new tab that can be safely rendered in
3676   // its own process.  This is done by sites like Gmail that try to open links
3677   // in new windows without script connections back to the original page.  We
3678   // treat such cases as browser navigations (in which we will create a new
3679   // renderer for a cross-site navigation), rather than WebKit navigations.
3680   //
3681   // We use the following heuristic to decide whether to fork a new page in its
3682   // own process:
3683   // The parent page must open a new tab to about:blank, set the new tab's
3684   // window.opener to null, and then redirect the tab to a cross-site URL using
3685   // JavaScript.
3686   //
3687   // TODO(creis): Deprecate this logic once we can rely on rel=noreferrer
3688   // (see below).
3689   bool is_fork =
3690       // Must start from a tab showing about:blank, which is later redirected.
3691       old_url == GURL(url::kAboutBlankURL) &&
3692       // Must be the first real navigation of the tab.
3693       render_view_->historyBackListCount() < 1 &&
3694       render_view_->historyForwardListCount() < 1 &&
3695       // The parent page must have set the child's window.opener to null before
3696       // redirecting to the desired URL.
3697       info.frame->opener() == NULL &&
3698       // Must be a top-level frame.
3699       info.frame->parent() == NULL &&
3700       // Must not have issued the request from this page.
3701       is_content_initiated &&
3702       // Must be targeted at the current tab.
3703       info.defaultPolicy == blink::WebNavigationPolicyCurrentTab &&
3704       // Must be a JavaScript navigation, which appears as "other".
3705       info.navigationType == blink::WebNavigationTypeOther;
3706
3707   if (is_fork) {
3708     // Open the URL via the browser, not via WebKit.
3709     OpenURL(info.frame, url, Referrer(), info.defaultPolicy);
3710     return blink::WebNavigationPolicyIgnore;
3711   }
3712
3713   return info.defaultPolicy;
3714 }
3715
3716 void RenderFrameImpl::OpenURL(WebFrame* frame,
3717                               const GURL& url,
3718                               const Referrer& referrer,
3719                               WebNavigationPolicy policy) {
3720   DCHECK_EQ(frame_, frame);
3721
3722   FrameHostMsg_OpenURL_Params params;
3723   params.url = url;
3724   params.referrer = referrer;
3725   params.disposition = RenderViewImpl::NavigationPolicyToDisposition(policy);
3726   WebDataSource* ds = frame->provisionalDataSource();
3727   if (ds) {
3728     DocumentState* document_state = DocumentState::FromDataSource(ds);
3729     NavigationState* navigation_state = document_state->navigation_state();
3730     if (navigation_state->is_content_initiated()) {
3731       params.should_replace_current_entry = ds->replacesCurrentHistoryItem();
3732     } else {
3733       // This is necessary to preserve the should_replace_current_entry value on
3734       // cross-process redirects, in the event it was set by a previous process.
3735       //
3736       // TODO(davidben): Avoid this awkward duplication of state. See comment on
3737       // NavigationState::should_replace_current_entry().
3738       params.should_replace_current_entry =
3739           navigation_state->should_replace_current_entry();
3740     }
3741   } else {
3742     params.should_replace_current_entry = false;
3743   }
3744   params.user_gesture = WebUserGestureIndicator::isProcessingUserGesture();
3745   if (GetContentClient()->renderer()->AllowPopup())
3746     params.user_gesture = true;
3747
3748   if (policy == blink::WebNavigationPolicyNewBackgroundTab ||
3749       policy == blink::WebNavigationPolicyNewForegroundTab ||
3750       policy == blink::WebNavigationPolicyNewWindow ||
3751       policy == blink::WebNavigationPolicyNewPopup) {
3752     WebUserGestureIndicator::consumeUserGesture();
3753   }
3754
3755   Send(new FrameHostMsg_OpenURL(routing_id_, params));
3756 }
3757
3758 void RenderFrameImpl::UpdateEncoding(WebFrame* frame,
3759                                      const std::string& encoding_name) {
3760   // Only update main frame's encoding_name.
3761   if (!frame->parent())
3762     Send(new FrameHostMsg_UpdateEncoding(routing_id_, encoding_name));
3763 }
3764
3765 void RenderFrameImpl::SyncSelectionIfRequired() {
3766   base::string16 text;
3767   size_t offset;
3768   gfx::Range range;
3769 #if defined(ENABLE_PLUGINS)
3770   if (render_view_->focused_pepper_plugin_) {
3771     render_view_->focused_pepper_plugin_->GetSurroundingText(&text, &range);
3772     offset = 0;  // Pepper API does not support offset reporting.
3773     // TODO(kinaba): cut as needed.
3774   } else
3775 #endif
3776   {
3777     size_t location, length;
3778     if (!GetRenderWidget()->webwidget()->caretOrSelectionRange(
3779             &location, &length)) {
3780       return;
3781     }
3782
3783     range = gfx::Range(location, location + length);
3784
3785     if (GetRenderWidget()->webwidget()->textInputInfo().type !=
3786             blink::WebTextInputTypeNone) {
3787       // If current focused element is editable, we will send 100 more chars
3788       // before and after selection. It is for input method surrounding text
3789       // feature.
3790       if (location > kExtraCharsBeforeAndAfterSelection)
3791         offset = location - kExtraCharsBeforeAndAfterSelection;
3792       else
3793         offset = 0;
3794       length = location + length - offset + kExtraCharsBeforeAndAfterSelection;
3795       WebRange webrange = WebRange::fromDocumentRange(frame_, offset, length);
3796       if (!webrange.isNull())
3797         text = WebRange::fromDocumentRange(
3798             frame_, offset, length).toPlainText();
3799     } else {
3800       offset = location;
3801       text = frame_->selectionAsText();
3802       // http://crbug.com/101435
3803       // In some case, frame->selectionAsText() returned text's length is not
3804       // equal to the length returned from webwidget()->caretOrSelectionRange().
3805       // So we have to set the range according to text.length().
3806       range.set_end(range.start() + text.length());
3807     }
3808   }
3809
3810   // Sometimes we get repeated didChangeSelection calls from webkit when
3811   // the selection hasn't actually changed. We don't want to report these
3812   // because it will cause us to continually claim the X clipboard.
3813   if (selection_text_offset_ != offset ||
3814       selection_range_ != range ||
3815       selection_text_ != text) {
3816     selection_text_ = text;
3817     selection_text_offset_ = offset;
3818     selection_range_ = range;
3819     SetSelectedText(text, offset, range);
3820   }
3821   GetRenderWidget()->UpdateSelectionBounds();
3822 }
3823
3824 void RenderFrameImpl::InitializeUserMediaClient() {
3825   if (!RenderThreadImpl::current())  // Will be NULL during unit tests.
3826     return;
3827
3828 #if defined(OS_ANDROID)
3829   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kDisableWebRTC))
3830     return;
3831 #endif
3832
3833 #if defined(ENABLE_WEBRTC)
3834   DCHECK(!web_user_media_client_);
3835   web_user_media_client_ = new UserMediaClientImpl(
3836       this,
3837       RenderThreadImpl::current()->GetPeerConnectionDependencyFactory(),
3838       make_scoped_ptr(new MediaStreamDispatcher(this)).Pass());
3839 #endif
3840 }
3841
3842 WebMediaPlayer* RenderFrameImpl::CreateWebMediaPlayerForMediaStream(
3843     const blink::WebURL& url,
3844     WebMediaPlayerClient* client) {
3845 #if defined(ENABLE_WEBRTC)
3846 #if defined(OS_ANDROID) && defined(ARCH_CPU_ARMEL)
3847   bool found_neon =
3848       (android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_NEON) != 0;
3849   UMA_HISTOGRAM_BOOLEAN("Platform.WebRtcNEONFound", found_neon);
3850 #endif  // defined(OS_ANDROID) && defined(ARCH_CPU_ARMEL)
3851   return new WebMediaPlayerMS(frame_, client, weak_factory_.GetWeakPtr(),
3852                               new RenderMediaLog(),
3853                               CreateRendererFactory());
3854 #else
3855   return NULL;
3856 #endif  // defined(ENABLE_WEBRTC)
3857 }
3858
3859 scoped_ptr<MediaStreamRendererFactory>
3860 RenderFrameImpl::CreateRendererFactory() {
3861 #if defined(ENABLE_WEBRTC)
3862   return scoped_ptr<MediaStreamRendererFactory>(
3863       new MediaStreamRendererFactory());
3864 #else
3865   return scoped_ptr<MediaStreamRendererFactory>(
3866       static_cast<MediaStreamRendererFactory*>(NULL));
3867 #endif
3868 }
3869
3870 bool RenderFrameImpl::PrepareRenderViewForNavigation(
3871     const GURL& url,
3872     FrameMsg_Navigate_Type::Value navigate_type,
3873     const PageState& state,
3874     bool check_history,
3875     int pending_history_list_offset,
3876     int32 page_id,
3877     bool* is_reload,
3878     WebURLRequest::CachePolicy* cache_policy) {
3879   MaybeHandleDebugURL(url);
3880   if (!render_view_->webview())
3881     return false;
3882
3883   FOR_EACH_OBSERVER(
3884       RenderViewObserver, render_view_->observers_, Navigate(url));
3885
3886   // If this is a stale back/forward (due to a recent navigation the browser
3887   // didn't know about), ignore it.
3888   if (check_history && render_view_->IsBackForwardToStaleEntry(
3889       state, pending_history_list_offset, page_id, *is_reload))
3890     return false;
3891
3892   if (!render_view_->is_swapped_out_ ||
3893       GetWebFrame() != render_view_->webview()->mainFrame())
3894     return true;
3895
3896   // This is a swapped out main frame, so swap the renderer back in.
3897   // We marked the view as hidden when swapping the view out, so be sure to
3898   // reset the visibility state before navigating to the new URL.
3899   render_view_->webview()->setVisibilityState(
3900       render_view_->visibilityState(), false);
3901
3902   // If this is an attempt to reload while we are swapped out, we should not
3903   // reload swappedout://, but the previous page, which is stored in
3904   // params.state.  Setting is_reload to false will treat this like a back
3905   // navigation to accomplish that.
3906   *is_reload = false;
3907   *cache_policy = WebURLRequest::ReloadIgnoringCacheData;
3908
3909   // We refresh timezone when a view is swapped in since timezone
3910   // can get out of sync when the system timezone is updated while
3911   // the view is swapped out.
3912   RenderThreadImpl::NotifyTimezoneChange();
3913
3914   render_view_->SetSwappedOut(false);
3915   is_swapped_out_ = false;
3916   return true;
3917 }
3918
3919 GURL RenderFrameImpl::GetLoadingUrl() const {
3920   WebDataSource* ds = frame_->dataSource();
3921   if (ds->hasUnreachableURL())
3922     return ds->unreachableURL();
3923
3924   const WebURLRequest& request = ds->request();
3925   return request.url();
3926 }
3927
3928 #if defined(OS_ANDROID)
3929
3930 WebMediaPlayer* RenderFrameImpl::CreateAndroidWebMediaPlayer(
3931     const blink::WebURL& url,
3932     WebMediaPlayerClient* client,
3933     blink::WebContentDecryptionModule* initial_cdm) {
3934   GpuChannelHost* gpu_channel_host =
3935       RenderThreadImpl::current()->EstablishGpuChannelSync(
3936           CAUSE_FOR_GPU_LAUNCH_VIDEODECODEACCELERATOR_INITIALIZE);
3937   if (!gpu_channel_host) {
3938     LOG(ERROR) << "Failed to establish GPU channel for media player";
3939     return NULL;
3940   }
3941
3942   scoped_refptr<StreamTextureFactory> stream_texture_factory;
3943   if (SynchronousCompositorFactory* factory =
3944           SynchronousCompositorFactory::GetInstance()) {
3945     stream_texture_factory = factory->CreateStreamTextureFactory(routing_id_);
3946   } else {
3947     scoped_refptr<webkit::gpu::ContextProviderWebContext> context_provider =
3948         RenderThreadImpl::current()->SharedMainThreadContextProvider();
3949
3950     if (!context_provider.get()) {
3951       LOG(ERROR) << "Failed to get context3d for media player";
3952       return NULL;
3953     }
3954
3955     stream_texture_factory = StreamTextureFactoryImpl::Create(
3956         context_provider, gpu_channel_host, routing_id_);
3957   }
3958
3959   return new WebMediaPlayerAndroid(
3960       frame_,
3961       client,
3962       weak_factory_.GetWeakPtr(),
3963       GetMediaPlayerManager(),
3964       GetCdmManager(),
3965       initial_cdm,
3966       stream_texture_factory,
3967       RenderThreadImpl::current()->GetMediaThreadTaskRunner(),
3968       new RenderMediaLog());
3969 }
3970
3971 RendererMediaPlayerManager* RenderFrameImpl::GetMediaPlayerManager() {
3972   if (!media_player_manager_)
3973     media_player_manager_ = new RendererMediaPlayerManager(this);
3974   return media_player_manager_;
3975 }
3976
3977 #endif  // defined(OS_ANDROID)
3978
3979 #if defined(ENABLE_BROWSER_CDMS)
3980 RendererCdmManager* RenderFrameImpl::GetCdmManager() {
3981   if (!cdm_manager_)
3982     cdm_manager_ = new RendererCdmManager(this);
3983   return cdm_manager_;
3984 }
3985 #endif  // defined(ENABLE_BROWSER_CDMS)
3986
3987 }  // namespace content