content/browser/renderer_host/render_view_host_impl.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/renderer_host/render_view_host_impl.h"
   6
   7 #include <set>
   8 #include <string>
   9 #include <utility>
  10 #include <vector>
  11
  12 #include "base/callback.h"
  13 #include "base/command_line.h"
  14 #include "base/debug/trace_event.h"
  15 #include "base/i18n/rtl.h"
  16 #include "base/json/json_reader.h"
  17 #include "base/message_loop/message_loop.h"
  18 #include "base/metrics/histogram.h"
  19 #include "base/stl_util.h"
  20 #include "base/strings/string_util.h"
  21 #include "base/strings/utf_string_conversions.h"
  22 #include "base/sys_info.h"
  23 #include "base/time/time.h"
  24 #include "base/values.h"
  25 #include "cc/base/switches.h"
  26 #include "content/browser/accessibility/browser_accessibility_manager.h"
  27 #include "content/browser/child_process_security_policy_impl.h"
  28 #include "content/browser/cross_site_request_manager.h"
  29 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
  30 #include "content/browser/frame_host/frame_tree.h"
  31 #include "content/browser/gpu/compositor_util.h"
  32 #include "content/browser/gpu/gpu_data_manager_impl.h"
  33 #include "content/browser/gpu/gpu_process_host.h"
  34 #include "content/browser/gpu/gpu_surface_tracker.h"
  35 #include "content/browser/host_zoom_map_impl.h"
  36 #include "content/browser/loader/resource_dispatcher_host_impl.h"
  37 #include "content/browser/renderer_host/dip_util.h"
  38 #include "content/browser/renderer_host/input/timeout_monitor.h"
  39 #include "content/browser/renderer_host/media/audio_renderer_host.h"
  40 #include "content/browser/renderer_host/render_process_host_impl.h"
  41 #include "content/browser/renderer_host/render_view_host_delegate.h"
  42 #include "content/common/accessibility_messages.h"
  43 #include "content/common/browser_plugin/browser_plugin_messages.h"
  44 #include "content/common/content_switches_internal.h"
  45 #include "content/common/desktop_notification_messages.h"
  46 #include "content/common/drag_messages.h"
  47 #include "content/common/frame_messages.h"
  48 #include "content/common/input_messages.h"
  49 #include "content/common/inter_process_time_ticks_converter.h"
  50 #include "content/common/speech_recognition_messages.h"
  51 #include "content/common/swapped_out_messages.h"
  52 #include "content/common/view_messages.h"
  53 #include "content/port/browser/render_view_host_delegate_view.h"
  54 #include "content/port/browser/render_widget_host_view_port.h"
  55 #include "content/public/browser/browser_accessibility_state.h"
  56 #include "content/public/browser/browser_context.h"
  57 #include "content/public/browser/browser_message_filter.h"
  58 #include "content/public/browser/content_browser_client.h"
  59 #include "content/public/browser/native_web_keyboard_event.h"
  60 #include "content/public/browser/notification_details.h"
  61 #include "content/public/browser/notification_service.h"
  62 #include "content/public/browser/notification_types.h"
  63 #include "content/public/browser/render_frame_host.h"
  64 #include "content/public/browser/render_widget_host_iterator.h"
  65 #include "content/public/browser/user_metrics.h"
  66 #include "content/public/common/bindings_policy.h"
  67 #include "content/public/common/content_constants.h"
  68 #include "content/public/common/content_switches.h"
  69 #include "content/public/common/context_menu_params.h"
  70 #include "content/public/common/drop_data.h"
  71 #include "content/public/common/result_codes.h"
  72 #include "content/public/common/url_constants.h"
  73 #include "content/public/common/url_utils.h"
  74 #include "net/base/net_util.h"
  75 #include "net/base/network_change_notifier.h"
  76 #include "net/url_request/url_request_context_getter.h"
  77 #include "third_party/skia/include/core/SkBitmap.h"
  78 #include "ui/accessibility/ax_tree.h"
  79 #include "ui/base/touch/touch_device.h"
  80 #include "ui/base/touch/touch_enabled.h"
  81 #include "ui/base/ui_base_switches.h"
  82 #include "ui/gfx/image/image_skia.h"
  83 #include "ui/gfx/native_widget_types.h"
  84 #include "ui/shell_dialogs/selected_file_info.h"
  85 #include "webkit/browser/fileapi/isolated_context.h"
  86
  87 #if defined(OS_MACOSX)
  88 #include "content/browser/renderer_host/popup_menu_helper_mac.h"
  89 #elif defined(OS_ANDROID)
  90 #include "content/browser/media/android/browser_media_player_manager.h"
  91 #elif defined(OS_WIN)
  92 #include "base/win/win_util.h"
  93 #endif
  94
  95 using base::TimeDelta;
  96 using blink::WebConsoleMessage;
  97 using blink::WebDragOperation;
  98 using blink::WebDragOperationNone;
  99 using blink::WebDragOperationsMask;
 100 using blink::WebInputEvent;
 101 using blink::WebMediaPlayerAction;
 102 using blink::WebPluginAction;
 103
 104 namespace content {
 105 namespace {
 106
 107 // Delay to wait on closing the WebContents for a beforeunload/unload handler to
 108 // fire.
 109 const int kUnloadTimeoutMS = 1000;
 110
 111 // Translate a WebKit text direction into a base::i18n one.
 112 base::i18n::TextDirection WebTextDirectionToChromeTextDirection(
 113     blink::WebTextDirection dir) {
 114   switch (dir) {
 115     case blink::WebTextDirectionLeftToRight:
 116       return base::i18n::LEFT_TO_RIGHT;
 117     case blink::WebTextDirectionRightToLeft:
 118       return base::i18n::RIGHT_TO_LEFT;
 119     default:
 120       NOTREACHED();
 121       return base::i18n::UNKNOWN_DIRECTION;
 122   }
 123 }
 124
 125 #if defined(OS_WIN)
 126
 127 const int kVirtualKeyboardDisplayWaitTimeoutMs = 100;
 128 const int kMaxVirtualKeyboardDisplayRetries = 5;
 129
 130 void DismissVirtualKeyboardTask() {
 131   static int virtual_keyboard_display_retries = 0;
 132   // If the virtual keyboard is not yet visible, then we execute the task again
 133   // waiting for it to show up.
 134   if (!base::win::DismissVirtualKeyboard()) {
 135     if (virtual_keyboard_display_retries < kMaxVirtualKeyboardDisplayRetries) {
 136       BrowserThread::PostDelayedTask(
 137           BrowserThread::UI, FROM_HERE,
 138           base::Bind(base::IgnoreResult(&DismissVirtualKeyboardTask)),
 139           TimeDelta::FromMilliseconds(kVirtualKeyboardDisplayWaitTimeoutMs));
 140       ++virtual_keyboard_display_retries;
 141     } else {
 142       virtual_keyboard_display_retries = 0;
 143     }
 144   }
 145 }
 146 #endif
 147
 148 }  // namespace
 149
 150 ///////////////////////////////////////////////////////////////////////////////
 151 // RenderViewHost, public:
 152
 153 // static
 154 bool RenderViewHostImpl::IsRVHStateActive(RenderViewHostImplState rvh_state) {
 155   if (rvh_state == STATE_DEFAULT ||
 156       rvh_state == STATE_WAITING_FOR_UNLOAD_ACK ||
 157       rvh_state == STATE_WAITING_FOR_COMMIT ||
 158       rvh_state == STATE_WAITING_FOR_CLOSE)
 159     return true;
 160   return false;
 161 }
 162
 163 // static
 164 RenderViewHost* RenderViewHost::FromID(int render_process_id,
 165                                        int render_view_id) {
 166   return RenderViewHostImpl::FromID(render_process_id, render_view_id);
 167 }
 168
 169 // static
 170 RenderViewHost* RenderViewHost::From(RenderWidgetHost* rwh) {
 171   DCHECK(rwh->IsRenderView());
 172   return static_cast<RenderViewHostImpl*>(RenderWidgetHostImpl::From(rwh));
 173 }
 174
 175 ///////////////////////////////////////////////////////////////////////////////
 176 // RenderViewHostImpl, public:
 177
 178 // static
 179 RenderViewHostImpl* RenderViewHostImpl::FromID(int render_process_id,
 180                                                int render_view_id) {
 181   RenderWidgetHost* widget =
 182       RenderWidgetHost::FromID(render_process_id, render_view_id);
 183   if (!widget || !widget->IsRenderView())
 184     return NULL;
 185   return static_cast<RenderViewHostImpl*>(RenderWidgetHostImpl::From(widget));
 186 }
 187
 188 RenderViewHostImpl::RenderViewHostImpl(
 189     SiteInstance* instance,
 190     RenderViewHostDelegate* delegate,
 191     RenderWidgetHostDelegate* widget_delegate,
 192     int routing_id,
 193     int main_frame_routing_id,
 194     bool swapped_out,
 195     bool hidden)
 196     : RenderWidgetHostImpl(widget_delegate,
 197                            instance->GetProcess(),
 198                            routing_id,
 199                            hidden),
 200       frames_ref_count_(0),
 201       delegate_(delegate),
 202       instance_(static_cast<SiteInstanceImpl*>(instance)),
 203       waiting_for_drag_context_response_(false),
 204       enabled_bindings_(0),
 205       navigations_suspended_(false),
 206       has_accessed_initial_document_(false),
 207       main_frame_routing_id_(main_frame_routing_id),
 208       is_waiting_for_beforeunload_ack_(false),
 209       unload_ack_is_for_cross_site_transition_(false),
 210       are_javascript_messages_suppressed_(false),
 211       sudden_termination_allowed_(false),
 212       render_view_termination_status_(base::TERMINATION_STATUS_STILL_RUNNING),
 213       virtual_keyboard_requested_(false),
 214       weak_factory_(this) {
 215   DCHECK(instance_.get());
 216   CHECK(delegate_);  // http://crbug.com/82827
 217
 218   GetProcess()->EnableSendQueue();
 219
 220   if (swapped_out) {
 221     rvh_state_ = STATE_SWAPPED_OUT;
 222   } else {
 223     rvh_state_ = STATE_DEFAULT;
 224     instance_->increment_active_view_count();
 225   }
 226
 227   if (ResourceDispatcherHostImpl::Get()) {
 228     BrowserThread::PostTask(
 229         BrowserThread::IO, FROM_HERE,
 230         base::Bind(&ResourceDispatcherHostImpl::OnRenderViewHostCreated,
 231                    base::Unretained(ResourceDispatcherHostImpl::Get()),
 232                    GetProcess()->GetID(), GetRoutingID()));
 233   }
 234
 235 #if defined(OS_ANDROID)
 236   media_player_manager_.reset(BrowserMediaPlayerManager::Create(this));
 237 #endif
 238
 239   unload_event_monitor_timeout_.reset(new TimeoutMonitor(base::Bind(
 240       &RenderViewHostImpl::OnSwappedOut, weak_factory_.GetWeakPtr(), true)));
 241 }
 242
 243 RenderViewHostImpl::~RenderViewHostImpl() {
 244   if (ResourceDispatcherHostImpl::Get()) {
 245     BrowserThread::PostTask(
 246         BrowserThread::IO, FROM_HERE,
 247         base::Bind(&ResourceDispatcherHostImpl::OnRenderViewHostDeleted,
 248                    base::Unretained(ResourceDispatcherHostImpl::Get()),
 249                    GetProcess()->GetID(), GetRoutingID()));
 250   }
 251
 252   delegate_->RenderViewDeleted(this);
 253
 254   // Be sure to clean up any leftover state from cross-site requests.
 255   CrossSiteRequestManager::GetInstance()->SetHasPendingCrossSiteRequest(
 256       GetProcess()->GetID(), GetRoutingID(), false);
 257
 258   // If this was swapped out, it already decremented the active view
 259   // count of the SiteInstance it belongs to.
 260   if (IsRVHStateActive(rvh_state_))
 261     instance_->decrement_active_view_count();
 262 }
 263
 264 RenderViewHostDelegate* RenderViewHostImpl::GetDelegate() const {
 265   return delegate_;
 266 }
 267
 268 SiteInstance* RenderViewHostImpl::GetSiteInstance() const {
 269   return instance_.get();
 270 }
 271
 272 bool RenderViewHostImpl::CreateRenderView(
 273     const base::string16& frame_name,
 274     int opener_route_id,
 275     int32 max_page_id) {
 276   TRACE_EVENT0("renderer_host", "RenderViewHostImpl::CreateRenderView");
 277   DCHECK(!IsRenderViewLive()) << "Creating view twice";
 278
 279   // The process may (if we're sharing a process with another host that already
 280   // initialized it) or may not (we have our own process or the old process
 281   // crashed) have been initialized. Calling Init multiple times will be
 282   // ignored, so this is safe.
 283   if (!GetProcess()->Init())
 284     return false;
 285   DCHECK(GetProcess()->HasConnection());
 286   DCHECK(GetProcess()->GetBrowserContext());
 287
 288   renderer_initialized_ = true;
 289
 290   GpuSurfaceTracker::Get()->SetSurfaceHandle(
 291       surface_id(), GetCompositingSurface());
 292
 293   // Ensure the RenderView starts with a next_page_id larger than any existing
 294   // page ID it might be asked to render.
 295   int32 next_page_id = 1;
 296   if (max_page_id > -1)
 297     next_page_id = max_page_id + 1;
 298
 299   ViewMsg_New_Params params;
 300   params.renderer_preferences =
 301       delegate_->GetRendererPrefs(GetProcess()->GetBrowserContext());
 302   params.web_preferences = delegate_->GetWebkitPrefs();
 303   params.view_id = GetRoutingID();
 304   params.main_frame_routing_id = main_frame_routing_id_;
 305   params.surface_id = surface_id();
 306   params.session_storage_namespace_id =
 307       delegate_->GetSessionStorageNamespace(instance_)->id();
 308   params.frame_name = frame_name;
 309   // Ensure the RenderView sets its opener correctly.
 310   params.opener_route_id = opener_route_id;
 311   params.swapped_out = !IsRVHStateActive(rvh_state_);
 312   params.hidden = is_hidden();
 313   params.next_page_id = next_page_id;
 314   GetWebScreenInfo(&params.screen_info);
 315   params.accessibility_mode = accessibility_mode();
 316
 317   Send(new ViewMsg_New(params));
 318
 319   // If it's enabled, tell the renderer to set up the Javascript bindings for
 320   // sending messages back to the browser.
 321   if (GetProcess()->IsGuest())
 322     DCHECK_EQ(0, enabled_bindings_);
 323   Send(new ViewMsg_AllowBindings(GetRoutingID(), enabled_bindings_));
 324   // Let our delegate know that we created a RenderView.
 325   delegate_->RenderViewCreated(this);
 326
 327   return true;
 328 }
 329
 330 bool RenderViewHostImpl::IsRenderViewLive() const {
 331   return GetProcess()->HasConnection() && renderer_initialized_;
 332 }
 333
 334 void RenderViewHostImpl::SyncRendererPrefs() {
 335   Send(new ViewMsg_SetRendererPrefs(GetRoutingID(),
 336                                     delegate_->GetRendererPrefs(
 337                                         GetProcess()->GetBrowserContext())));
 338 }
 339
 340 WebPreferences RenderViewHostImpl::GetWebkitPrefs(const GURL& url) {
 341   TRACE_EVENT0("browser", "RenderViewHostImpl::GetWebkitPrefs");
 342   WebPreferences prefs;
 343
 344   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
 345
 346   prefs.javascript_enabled =
 347       !command_line.HasSwitch(switches::kDisableJavaScript);
 348   prefs.web_security_enabled =
 349       !command_line.HasSwitch(switches::kDisableWebSecurity);
 350   prefs.plugins_enabled =
 351       !command_line.HasSwitch(switches::kDisablePlugins);
 352   prefs.java_enabled =
 353       !command_line.HasSwitch(switches::kDisableJava);
 354
 355   prefs.remote_fonts_enabled =
 356       !command_line.HasSwitch(switches::kDisableRemoteFonts);
 357   prefs.xslt_enabled =
 358       !command_line.HasSwitch(switches::kDisableXSLT);
 359   prefs.xss_auditor_enabled =
 360       !command_line.HasSwitch(switches::kDisableXSSAuditor);
 361   prefs.application_cache_enabled =
 362       !command_line.HasSwitch(switches::kDisableApplicationCache);
 363
 364   prefs.local_storage_enabled =
 365       !command_line.HasSwitch(switches::kDisableLocalStorage);
 366   prefs.databases_enabled =
 367       !command_line.HasSwitch(switches::kDisableDatabases);
 368 #if defined(OS_ANDROID) && defined(ARCH_CPU_X86)
 369   prefs.webaudio_enabled =
 370       command_line.HasSwitch(switches::kEnableWebAudio);
 371 #else
 372   prefs.webaudio_enabled =
 373       !command_line.HasSwitch(switches::kDisableWebAudio);
 374 #endif
 375
 376   prefs.experimental_webgl_enabled =
 377       GpuProcessHost::gpu_enabled() &&
 378       !command_line.HasSwitch(switches::kDisable3DAPIs) &&
 379       !command_line.HasSwitch(switches::kDisableExperimentalWebGL);
 380
 381   prefs.pepper_3d_enabled =
 382       !command_line.HasSwitch(switches::kDisablePepper3d);
 383
 384   prefs.flash_3d_enabled =
 385       GpuProcessHost::gpu_enabled() &&
 386       !command_line.HasSwitch(switches::kDisableFlash3d);
 387   prefs.flash_stage3d_enabled =
 388       GpuProcessHost::gpu_enabled() &&
 389       !command_line.HasSwitch(switches::kDisableFlashStage3d);
 390   prefs.flash_stage3d_baseline_enabled =
 391       GpuProcessHost::gpu_enabled() &&
 392       !command_line.HasSwitch(switches::kDisableFlashStage3d);
 393
 394   prefs.gl_multisampling_enabled =
 395       !command_line.HasSwitch(switches::kDisableGLMultisampling);
 396   prefs.privileged_webgl_extensions_enabled =
 397       command_line.HasSwitch(switches::kEnablePrivilegedWebGLExtensions);
 398   prefs.site_specific_quirks_enabled =
 399       !command_line.HasSwitch(switches::kDisableSiteSpecificQuirks);
 400   prefs.allow_file_access_from_file_urls =
 401       command_line.HasSwitch(switches::kAllowFileAccessFromFiles);
 402
 403   prefs.layer_squashing_enabled = false;
 404   if (command_line.HasSwitch(switches::kEnableLayerSquashing))
 405       prefs.layer_squashing_enabled = true;
 406   if (command_line.HasSwitch(switches::kDisableLayerSquashing))
 407       prefs.layer_squashing_enabled = false;
 408
 409   prefs.show_paint_rects =
 410       command_line.HasSwitch(switches::kShowPaintRects);
 411   prefs.accelerated_compositing_enabled =
 412       GpuProcessHost::gpu_enabled() &&
 413       !command_line.HasSwitch(switches::kDisableAcceleratedCompositing);
 414   prefs.force_compositing_mode =
 415       content::IsForceCompositingModeEnabled() &&
 416       !command_line.HasSwitch(switches::kDisableForceCompositingMode);
 417   prefs.accelerated_2d_canvas_enabled =
 418       GpuProcessHost::gpu_enabled() &&
 419       !command_line.HasSwitch(switches::kDisableAccelerated2dCanvas);
 420   prefs.antialiased_2d_canvas_disabled =
 421       command_line.HasSwitch(switches::kDisable2dCanvasAntialiasing);
 422   prefs.accelerated_2d_canvas_msaa_sample_count =
 423       atoi(command_line.GetSwitchValueASCII(
 424       switches::kAcceleratedCanvas2dMSAASampleCount).c_str());
 425   prefs.accelerated_filters_enabled =
 426       GpuProcessHost::gpu_enabled() &&
 427       command_line.HasSwitch(switches::kEnableAcceleratedFilters);
 428   prefs.deferred_filters_enabled =
 429       command_line.HasSwitch(switches::kEnableDeferredFilters);
 430   prefs.accelerated_compositing_for_3d_transforms_enabled =
 431       prefs.accelerated_compositing_for_animation_enabled =
 432           !command_line.HasSwitch(switches::kDisableAcceleratedLayers);
 433   prefs.accelerated_compositing_for_plugins_enabled =
 434       !command_line.HasSwitch(switches::kDisableAcceleratedPlugins);
 435   prefs.accelerated_compositing_for_video_enabled =
 436       !command_line.HasSwitch(switches::kDisableAcceleratedVideo);
 437   prefs.lazy_layout_enabled =
 438       command_line.HasSwitch(switches::kEnableExperimentalWebPlatformFeatures);
 439   prefs.region_based_columns_enabled =
 440       command_line.HasSwitch(switches::kEnableRegionBasedColumns);
 441   prefs.threaded_html_parser =
 442       !command_line.HasSwitch(switches::kDisableThreadedHTMLParser);
 443   prefs.experimental_websocket_enabled =
 444       command_line.HasSwitch(switches::kEnableExperimentalWebSocket);
 445   if (command_line.HasSwitch(cc::switches::kEnablePinchVirtualViewport)) {
 446     prefs.pinch_virtual_viewport_enabled = true;
 447     prefs.pinch_overlay_scrollbar_thickness = 10;
 448   }
 449   prefs.use_solid_color_scrollbars = IsOverlayScrollbarEnabled();
 450
 451 #if defined(OS_ANDROID)
 452   prefs.user_gesture_required_for_media_playback = !command_line.HasSwitch(
 453       switches::kDisableGestureRequirementForMediaPlayback);
 454   prefs.user_gesture_required_for_media_fullscreen = !command_line.HasSwitch(
 455       switches::kDisableGestureRequirementForMediaFullscreen);
 456 #endif
 457
 458   prefs.touch_enabled = ui::AreTouchEventsEnabled();
 459   prefs.device_supports_touch = prefs.touch_enabled &&
 460       ui::IsTouchDevicePresent();
 461 #if defined(OS_ANDROID)
 462   prefs.device_supports_mouse = false;
 463 #endif
 464
 465   prefs.pointer_events_max_touch_points = ui::MaxTouchPoints();
 466
 467   prefs.touch_adjustment_enabled =
 468       !command_line.HasSwitch(switches::kDisableTouchAdjustment);
 469   prefs.compositor_touch_hit_testing =
 470       !command_line.HasSwitch(cc::switches::kDisableCompositorTouchHitTesting);
 471
 472 #if defined(OS_MACOSX) || defined(OS_CHROMEOS)
 473   bool default_enable_scroll_animator = true;
 474 #else
 475   bool default_enable_scroll_animator = false;
 476 #endif
 477   prefs.enable_scroll_animator = default_enable_scroll_animator;
 478   if (command_line.HasSwitch(switches::kEnableSmoothScrolling))
 479     prefs.enable_scroll_animator = true;
 480   if (command_line.HasSwitch(switches::kDisableSmoothScrolling))
 481     prefs.enable_scroll_animator = false;
 482
 483   prefs.visual_word_movement_enabled =
 484       command_line.HasSwitch(switches::kEnableVisualWordMovement);
 485
 486   // Certain GPU features might have been blacklisted.
 487   GpuDataManagerImpl::GetInstance()->UpdateRendererWebPrefs(&prefs);
 488
 489   if (ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
 490           GetProcess()->GetID())) {
 491     prefs.loads_images_automatically = true;
 492     prefs.javascript_enabled = true;
 493   }
 494
 495   prefs.is_online = !net::NetworkChangeNotifier::IsOffline();
 496
 497   prefs.fixed_position_creates_stacking_context = !command_line.HasSwitch(
 498       switches::kDisableFixedPositionCreatesStackingContext);
 499
 500 #if defined(OS_CHROMEOS)
 501   prefs.gesture_tap_highlight_enabled = !command_line.HasSwitch(
 502       switches::kDisableGestureTapHighlight);
 503 #else
 504   prefs.gesture_tap_highlight_enabled = command_line.HasSwitch(
 505       switches::kEnableGestureTapHighlight);
 506 #endif
 507
 508   prefs.number_of_cpu_cores = base::SysInfo::NumberOfProcessors();
 509
 510   prefs.viewport_meta_enabled =
 511       command_line.HasSwitch(switches::kEnableViewportMeta);
 512
 513   prefs.viewport_enabled =
 514       command_line.HasSwitch(switches::kEnableViewport) ||
 515       prefs.viewport_meta_enabled;
 516
 517   prefs.main_frame_resizes_are_orientation_changes =
 518       command_line.HasSwitch(switches::kMainFrameResizesAreOrientationChanges);
 519
 520   prefs.deferred_image_decoding_enabled =
 521       command_line.HasSwitch(switches::kEnableDeferredImageDecoding) ||
 522       cc::switches::IsImplSidePaintingEnabled();
 523
 524   prefs.spatial_navigation_enabled = command_line.HasSwitch(
 525       switches::kEnableSpatialNavigation);
 526
 527   GetContentClient()->browser()->OverrideWebkitPrefs(this, url, &prefs);
 528
 529   // Disable compositing in guests until we have compositing path implemented
 530   // for guests.
 531   bool guest_compositing_enabled = !command_line.HasSwitch(
 532       switches::kDisableBrowserPluginCompositing);
 533   if (GetProcess()->IsGuest() && !guest_compositing_enabled) {
 534     prefs.force_compositing_mode = false;
 535     prefs.accelerated_compositing_enabled = false;
 536   }
 537
 538   return prefs;
 539 }
 540
 541 void RenderViewHostImpl::Navigate(const FrameMsg_Navigate_Params& params) {
 542   TRACE_EVENT0("renderer_host", "RenderViewHostImpl::Navigate");
 543   delegate_->GetFrameTree()->GetMainFrame()->Navigate(params);
 544 }
 545
 546 void RenderViewHostImpl::NavigateToURL(const GURL& url) {
 547   delegate_->GetFrameTree()->GetMainFrame()->NavigateToURL(url);
 548 }
 549
 550 void RenderViewHostImpl::SetNavigationsSuspended(
 551     bool suspend,
 552     const base::TimeTicks& proceed_time) {
 553   // This should only be called to toggle the state.
 554   DCHECK(navigations_suspended_ != suspend);
 555
 556   navigations_suspended_ = suspend;
 557   if (!suspend && suspended_nav_params_) {
 558     // There's navigation message params waiting to be sent.  Now that we're not
 559     // suspended anymore, resume navigation by sending them.  If we were swapped
 560     // out, we should also stop filtering out the IPC messages now.
 561     SetState(STATE_DEFAULT);
 562
 563     DCHECK(!proceed_time.is_null());
 564     suspended_nav_params_->browser_navigation_start = proceed_time;
 565     Send(new FrameMsg_Navigate(
 566         main_frame_routing_id_, *suspended_nav_params_.get()));
 567     suspended_nav_params_.reset();
 568   }
 569 }
 570
 571 void RenderViewHostImpl::CancelSuspendedNavigations() {
 572   // Clear any state if a pending navigation is canceled or pre-empted.
 573   if (suspended_nav_params_)
 574     suspended_nav_params_.reset();
 575   navigations_suspended_ = false;
 576 }
 577
 578 void RenderViewHostImpl::FirePageBeforeUnload(bool for_cross_site_transition) {
 579   if (!IsRenderViewLive()) {
 580     // This RenderViewHostImpl doesn't have a live renderer, so just
 581     // skip running the onbeforeunload handler.
 582     is_waiting_for_beforeunload_ack_ = true;  // Checked by OnShouldCloseACK.
 583     unload_ack_is_for_cross_site_transition_ = for_cross_site_transition;
 584     base::TimeTicks now = base::TimeTicks::Now();
 585     OnShouldCloseACK(true, now, now);
 586     return;
 587   }
 588
 589   // This may be called more than once (if the user clicks the tab close button
 590   // several times, or if she clicks the tab close button then the browser close
 591   // button), and we only send the message once.
 592   if (is_waiting_for_beforeunload_ack_) {
 593     // Some of our close messages could be for the tab, others for cross-site
 594     // transitions. We always want to think it's for closing the tab if any
 595     // of the messages were, since otherwise it might be impossible to close
 596     // (if there was a cross-site "close" request pending when the user clicked
 597     // the close button). We want to keep the "for cross site" flag only if
 598     // both the old and the new ones are also for cross site.
 599     unload_ack_is_for_cross_site_transition_ =
 600         unload_ack_is_for_cross_site_transition_ && for_cross_site_transition;
 601   } else {
 602     // Start the hang monitor in case the renderer hangs in the beforeunload
 603     // handler.
 604     is_waiting_for_beforeunload_ack_ = true;
 605     unload_ack_is_for_cross_site_transition_ = for_cross_site_transition;
 606     // Increment the in-flight event count, to ensure that input events won't
 607     // cancel the timeout timer.
 608     increment_in_flight_event_count();
 609     StartHangMonitorTimeout(TimeDelta::FromMilliseconds(kUnloadTimeoutMS));
 610     send_should_close_start_time_ = base::TimeTicks::Now();
 611     Send(new ViewMsg_ShouldClose(GetRoutingID()));
 612   }
 613 }
 614
 615 void RenderViewHostImpl::SuppressDialogsUntilSwapOut() {
 616   Send(new ViewMsg_SuppressDialogsUntilSwapOut(GetRoutingID()));
 617 }
 618
 619 void RenderViewHostImpl::SwapOut() {
 620   SetState(STATE_WAITING_FOR_UNLOAD_ACK);
 621   unload_event_monitor_timeout_->Start(
 622       base::TimeDelta::FromMilliseconds(kUnloadTimeoutMS));
 623
 624   if (IsRenderViewLive()) {
 625     Send(new ViewMsg_SwapOut(GetRoutingID()));
 626   }
 627   delegate_->SwappedOut(this);
 628 }
 629
 630 void RenderViewHostImpl::OnSwapOutACK() {
 631   OnSwappedOut(false);
 632 }
 633
 634 void RenderViewHostImpl::OnSwappedOut(bool timed_out) {
 635   // Ignore spurious swap out ack.
 636   if (!IsWaitingForUnloadACK())
 637     return;
 638   unload_event_monitor_timeout_->Stop();
 639   if (timed_out) {
 640     base::ProcessHandle process_handle = GetProcess()->GetHandle();
 641     int views = 0;
 642
 643     // Count the number of active widget hosts for the process, which
 644     // is equivalent to views using the process as of this writing.
 645     scoped_ptr<RenderWidgetHostIterator> widgets(
 646       RenderWidgetHost::GetRenderWidgetHosts());
 647     while (RenderWidgetHost* widget = widgets->GetNextHost()) {
 648       if (widget->GetProcess()->GetID() == GetProcess()->GetID())
 649         ++views;
 650     }
 651
 652     if (!RenderProcessHost::run_renderer_in_process() &&
 653         process_handle && views <= 1) {
 654       // The process can safely be terminated, only if WebContents sets
 655       // SuddenTerminationAllowed, which indicates that the timer has expired.
 656       // This is not the case if we load data URLs or about:blank. The reason
 657       // is that those have no network requests and this code is hit without
 658       // setting the unresponsiveness timer. This allows a corner case where a
 659       // navigation to a data URL will leave a process running, if the
 660       // beforeunload handler completes fine, but the unload handler hangs.
 661       // At this time, the complexity to solve this edge case is not worthwhile.
 662       if (SuddenTerminationAllowed()) {
 663         // We should kill the process, but for now, just log the data so we can
 664         // diagnose the kill rate and investigate if separate timer is needed.
 665         // http://crbug.com/104346.
 666
 667         // Log a histogram point to help us diagnose how many of those kills
 668         // we have performed. 1 is the enum value for RendererType Normal for
 669         // the histogram.
 670         UMA_HISTOGRAM_PERCENTAGE(
 671             "BrowserRenderProcessHost.ChildKillsUnresponsive", 1);
 672       }
 673     }
 674   }
 675
 676   switch (rvh_state_) {
 677     case STATE_WAITING_FOR_UNLOAD_ACK:
 678       SetState(STATE_WAITING_FOR_COMMIT);
 679       break;
 680     case STATE_PENDING_SWAP_OUT:
 681       SetState(STATE_SWAPPED_OUT);
 682       break;
 683     case STATE_PENDING_SHUTDOWN:
 684       DCHECK(!pending_shutdown_on_swap_out_.is_null());
 685       pending_shutdown_on_swap_out_.Run();
 686       break;
 687     default:
 688       NOTREACHED();
 689   }
 690 }
 691
 692 void RenderViewHostImpl::WasSwappedOut(
 693     const base::Closure& pending_delete_on_swap_out) {
 694   Send(new ViewMsg_WasSwappedOut(GetRoutingID()));
 695   if (rvh_state_ == STATE_WAITING_FOR_UNLOAD_ACK) {
 696     SetState(STATE_PENDING_SWAP_OUT);
 697     if (!instance_->active_view_count())
 698       SetPendingShutdown(pending_delete_on_swap_out);
 699   } else if (rvh_state_ == STATE_WAITING_FOR_COMMIT) {
 700     SetState(STATE_SWAPPED_OUT);
 701   } else if (rvh_state_ == STATE_DEFAULT) {
 702     // When the RenderView is not live, the RenderFrameHostManager will call
 703     // CommitPending directly, without calling SwapOut on the old RVH. This will
 704     // cause WasSwappedOut to be called directly on the live old RVH.
 705     DCHECK(!IsRenderViewLive());
 706     SetState(STATE_SWAPPED_OUT);
 707   } else {
 708     NOTREACHED();
 709   }
 710 }
 711
 712 void RenderViewHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) {
 713   pending_shutdown_on_swap_out_ = on_swap_out;
 714   SetState(STATE_PENDING_SHUTDOWN);
 715 }
 716
 717 void RenderViewHostImpl::ClosePage() {
 718   SetState(STATE_WAITING_FOR_CLOSE);
 719   StartHangMonitorTimeout(TimeDelta::FromMilliseconds(kUnloadTimeoutMS));
 720
 721   if (IsRenderViewLive()) {
 722     // Since we are sending an IPC message to the renderer, increase the event
 723     // count to prevent the hang monitor timeout from being stopped by input
 724     // event acknowledgements.
 725     increment_in_flight_event_count();
 726
 727     // TODO(creis): Should this be moved to Shutdown?  It may not be called for
 728     // RenderViewHosts that have been swapped out.
 729     NotificationService::current()->Notify(
 730         NOTIFICATION_RENDER_VIEW_HOST_WILL_CLOSE_RENDER_VIEW,
 731         Source<RenderViewHost>(this),
 732         NotificationService::NoDetails());
 733
 734     Send(new ViewMsg_ClosePage(GetRoutingID()));
 735   } else {
 736     // This RenderViewHost doesn't have a live renderer, so just skip the unload
 737     // event and close the page.
 738     ClosePageIgnoringUnloadEvents();
 739   }
 740 }
 741
 742 void RenderViewHostImpl::ClosePageIgnoringUnloadEvents() {
 743   StopHangMonitorTimeout();
 744   is_waiting_for_beforeunload_ack_ = false;
 745
 746   sudden_termination_allowed_ = true;
 747   delegate_->Close(this);
 748 }
 749
 750 bool RenderViewHostImpl::HasPendingCrossSiteRequest() {
 751   return CrossSiteRequestManager::GetInstance()->HasPendingCrossSiteRequest(
 752       GetProcess()->GetID(), GetRoutingID());
 753 }
 754
 755 void RenderViewHostImpl::SetHasPendingCrossSiteRequest(
 756     bool has_pending_request) {
 757   CrossSiteRequestManager::GetInstance()->SetHasPendingCrossSiteRequest(
 758       GetProcess()->GetID(), GetRoutingID(), has_pending_request);
 759 }
 760
 761 #if defined(OS_ANDROID)
 762 void RenderViewHostImpl::ActivateNearestFindResult(int request_id,
 763                                                    float x,
 764                                                    float y) {
 765   Send(new InputMsg_ActivateNearestFindResult(GetRoutingID(),
 766                                               request_id, x, y));
 767 }
 768
 769 void RenderViewHostImpl::RequestFindMatchRects(int current_version) {
 770   Send(new ViewMsg_FindMatchRects(GetRoutingID(), current_version));
 771 }
 772
 773 void RenderViewHostImpl::DisableFullscreenEncryptedMediaPlayback() {
 774   media_player_manager_->DisableFullscreenEncryptedMediaPlayback();
 775 }
 776 #endif
 777
 778 void RenderViewHostImpl::DragTargetDragEnter(
 779     const DropData& drop_data,
 780     const gfx::Point& client_pt,
 781     const gfx::Point& screen_pt,
 782     WebDragOperationsMask operations_allowed,
 783     int key_modifiers) {
 784   const int renderer_id = GetProcess()->GetID();
 785   ChildProcessSecurityPolicyImpl* policy =
 786       ChildProcessSecurityPolicyImpl::GetInstance();
 787
 788   // The URL could have been cobbled together from any highlighted text string,
 789   // and can't be interpreted as a capability.
 790   DropData filtered_data(drop_data);
 791   GetProcess()->FilterURL(true, &filtered_data.url);
 792
 793   // The filenames vector, on the other hand, does represent a capability to
 794   // access the given files.
 795   fileapi::IsolatedContext::FileInfoSet files;
 796   for (std::vector<DropData::FileInfo>::iterator iter(
 797            filtered_data.filenames.begin());
 798        iter != filtered_data.filenames.end(); ++iter) {
 799     // A dragged file may wind up as the value of an input element, or it
 800     // may be used as the target of a navigation instead.  We don't know
 801     // which will happen at this point, so generously grant both access
 802     // and request permissions to the specific file to cover both cases.
 803     // We do not give it the permission to request all file:// URLs.
 804     base::FilePath path =
 805         base::FilePath::FromUTF8Unsafe(base::UTF16ToUTF8(iter->path));
 806
 807     // Make sure we have the same display_name as the one we register.
 808     if (iter->display_name.empty()) {
 809       std::string name;
 810       files.AddPath(path, &name);
 811       iter->display_name = base::UTF8ToUTF16(name);
 812     } else {
 813       files.AddPathWithName(path, base::UTF16ToUTF8(iter->display_name));
 814     }
 815
 816     policy->GrantRequestSpecificFileURL(renderer_id,
 817                                         net::FilePathToFileURL(path));
 818
 819     // If the renderer already has permission to read these paths, we don't need
 820     // to re-grant them. This prevents problems with DnD for files in the CrOS
 821     // file manager--the file manager already had read/write access to those
 822     // directories, but dragging a file would cause the read/write access to be
 823     // overwritten with read-only access, making them impossible to delete or
 824     // rename until the renderer was killed.
 825     if (!policy->CanReadFile(renderer_id, path))
 826       policy->GrantReadFile(renderer_id, path);
 827   }
 828
 829   fileapi::IsolatedContext* isolated_context =
 830       fileapi::IsolatedContext::GetInstance();
 831   DCHECK(isolated_context);
 832   std::string filesystem_id = isolated_context->RegisterDraggedFileSystem(
 833       files);
 834   if (!filesystem_id.empty()) {
 835     // Grant the permission iff the ID is valid.
 836     policy->GrantReadFileSystem(renderer_id, filesystem_id);
 837   }
 838   filtered_data.filesystem_id = base::UTF8ToUTF16(filesystem_id);
 839
 840   Send(new DragMsg_TargetDragEnter(GetRoutingID(), filtered_data, client_pt,
 841                                    screen_pt, operations_allowed,
 842                                    key_modifiers));
 843 }
 844
 845 void RenderViewHostImpl::DragTargetDragOver(
 846     const gfx::Point& client_pt,
 847     const gfx::Point& screen_pt,
 848     WebDragOperationsMask operations_allowed,
 849     int key_modifiers) {
 850   Send(new DragMsg_TargetDragOver(GetRoutingID(), client_pt, screen_pt,
 851                                   operations_allowed, key_modifiers));
 852 }
 853
 854 void RenderViewHostImpl::DragTargetDragLeave() {
 855   Send(new DragMsg_TargetDragLeave(GetRoutingID()));
 856 }
 857
 858 void RenderViewHostImpl::DragTargetDrop(
 859     const gfx::Point& client_pt,
 860     const gfx::Point& screen_pt,
 861     int key_modifiers) {
 862   Send(new DragMsg_TargetDrop(GetRoutingID(), client_pt, screen_pt,
 863                               key_modifiers));
 864 }
 865
 866 void RenderViewHostImpl::DesktopNotificationPermissionRequestDone(
 867     int callback_context) {
 868   Send(new DesktopNotificationMsg_PermissionRequestDone(
 869       GetRoutingID(), callback_context));
 870 }
 871
 872 void RenderViewHostImpl::DesktopNotificationPostDisplay(int callback_context) {
 873   Send(new DesktopNotificationMsg_PostDisplay(GetRoutingID(),
 874                                               callback_context));
 875 }
 876
 877 void RenderViewHostImpl::DesktopNotificationPostError(
 878     int notification_id,
 879     const base::string16& message) {
 880   Send(new DesktopNotificationMsg_PostError(
 881       GetRoutingID(), notification_id, message));
 882 }
 883
 884 void RenderViewHostImpl::DesktopNotificationPostClose(int notification_id,
 885                                                       bool by_user) {
 886   Send(new DesktopNotificationMsg_PostClose(
 887       GetRoutingID(), notification_id, by_user));
 888 }
 889
 890 void RenderViewHostImpl::DesktopNotificationPostClick(int notification_id) {
 891   Send(new DesktopNotificationMsg_PostClick(GetRoutingID(), notification_id));
 892 }
 893
 894 void RenderViewHostImpl::ExecuteJavascriptInWebFrame(
 895     const base::string16& frame_xpath,
 896     const base::string16& jscript) {
 897   Send(new ViewMsg_ScriptEvalRequest(GetRoutingID(), frame_xpath, jscript,
 898                                      0, false));
 899 }
 900
 901 void RenderViewHostImpl::ExecuteJavascriptInWebFrameCallbackResult(
 902      const base::string16& frame_xpath,
 903      const base::string16& jscript,
 904      const JavascriptResultCallback& callback) {
 905   static int next_id = 1;
 906   int key = next_id++;
 907   Send(new ViewMsg_ScriptEvalRequest(GetRoutingID(), frame_xpath, jscript,
 908                                      key, true));
 909   javascript_callbacks_.insert(std::make_pair(key, callback));
 910 }
 911
 912 void RenderViewHostImpl::JavaScriptDialogClosed(
 913     IPC::Message* reply_msg,
 914     bool success,
 915     const base::string16& user_input) {
 916   GetProcess()->SetIgnoreInputEvents(false);
 917   bool is_waiting = is_waiting_for_beforeunload_ack_ || IsWaitingForUnloadACK();
 918
 919   // If we are executing as part of (before)unload event handling, we don't
 920   // want to use the regular hung_renderer_delay_ms_ if the user has agreed to
 921   // leave the current page. In this case, use the regular timeout value used
 922   // during the (before)unload handling.
 923   if (is_waiting) {
 924     StartHangMonitorTimeout(TimeDelta::FromMilliseconds(
 925         success ? kUnloadTimeoutMS : hung_renderer_delay_ms_));
 926   }
 927
 928   ViewHostMsg_RunJavaScriptMessage::WriteReplyParams(reply_msg,
 929                                                      success, user_input);
 930   Send(reply_msg);
 931
 932   // If we are waiting for an unload or beforeunload ack and the user has
 933   // suppressed messages, kill the tab immediately; a page that's spamming
 934   // alerts in onbeforeunload is presumably malicious, so there's no point in
 935   // continuing to run its script and dragging out the process.
 936   // This must be done after sending the reply since RenderView can't close
 937   // correctly while waiting for a response.
 938   if (is_waiting && are_javascript_messages_suppressed_)
 939     delegate_->RendererUnresponsive(
 940         this, is_waiting_for_beforeunload_ack_, IsWaitingForUnloadACK());
 941 }
 942
 943 void RenderViewHostImpl::DragSourceEndedAt(
 944     int client_x, int client_y, int screen_x, int screen_y,
 945     WebDragOperation operation) {
 946   Send(new DragMsg_SourceEndedOrMoved(
 947       GetRoutingID(),
 948       gfx::Point(client_x, client_y),
 949       gfx::Point(screen_x, screen_y),
 950       true, operation));
 951 }
 952
 953 void RenderViewHostImpl::DragSourceMovedTo(
 954     int client_x, int client_y, int screen_x, int screen_y) {
 955   Send(new DragMsg_SourceEndedOrMoved(
 956       GetRoutingID(),
 957       gfx::Point(client_x, client_y),
 958       gfx::Point(screen_x, screen_y),
 959       false, WebDragOperationNone));
 960 }
 961
 962 void RenderViewHostImpl::DragSourceSystemDragEnded() {
 963   Send(new DragMsg_SourceSystemDragEnded(GetRoutingID()));
 964 }
 965
 966 RenderFrameHost* RenderViewHostImpl::GetMainFrame() {
 967   return RenderFrameHost::FromID(GetProcess()->GetID(), main_frame_routing_id_);
 968 }
 969
 970 void RenderViewHostImpl::AllowBindings(int bindings_flags) {
 971   // Never grant any bindings to browser plugin guests.
 972   if (GetProcess()->IsGuest()) {
 973     NOTREACHED() << "Never grant bindings to a guest process.";
 974     return;
 975   }
 976
 977   // Ensure we aren't granting WebUI bindings to a process that has already
 978   // been used for non-privileged views.
 979   if (bindings_flags & BINDINGS_POLICY_WEB_UI &&
 980       GetProcess()->HasConnection() &&
 981       !ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
 982           GetProcess()->GetID())) {
 983     // This process has no bindings yet. Make sure it does not have more
 984     // than this single active view.
 985     RenderProcessHostImpl* process =
 986         static_cast<RenderProcessHostImpl*>(GetProcess());
 987     if (process->GetActiveViewCount() > 1)
 988       return;
 989   }
 990
 991   if (bindings_flags & BINDINGS_POLICY_WEB_UI) {
 992     ChildProcessSecurityPolicyImpl::GetInstance()->GrantWebUIBindings(
 993         GetProcess()->GetID());
 994   }
 995
 996   enabled_bindings_ |= bindings_flags;
 997   if (renderer_initialized_)
 998     Send(new ViewMsg_AllowBindings(GetRoutingID(), enabled_bindings_));
 999 }
1000
1001 int RenderViewHostImpl::GetEnabledBindings() const {
1002   return enabled_bindings_;
1003 }
1004
1005 void RenderViewHostImpl::SetWebUIProperty(const std::string& name,
1006                                           const std::string& value) {
1007   // This is a sanity check before telling the renderer to enable the property.
1008   // It could lie and send the corresponding IPC messages anyway, but we will
1009   // not act on them if enabled_bindings_ doesn't agree. If we get here without
1010   // WebUI bindings, kill the renderer process.
1011   if (enabled_bindings_ & BINDINGS_POLICY_WEB_UI) {
1012     Send(new ViewMsg_SetWebUIProperty(GetRoutingID(), name, value));
1013   } else {
1014     RecordAction(
1015         base::UserMetricsAction("BindingsMismatchTerminate_RVH_WebUI"));
1016     base::KillProcess(
1017         GetProcess()->GetHandle(), content::RESULT_CODE_KILLED, false);
1018   }
1019 }
1020
1021 void RenderViewHostImpl::GotFocus() {
1022   RenderWidgetHostImpl::GotFocus();  // Notifies the renderer it got focus.
1023
1024   RenderViewHostDelegateView* view = delegate_->GetDelegateView();
1025   if (view)
1026     view->GotFocus();
1027 }
1028
1029 void RenderViewHostImpl::LostCapture() {
1030   RenderWidgetHostImpl::LostCapture();
1031   delegate_->LostCapture();
1032 }
1033
1034 void RenderViewHostImpl::LostMouseLock() {
1035   RenderWidgetHostImpl::LostMouseLock();
1036   delegate_->LostMouseLock();
1037 }
1038
1039 void RenderViewHostImpl::SetInitialFocus(bool reverse) {
1040   Send(new ViewMsg_SetInitialFocus(GetRoutingID(), reverse));
1041 }
1042
1043 void RenderViewHostImpl::FilesSelectedInChooser(
1044     const std::vector<ui::SelectedFileInfo>& files,
1045     FileChooserParams::Mode permissions) {
1046   // Grant the security access requested to the given files.
1047   for (size_t i = 0; i < files.size(); ++i) {
1048     const ui::SelectedFileInfo& file = files[i];
1049     if (permissions == FileChooserParams::Save) {
1050       ChildProcessSecurityPolicyImpl::GetInstance()->GrantCreateReadWriteFile(
1051           GetProcess()->GetID(), file.local_path);
1052     } else {
1053       ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadFile(
1054           GetProcess()->GetID(), file.local_path);
1055     }
1056   }
1057   Send(new ViewMsg_RunFileChooserResponse(GetRoutingID(), files));
1058 }
1059
1060 void RenderViewHostImpl::DirectoryEnumerationFinished(
1061     int request_id,
1062     const std::vector<base::FilePath>& files) {
1063   // Grant the security access requested to the given files.
1064   for (std::vector<base::FilePath>::const_iterator file = files.begin();
1065        file != files.end(); ++file) {
1066     ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadFile(
1067         GetProcess()->GetID(), *file);
1068   }
1069   Send(new ViewMsg_EnumerateDirectoryResponse(GetRoutingID(),
1070                                               request_id,
1071                                               files));
1072 }
1073
1074 void RenderViewHostImpl::LoadStateChanged(
1075     const GURL& url,
1076     const net::LoadStateWithParam& load_state,
1077     uint64 upload_position,
1078     uint64 upload_size) {
1079   delegate_->LoadStateChanged(url, load_state, upload_position, upload_size);
1080 }
1081
1082 bool RenderViewHostImpl::SuddenTerminationAllowed() const {
1083   return sudden_termination_allowed_ ||
1084       GetProcess()->SuddenTerminationAllowed();
1085 }
1086
1087 ///////////////////////////////////////////////////////////////////////////////
1088 // RenderViewHostImpl, IPC message handlers:
1089
1090 bool RenderViewHostImpl::OnMessageReceived(const IPC::Message& msg) {
1091   if (!BrowserMessageFilter::CheckCanDispatchOnUI(msg, this))
1092     return true;
1093
1094   // Filter out most IPC messages if this renderer is swapped out.
1095   // We still want to handle certain ACKs to keep our state consistent.
1096   if (IsSwappedOut()) {
1097     if (!SwappedOutMessages::CanHandleWhileSwappedOut(msg)) {
1098       // If this is a synchronous message and we decided not to handle it,
1099       // we must send an error reply, or else the renderer will be stuck
1100       // and won't respond to future requests.
1101       if (msg.is_sync()) {
1102         IPC::Message* reply = IPC::SyncMessage::GenerateReply(&msg);
1103         reply->set_reply_error();
1104         Send(reply);
1105       }
1106       // Don't continue looking for someone to handle it.
1107       return true;
1108     }
1109   }
1110
1111   if (delegate_->OnMessageReceived(this, msg))
1112     return true;
1113
1114   bool handled = true;
1115   bool msg_is_ok = true;
1116   IPC_BEGIN_MESSAGE_MAP_EX(RenderViewHostImpl, msg, msg_is_ok)
1117     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowView, OnShowView)
1118     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnShowWidget)
1119     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowFullscreenWidget,
1120                         OnShowFullscreenWidget)
1121     IPC_MESSAGE_HANDLER(ViewHostMsg_RenderViewReady, OnRenderViewReady)
1122     IPC_MESSAGE_HANDLER(ViewHostMsg_RenderProcessGone, OnRenderProcessGone)
1123     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateState, OnUpdateState)
1124     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTitle, OnUpdateTitle)
1125     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateEncoding, OnUpdateEncoding)
1126     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTargetURL, OnUpdateTargetURL)
1127     IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateInspectorSetting,
1128                         OnUpdateInspectorSetting)
1129     IPC_MESSAGE_HANDLER(ViewHostMsg_Close, OnClose)
1130     IPC_MESSAGE_HANDLER(ViewHostMsg_RequestMove, OnRequestMove)
1131     IPC_MESSAGE_HANDLER(ViewHostMsg_DidChangeLoadProgress,
1132                         OnDidChangeLoadProgress)
1133     IPC_MESSAGE_HANDLER(ViewHostMsg_DidDisownOpener, OnDidDisownOpener)
1134     IPC_MESSAGE_HANDLER(ViewHostMsg_DocumentAvailableInMainFrame,
1135                         OnDocumentAvailableInMainFrame)
1136     IPC_MESSAGE_HANDLER(ViewHostMsg_DocumentOnLoadCompletedInMainFrame,
1137                         OnDocumentOnLoadCompletedInMainFrame)
1138     IPC_MESSAGE_HANDLER(ViewHostMsg_ToggleFullscreen, OnToggleFullscreen)
1139     IPC_MESSAGE_HANDLER(ViewHostMsg_DidContentsPreferredSizeChange,
1140                         OnDidContentsPreferredSizeChange)
1141     IPC_MESSAGE_HANDLER(ViewHostMsg_DidChangeScrollOffset,
1142                         OnDidChangeScrollOffset)
1143     IPC_MESSAGE_HANDLER(ViewHostMsg_DidChangeScrollbarsForMainFrame,
1144                         OnDidChangeScrollbarsForMainFrame)
1145     IPC_MESSAGE_HANDLER(ViewHostMsg_DidChangeScrollOffsetPinningForMainFrame,
1146                         OnDidChangeScrollOffsetPinningForMainFrame)
1147     IPC_MESSAGE_HANDLER(ViewHostMsg_DidChangeNumWheelEvents,
1148                         OnDidChangeNumWheelEvents)
1149     IPC_MESSAGE_HANDLER(ViewHostMsg_RouteCloseEvent,
1150                         OnRouteCloseEvent)
1151     IPC_MESSAGE_HANDLER(ViewHostMsg_RouteMessageEvent, OnRouteMessageEvent)
1152     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunJavaScriptMessage,
1153                                     OnRunJavaScriptMessage)
1154     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunBeforeUnloadConfirm,
1155                                     OnRunBeforeUnloadConfirm)
1156     IPC_MESSAGE_HANDLER(DragHostMsg_StartDragging, OnStartDragging)
1157     IPC_MESSAGE_HANDLER(DragHostMsg_UpdateDragCursor, OnUpdateDragCursor)
1158     IPC_MESSAGE_HANDLER(DragHostMsg_TargetDrop_ACK, OnTargetDropACK)
1159     IPC_MESSAGE_HANDLER(ViewHostMsg_TakeFocus, OnTakeFocus)
1160     IPC_MESSAGE_HANDLER(ViewHostMsg_FocusedNodeChanged, OnFocusedNodeChanged)
1161     IPC_MESSAGE_HANDLER(ViewHostMsg_AddMessageToConsole, OnAddMessageToConsole)
1162     IPC_MESSAGE_HANDLER(ViewHostMsg_ShouldClose_ACK, OnShouldCloseACK)
1163     IPC_MESSAGE_HANDLER(ViewHostMsg_ClosePage_ACK, OnClosePageACK)
1164     IPC_MESSAGE_HANDLER(ViewHostMsg_SwapOut_ACK, OnSwapOutACK)
1165     IPC_MESSAGE_HANDLER(ViewHostMsg_SelectionChanged, OnSelectionChanged)
1166     IPC_MESSAGE_HANDLER(ViewHostMsg_SelectionBoundsChanged,
1167                         OnSelectionBoundsChanged)
1168     IPC_MESSAGE_HANDLER(ViewHostMsg_ScriptEvalResponse, OnScriptEvalResponse)
1169     IPC_MESSAGE_HANDLER(ViewHostMsg_DidZoomURL, OnDidZoomURL)
1170     IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_RequestPermission,
1171                         OnRequestDesktopNotificationPermission)
1172     IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show,
1173                         OnShowDesktopNotification)
1174     IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel,
1175                         OnCancelDesktopNotification)
1176 #if defined(OS_MACOSX) || defined(OS_ANDROID)
1177     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowPopup, OnShowPopup)
1178 #endif
1179     IPC_MESSAGE_HANDLER(ViewHostMsg_RunFileChooser, OnRunFileChooser)
1180     IPC_MESSAGE_HANDLER(ViewHostMsg_DidAccessInitialDocument,
1181                         OnDidAccessInitialDocument)
1182     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_Events, OnAccessibilityEvents)
1183     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_LocationChanges,
1184                         OnAccessibilityLocationChanges)
1185     IPC_MESSAGE_HANDLER(ViewHostMsg_FocusedNodeTouched, OnFocusedNodeTouched)
1186     // Have the super handle all other messages.
1187     IPC_MESSAGE_UNHANDLED(
1188         handled = RenderWidgetHostImpl::OnMessageReceived(msg))
1189   IPC_END_MESSAGE_MAP_EX()
1190
1191   if (!msg_is_ok) {
1192     // The message had a handler, but its de-serialization failed.
1193     // Kill the renderer.
1194     RecordAction(base::UserMetricsAction("BadMessageTerminate_RVH"));
1195     GetProcess()->ReceivedBadMessage();
1196   }
1197
1198   return handled;
1199 }
1200
1201 void RenderViewHostImpl::Init() {
1202   RenderWidgetHostImpl::Init();
1203 }
1204
1205 bool RenderViewHostImpl::IsRenderView() const {
1206   return true;
1207 }
1208
1209 void RenderViewHostImpl::CreateNewWindow(
1210     int route_id,
1211     int main_frame_route_id,
1212     const ViewHostMsg_CreateWindow_Params& params,
1213     SessionStorageNamespace* session_storage_namespace) {
1214   ViewHostMsg_CreateWindow_Params validated_params(params);
1215   GetProcess()->FilterURL(false, &validated_params.target_url);
1216   GetProcess()->FilterURL(false, &validated_params.opener_url);
1217   GetProcess()->FilterURL(true, &validated_params.opener_security_origin);
1218
1219   delegate_->CreateNewWindow(
1220       GetProcess()->GetID(), route_id, main_frame_route_id, validated_params,
1221       session_storage_namespace);
1222 }
1223
1224 void RenderViewHostImpl::CreateNewWidget(int route_id,
1225                                      blink::WebPopupType popup_type) {
1226   delegate_->CreateNewWidget(GetProcess()->GetID(), route_id, popup_type);
1227 }
1228
1229 void RenderViewHostImpl::CreateNewFullscreenWidget(int route_id) {
1230   delegate_->CreateNewFullscreenWidget(GetProcess()->GetID(), route_id);
1231 }
1232
1233 void RenderViewHostImpl::OnShowView(int route_id,
1234                                     WindowOpenDisposition disposition,
1235                                     const gfx::Rect& initial_pos,
1236                                     bool user_gesture) {
1237   if (IsRVHStateActive(rvh_state_)) {
1238     delegate_->ShowCreatedWindow(
1239         route_id, disposition, initial_pos, user_gesture);
1240   }
1241   Send(new ViewMsg_Move_ACK(route_id));
1242 }
1243
1244 void RenderViewHostImpl::OnShowWidget(int route_id,
1245                                       const gfx::Rect& initial_pos) {
1246   if (IsRVHStateActive(rvh_state_))
1247     delegate_->ShowCreatedWidget(route_id, initial_pos);
1248   Send(new ViewMsg_Move_ACK(route_id));
1249 }
1250
1251 void RenderViewHostImpl::OnShowFullscreenWidget(int route_id) {
1252   if (IsRVHStateActive(rvh_state_))
1253     delegate_->ShowCreatedFullscreenWidget(route_id);
1254   Send(new ViewMsg_Move_ACK(route_id));
1255 }
1256
1257 void RenderViewHostImpl::OnRenderViewReady() {
1258   render_view_termination_status_ = base::TERMINATION_STATUS_STILL_RUNNING;
1259   SendScreenRects();
1260   WasResized();
1261   delegate_->RenderViewReady(this);
1262 }
1263
1264 void RenderViewHostImpl::OnRenderProcessGone(int status, int exit_code) {
1265   // Keep the termination status so we can get at it later when we
1266   // need to know why it died.
1267   render_view_termination_status_ =
1268       static_cast<base::TerminationStatus>(status);
1269
1270   // Reset frame tree state associated with this process.
1271   delegate_->GetFrameTree()->RenderProcessGone(this);
1272
1273   // Our base class RenderWidgetHost needs to reset some stuff.
1274   RendererExited(render_view_termination_status_, exit_code);
1275
1276   delegate_->RenderViewTerminated(this,
1277                                   static_cast<base::TerminationStatus>(status),
1278                                   exit_code);
1279 }
1280
1281 void RenderViewHostImpl::OnDidStartProvisionalLoadForFrame(
1282     int parent_routing_id,
1283     bool is_main_frame,
1284     const GURL& url) {
1285   NOTREACHED();
1286 }
1287
1288 void RenderViewHostImpl::OnNavigate(const IPC::Message& msg) {
1289   // TODO(nasko): Forward calls to the top level RenderFrameHost until all
1290   // callers of this method on RenderViewHost are removed.
1291   delegate_->GetFrameTree()->GetMainFrame()->OnMessageReceived(msg);
1292 }
1293
1294 void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) {
1295   // Without this check, the renderer can trick the browser into using
1296   // filenames it can't access in a future session restore.
1297   if (!CanAccessFilesOfPageState(state)) {
1298     GetProcess()->ReceivedBadMessage();
1299     return;
1300   }
1301
1302   delegate_->UpdateState(this, page_id, state);
1303 }
1304
1305 void RenderViewHostImpl::OnUpdateTitle(
1306     int32 page_id,
1307     const base::string16& title,
1308     blink::WebTextDirection title_direction) {
1309   if (title.length() > kMaxTitleChars) {
1310     NOTREACHED() << "Renderer sent too many characters in title.";
1311     return;
1312   }
1313
1314   delegate_->UpdateTitle(this, page_id, title,
1315                          WebTextDirectionToChromeTextDirection(
1316                              title_direction));
1317 }
1318
1319 void RenderViewHostImpl::OnUpdateEncoding(const std::string& encoding_name) {
1320   delegate_->UpdateEncoding(this, encoding_name);
1321 }
1322
1323 void RenderViewHostImpl::OnUpdateTargetURL(int32 page_id, const GURL& url) {
1324   if (IsRVHStateActive(rvh_state_))
1325     delegate_->UpdateTargetURL(page_id, url);
1326
1327   // Send a notification back to the renderer that we are ready to
1328   // receive more target urls.
1329   Send(new ViewMsg_UpdateTargetURL_ACK(GetRoutingID()));
1330 }
1331
1332 void RenderViewHostImpl::OnUpdateInspectorSetting(
1333     const std::string& key, const std::string& value) {
1334   GetContentClient()->browser()->UpdateInspectorSetting(
1335       this, key, value);
1336 }
1337
1338 void RenderViewHostImpl::OnClose() {
1339   // If the renderer is telling us to close, it has already run the unload
1340   // events, and we can take the fast path.
1341   ClosePageIgnoringUnloadEvents();
1342 }
1343
1344 void RenderViewHostImpl::OnRequestMove(const gfx::Rect& pos) {
1345   if (IsRVHStateActive(rvh_state_))
1346     delegate_->RequestMove(pos);
1347   Send(new ViewMsg_Move_ACK(GetRoutingID()));
1348 }
1349
1350 void RenderViewHostImpl::OnDidChangeLoadProgress(double load_progress) {
1351   delegate_->DidChangeLoadProgress(load_progress);
1352 }
1353
1354 void RenderViewHostImpl::OnDidDisownOpener() {
1355   delegate_->DidDisownOpener(this);
1356 }
1357
1358 void RenderViewHostImpl::OnDocumentAvailableInMainFrame() {
1359   delegate_->DocumentAvailableInMainFrame(this);
1360 }
1361
1362 void RenderViewHostImpl::OnDocumentOnLoadCompletedInMainFrame(
1363     int32 page_id) {
1364   delegate_->DocumentOnLoadCompletedInMainFrame(this, page_id);
1365 }
1366
1367 void RenderViewHostImpl::OnToggleFullscreen(bool enter_fullscreen) {
1368   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
1369   delegate_->ToggleFullscreenMode(enter_fullscreen);
1370   // We need to notify the contents that its fullscreen state has changed. This
1371   // is done as part of the resize message.
1372   WasResized();
1373 }
1374
1375 void RenderViewHostImpl::OnDidContentsPreferredSizeChange(
1376     const gfx::Size& new_size) {
1377   delegate_->UpdatePreferredSize(new_size);
1378 }
1379
1380 void RenderViewHostImpl::OnRenderAutoResized(const gfx::Size& new_size) {
1381   delegate_->ResizeDueToAutoResize(new_size);
1382 }
1383
1384 void RenderViewHostImpl::OnDidChangeScrollOffset() {
1385   if (view_)
1386     view_->ScrollOffsetChanged();
1387 }
1388
1389 void RenderViewHostImpl::OnDidChangeScrollbarsForMainFrame(
1390     bool has_horizontal_scrollbar, bool has_vertical_scrollbar) {
1391   if (view_)
1392     view_->SetHasHorizontalScrollbar(has_horizontal_scrollbar);
1393 }
1394
1395 void RenderViewHostImpl::OnDidChangeScrollOffsetPinningForMainFrame(
1396     bool is_pinned_to_left, bool is_pinned_to_right) {
1397   if (view_)
1398     view_->SetScrollOffsetPinning(is_pinned_to_left, is_pinned_to_right);
1399 }
1400
1401 void RenderViewHostImpl::OnDidChangeNumWheelEvents(int count) {
1402 }
1403
1404 void RenderViewHostImpl::OnSelectionChanged(const base::string16& text,
1405                                             size_t offset,
1406                                             const gfx::Range& range) {
1407   if (view_)
1408     view_->SelectionChanged(text, offset, range);
1409 }
1410
1411 void RenderViewHostImpl::OnSelectionBoundsChanged(
1412     const ViewHostMsg_SelectionBounds_Params& params) {
1413   if (view_) {
1414     view_->SelectionBoundsChanged(params);
1415   }
1416 }
1417
1418 void RenderViewHostImpl::OnRouteCloseEvent() {
1419   // Have the delegate route this to the active RenderViewHost.
1420   delegate_->RouteCloseEvent(this);
1421 }
1422
1423 void RenderViewHostImpl::OnRouteMessageEvent(
1424     const ViewMsg_PostMessage_Params& params) {
1425   // Give to the delegate to route to the active RenderViewHost.
1426   delegate_->RouteMessageEvent(this, params);
1427 }
1428
1429 void RenderViewHostImpl::OnRunJavaScriptMessage(
1430     const base::string16& message,
1431     const base::string16& default_prompt,
1432     const GURL& frame_url,
1433     JavaScriptMessageType type,
1434     IPC::Message* reply_msg) {
1435   // While a JS message dialog is showing, tabs in the same process shouldn't
1436   // process input events.
1437   GetProcess()->SetIgnoreInputEvents(true);
1438   StopHangMonitorTimeout();
1439   delegate_->RunJavaScriptMessage(this, message, default_prompt, frame_url,
1440                                   type, reply_msg,
1441                                   &are_javascript_messages_suppressed_);
1442 }
1443
1444 void RenderViewHostImpl::OnRunBeforeUnloadConfirm(const GURL& frame_url,
1445                                                   const base::string16& message,
1446                                                   bool is_reload,
1447                                                   IPC::Message* reply_msg) {
1448   // While a JS before unload dialog is showing, tabs in the same process
1449   // shouldn't process input events.
1450   GetProcess()->SetIgnoreInputEvents(true);
1451   StopHangMonitorTimeout();
1452   delegate_->RunBeforeUnloadConfirm(this, message, is_reload, reply_msg);
1453 }
1454
1455 void RenderViewHostImpl::OnStartDragging(
1456     const DropData& drop_data,
1457     WebDragOperationsMask drag_operations_mask,
1458     const SkBitmap& bitmap,
1459     const gfx::Vector2d& bitmap_offset_in_dip,
1460     const DragEventSourceInfo& event_info) {
1461   RenderViewHostDelegateView* view = delegate_->GetDelegateView();
1462   if (!view)
1463     return;
1464
1465   DropData filtered_data(drop_data);
1466   RenderProcessHost* process = GetProcess();
1467   ChildProcessSecurityPolicyImpl* policy =
1468       ChildProcessSecurityPolicyImpl::GetInstance();
1469
1470   // Allow drag of Javascript URLs to enable bookmarklet drag to bookmark bar.
1471   if (!filtered_data.url.SchemeIs(kJavaScriptScheme))
1472     process->FilterURL(true, &filtered_data.url);
1473   process->FilterURL(false, &filtered_data.html_base_url);
1474   // Filter out any paths that the renderer didn't have access to. This prevents
1475   // the following attack on a malicious renderer:
1476   // 1. StartDragging IPC sent with renderer-specified filesystem paths that it
1477   //    doesn't have read permissions for.
1478   // 2. We initiate a native DnD operation.
1479   // 3. DnD operation immediately ends since mouse is not held down. DnD events
1480   //    still fire though, which causes read permissions to be granted to the
1481   //    renderer for any file paths in the drop.
1482   filtered_data.filenames.clear();
1483   for (std::vector<DropData::FileInfo>::const_iterator it =
1484            drop_data.filenames.begin();
1485        it != drop_data.filenames.end(); ++it) {
1486     base::FilePath path(
1487         base::FilePath::FromUTF8Unsafe(base::UTF16ToUTF8(it->path)));
1488     if (policy->CanReadFile(GetProcess()->GetID(), path))
1489       filtered_data.filenames.push_back(*it);
1490   }
1491   float scale = ui::GetImageScale(GetScaleFactorForView(GetView()));
1492   gfx::ImageSkia image(gfx::ImageSkiaRep(bitmap, scale));
1493   view->StartDragging(filtered_data, drag_operations_mask, image,
1494       bitmap_offset_in_dip, event_info);
1495 }
1496
1497 void RenderViewHostImpl::OnUpdateDragCursor(WebDragOperation current_op) {
1498   RenderViewHostDelegateView* view = delegate_->GetDelegateView();
1499   if (view)
1500     view->UpdateDragCursor(current_op);
1501 }
1502
1503 void RenderViewHostImpl::OnTargetDropACK() {
1504   NotificationService::current()->Notify(
1505       NOTIFICATION_RENDER_VIEW_HOST_DID_RECEIVE_DRAG_TARGET_DROP_ACK,
1506       Source<RenderViewHost>(this),
1507       NotificationService::NoDetails());
1508 }
1509
1510 void RenderViewHostImpl::OnTakeFocus(bool reverse) {
1511   RenderViewHostDelegateView* view = delegate_->GetDelegateView();
1512   if (view)
1513     view->TakeFocus(reverse);
1514 }
1515
1516 void RenderViewHostImpl::OnFocusedNodeChanged(bool is_editable_node) {
1517   if (view_)
1518     view_->FocusedNodeChanged(is_editable_node);
1519 #if defined(OS_WIN)
1520   if (!is_editable_node && virtual_keyboard_requested_) {
1521     virtual_keyboard_requested_ = false;
1522     BrowserThread::PostDelayedTask(
1523         BrowserThread::UI, FROM_HERE,
1524         base::Bind(base::IgnoreResult(&DismissVirtualKeyboardTask)),
1525         TimeDelta::FromMilliseconds(kVirtualKeyboardDisplayWaitTimeoutMs));
1526   }
1527 #endif
1528   NotificationService::current()->Notify(
1529       NOTIFICATION_FOCUS_CHANGED_IN_PAGE,
1530       Source<RenderViewHost>(this),
1531       Details<const bool>(&is_editable_node));
1532 }
1533
1534 void RenderViewHostImpl::OnAddMessageToConsole(
1535     int32 level,
1536     const base::string16& message,
1537     int32 line_no,
1538     const base::string16& source_id) {
1539   if (delegate_->AddMessageToConsole(level, message, line_no, source_id))
1540     return;
1541
1542   // Pass through log level only on WebUI pages to limit console spew.
1543   int32 resolved_level = HasWebUIScheme(delegate_->GetURL()) ? level : 0;
1544
1545   if (resolved_level >= ::logging::GetMinLogLevel()) {
1546     logging::LogMessage("CONSOLE", line_no, resolved_level).stream() << "\"" <<
1547         message << "\", source: " << source_id << " (" << line_no << ")";
1548   }
1549 }
1550
1551 void RenderViewHostImpl::OnUserGesture() {
1552   delegate_->OnUserGesture();
1553 }
1554
1555 void RenderViewHostImpl::OnShouldCloseACK(
1556     bool proceed,
1557     const base::TimeTicks& renderer_before_unload_start_time,
1558     const base::TimeTicks& renderer_before_unload_end_time) {
1559   decrement_in_flight_event_count();
1560   StopHangMonitorTimeout();
1561   // If this renderer navigated while the beforeunload request was in flight, we
1562   // may have cleared this state in OnNavigate, in which case we can ignore
1563   // this message.
1564   if (!is_waiting_for_beforeunload_ack_ || rvh_state_ != STATE_DEFAULT)
1565     return;
1566
1567   is_waiting_for_beforeunload_ack_ = false;
1568
1569   RenderViewHostDelegate::RendererManagement* management_delegate =
1570       delegate_->GetRendererManagementDelegate();
1571   if (management_delegate) {
1572     base::TimeTicks before_unload_end_time;
1573     if (!send_should_close_start_time_.is_null() &&
1574         !renderer_before_unload_start_time.is_null() &&
1575         !renderer_before_unload_end_time.is_null()) {
1576       // When passing TimeTicks across process boundaries, we need to compensate
1577       // for any skew between the processes. Here we are converting the
1578       // renderer's notion of before_unload_end_time to TimeTicks in the browser
1579       // process. See comments in inter_process_time_ticks_converter.h for more.
1580       InterProcessTimeTicksConverter converter(
1581           LocalTimeTicks::FromTimeTicks(send_should_close_start_time_),
1582           LocalTimeTicks::FromTimeTicks(base::TimeTicks::Now()),
1583           RemoteTimeTicks::FromTimeTicks(renderer_before_unload_start_time),
1584           RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
1585       LocalTimeTicks browser_before_unload_end_time =
1586           converter.ToLocalTimeTicks(
1587               RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
1588       before_unload_end_time = browser_before_unload_end_time.ToTimeTicks();
1589     }
1590     management_delegate->ShouldClosePage(
1591         unload_ack_is_for_cross_site_transition_, proceed,
1592         before_unload_end_time);
1593   }
1594
1595   // If canceled, notify the delegate to cancel its pending navigation entry.
1596   if (!proceed)
1597     delegate_->DidCancelLoading();
1598 }
1599
1600 void RenderViewHostImpl::OnClosePageACK() {
1601   decrement_in_flight_event_count();
1602   ClosePageIgnoringUnloadEvents();
1603 }
1604
1605 void RenderViewHostImpl::NotifyRendererUnresponsive() {
1606   delegate_->RendererUnresponsive(
1607       this, is_waiting_for_beforeunload_ack_, IsWaitingForUnloadACK());
1608 }
1609
1610 void RenderViewHostImpl::NotifyRendererResponsive() {
1611   delegate_->RendererResponsive(this);
1612 }
1613
1614 void RenderViewHostImpl::RequestToLockMouse(bool user_gesture,
1615                                             bool last_unlocked_by_target) {
1616   delegate_->RequestToLockMouse(user_gesture, last_unlocked_by_target);
1617 }
1618
1619 bool RenderViewHostImpl::IsFullscreen() const {
1620   return delegate_->IsFullscreenForCurrentTab();
1621 }
1622
1623 void RenderViewHostImpl::OnFocus() {
1624   // Note: We allow focus and blur from swapped out RenderViewHosts, even when
1625   // the active RenderViewHost is in a different BrowsingInstance (e.g., WebUI).
1626   delegate_->Activate();
1627 }
1628
1629 void RenderViewHostImpl::OnBlur() {
1630   delegate_->Deactivate();
1631 }
1632
1633 gfx::Rect RenderViewHostImpl::GetRootWindowResizerRect() const {
1634   return delegate_->GetRootWindowResizerRect();
1635 }
1636
1637 void RenderViewHostImpl::ForwardMouseEvent(
1638     const blink::WebMouseEvent& mouse_event) {
1639
1640   // We make a copy of the mouse event because
1641   // RenderWidgetHost::ForwardMouseEvent will delete |mouse_event|.
1642   blink::WebMouseEvent event_copy(mouse_event);
1643   RenderWidgetHostImpl::ForwardMouseEvent(event_copy);
1644
1645   switch (event_copy.type) {
1646     case WebInputEvent::MouseMove:
1647       delegate_->HandleMouseMove();
1648       break;
1649     case WebInputEvent::MouseLeave:
1650       delegate_->HandleMouseLeave();
1651       break;
1652     case WebInputEvent::MouseDown:
1653       delegate_->HandleMouseDown();
1654       break;
1655     case WebInputEvent::MouseWheel:
1656       if (ignore_input_events())
1657         delegate_->OnIgnoredUIEvent();
1658       break;
1659     case WebInputEvent::MouseUp:
1660       delegate_->HandleMouseUp();
1661     default:
1662       // For now, we don't care about the rest.
1663       break;
1664   }
1665 }
1666
1667 void RenderViewHostImpl::OnPointerEventActivate() {
1668   delegate_->HandlePointerActivate();
1669 }
1670
1671 void RenderViewHostImpl::ForwardKeyboardEvent(
1672     const NativeWebKeyboardEvent& key_event) {
1673   if (ignore_input_events()) {
1674     if (key_event.type == WebInputEvent::RawKeyDown)
1675       delegate_->OnIgnoredUIEvent();
1676     return;
1677   }
1678   RenderWidgetHostImpl::ForwardKeyboardEvent(key_event);
1679 }
1680
1681 #if defined(OS_ANDROID)
1682 void RenderViewHostImpl::DidSelectPopupMenuItems(
1683     const std::vector<int>& selected_indices) {
1684   Send(new ViewMsg_SelectPopupMenuItems(GetRoutingID(), false,
1685                                         selected_indices));
1686 }
1687
1688 void RenderViewHostImpl::DidCancelPopupMenu() {
1689   Send(new ViewMsg_SelectPopupMenuItems(GetRoutingID(), true,
1690                                         std::vector<int>()));
1691 }
1692 #endif
1693
1694 #if defined(OS_MACOSX)
1695 void RenderViewHostImpl::DidSelectPopupMenuItem(int selected_index) {
1696   Send(new ViewMsg_SelectPopupMenuItem(GetRoutingID(), selected_index));
1697 }
1698
1699 void RenderViewHostImpl::DidCancelPopupMenu() {
1700   Send(new ViewMsg_SelectPopupMenuItem(GetRoutingID(), -1));
1701 }
1702 #endif
1703
1704 void RenderViewHostImpl::SendOrientationChangeEvent(int orientation) {
1705   Send(new ViewMsg_OrientationChangeEvent(GetRoutingID(), orientation));
1706 }
1707
1708 void RenderViewHostImpl::ToggleSpeechInput() {
1709   Send(new InputTagSpeechMsg_ToggleSpeechInput(GetRoutingID()));
1710 }
1711
1712 bool RenderViewHostImpl::IsWaitingForUnloadACK() const {
1713   return rvh_state_ == STATE_WAITING_FOR_UNLOAD_ACK ||
1714          rvh_state_ == STATE_WAITING_FOR_CLOSE ||
1715          rvh_state_ == STATE_PENDING_SHUTDOWN ||
1716          rvh_state_ == STATE_PENDING_SWAP_OUT;
1717 }
1718
1719 void RenderViewHostImpl::ExitFullscreen() {
1720   RejectMouseLockOrUnlockIfNecessary();
1721   // Notify delegate_ and renderer of fullscreen state change.
1722   OnToggleFullscreen(false);
1723 }
1724
1725 WebPreferences RenderViewHostImpl::GetWebkitPreferences() {
1726   return delegate_->GetWebkitPrefs();
1727 }
1728
1729 void RenderViewHostImpl::DisownOpener() {
1730   // This should only be called when swapped out.
1731   DCHECK(IsSwappedOut());
1732
1733   Send(new ViewMsg_DisownOpener(GetRoutingID()));
1734 }
1735
1736 void RenderViewHostImpl::SetAccessibilityCallbackForTesting(
1737     const base::Callback<void(ui::AXEvent)>& callback) {
1738   accessibility_testing_callback_ = callback;
1739 }
1740
1741 void RenderViewHostImpl::UpdateWebkitPreferences(const WebPreferences& prefs) {
1742   Send(new ViewMsg_UpdateWebPreferences(GetRoutingID(), prefs));
1743 }
1744
1745 void RenderViewHostImpl::NotifyTimezoneChange() {
1746   Send(new ViewMsg_TimezoneChange(GetRoutingID()));
1747 }
1748
1749 void RenderViewHostImpl::GetAudioOutputControllers(
1750     const GetAudioOutputControllersCallback& callback) const {
1751   AudioRendererHost* audio_host =
1752       static_cast<RenderProcessHostImpl*>(GetProcess())->audio_renderer_host();
1753   audio_host->GetOutputControllers(GetRoutingID(), callback);
1754 }
1755
1756 void RenderViewHostImpl::ClearFocusedElement() {
1757   Send(new ViewMsg_ClearFocusedElement(GetRoutingID()));
1758 }
1759
1760 void RenderViewHostImpl::Zoom(PageZoom zoom) {
1761   Send(new ViewMsg_Zoom(GetRoutingID(), zoom));
1762 }
1763
1764 void RenderViewHostImpl::ReloadFrame() {
1765   Send(new ViewMsg_ReloadFrame(GetRoutingID()));
1766 }
1767
1768 void RenderViewHostImpl::InsertCSS(const base::string16& frame_xpath,
1769                                    const std::string& css) {
1770   Send(new ViewMsg_CSSInsertRequest(GetRoutingID(), frame_xpath, css));
1771 }
1772
1773 void RenderViewHostImpl::DisableScrollbarsForThreshold(const gfx::Size& size) {
1774   Send(new ViewMsg_DisableScrollbarsForSmallWindows(GetRoutingID(), size));
1775 }
1776
1777 void RenderViewHostImpl::EnablePreferredSizeMode() {
1778   Send(new ViewMsg_EnablePreferredSizeChangedMode(GetRoutingID()));
1779 }
1780
1781 void RenderViewHostImpl::EnableAutoResize(const gfx::Size& min_size,
1782                                           const gfx::Size& max_size) {
1783   SetShouldAutoResize(true);
1784   Send(new ViewMsg_EnableAutoResize(GetRoutingID(), min_size, max_size));
1785 }
1786
1787 void RenderViewHostImpl::DisableAutoResize(const gfx::Size& new_size) {
1788   SetShouldAutoResize(false);
1789   Send(new ViewMsg_DisableAutoResize(GetRoutingID(), new_size));
1790 }
1791
1792 void RenderViewHostImpl::CopyImageAt(int x, int y) {
1793   Send(new ViewMsg_CopyImageAt(GetRoutingID(), x, y));
1794 }
1795
1796 void RenderViewHostImpl::ExecuteMediaPlayerActionAtLocation(
1797   const gfx::Point& location, const blink::WebMediaPlayerAction& action) {
1798   Send(new ViewMsg_MediaPlayerActionAt(GetRoutingID(), location, action));
1799 }
1800
1801 void RenderViewHostImpl::ExecutePluginActionAtLocation(
1802   const gfx::Point& location, const blink::WebPluginAction& action) {
1803   Send(new ViewMsg_PluginActionAt(GetRoutingID(), location, action));
1804 }
1805
1806 void RenderViewHostImpl::NotifyMoveOrResizeStarted() {
1807   Send(new ViewMsg_MoveOrResizeStarted(GetRoutingID()));
1808 }
1809
1810 void RenderViewHostImpl::OnAccessibilityEvents(
1811     const std::vector<AccessibilityHostMsg_EventParams>& params) {
1812   if ((accessibility_mode() & AccessibilityModeFlagPlatform) && view_ &&
1813       IsRVHStateActive(rvh_state_)) {
1814     view_->CreateBrowserAccessibilityManagerIfNeeded();
1815     BrowserAccessibilityManager* manager =
1816         view_->GetBrowserAccessibilityManager();
1817     if (manager)
1818       manager->OnAccessibilityEvents(params);
1819   }
1820
1821   // Always send an ACK or the renderer can be in a bad state.
1822   Send(new AccessibilityMsg_Events_ACK(GetRoutingID()));
1823
1824   // The rest of this code is just for testing; bail out if we're not
1825   // in that mode.
1826   if (accessibility_testing_callback_.is_null())
1827     return;
1828
1829   for (unsigned i = 0; i < params.size(); i++) {
1830     const AccessibilityHostMsg_EventParams& param = params[i];
1831     if (static_cast<int>(param.event_type) < 0)
1832       continue;
1833     ui::AXTreeUpdate update;
1834     update.nodes = param.nodes;
1835     if (!ax_tree_)
1836       ax_tree_.reset(new ui::AXTree(update));
1837     else
1838       CHECK(ax_tree_->Unserialize(update)) << ax_tree_->error();
1839     accessibility_testing_callback_.Run(param.event_type);
1840   }
1841 }
1842
1843 void RenderViewHostImpl::OnAccessibilityLocationChanges(
1844     const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
1845   if (view_ && IsRVHStateActive(rvh_state_)) {
1846     view_->CreateBrowserAccessibilityManagerIfNeeded();
1847     BrowserAccessibilityManager* manager =
1848         view_->GetBrowserAccessibilityManager();
1849     if (manager)
1850       manager->OnLocationChanges(params);
1851   }
1852 }
1853
1854 void RenderViewHostImpl::OnScriptEvalResponse(int id,
1855                                               const base::ListValue& result) {
1856   const base::Value* result_value;
1857   if (!result.Get(0, &result_value)) {
1858     // Programming error or rogue renderer.
1859     NOTREACHED() << "Got bad arguments for OnScriptEvalResponse";
1860     return;
1861   }
1862
1863   std::map<int, JavascriptResultCallback>::iterator it =
1864       javascript_callbacks_.find(id);
1865   if (it != javascript_callbacks_.end()) {
1866     // ExecuteJavascriptInWebFrameCallbackResult was used; do callback.
1867     it->second.Run(result_value);
1868     javascript_callbacks_.erase(it);
1869   } else {
1870     NOTREACHED() << "Received script response for unknown request";
1871   }
1872 }
1873
1874 void RenderViewHostImpl::OnDidZoomURL(double zoom_level,
1875                                       bool remember,
1876                                       const GURL& url) {
1877   HostZoomMapImpl* host_zoom_map = static_cast<HostZoomMapImpl*>(
1878       HostZoomMap::GetForBrowserContext(GetProcess()->GetBrowserContext()));
1879   if (remember) {
1880     host_zoom_map->
1881         SetZoomLevelForHost(net::GetHostOrSpecFromURL(url), zoom_level);
1882   } else {
1883     host_zoom_map->SetTemporaryZoomLevel(
1884         GetProcess()->GetID(), GetRoutingID(), zoom_level);
1885   }
1886 }
1887
1888 void RenderViewHostImpl::OnRequestDesktopNotificationPermission(
1889     const GURL& source_origin, int callback_context) {
1890   GetContentClient()->browser()->RequestDesktopNotificationPermission(
1891       source_origin, callback_context, GetProcess()->GetID(), GetRoutingID());
1892 }
1893
1894 void RenderViewHostImpl::OnShowDesktopNotification(
1895     const ShowDesktopNotificationHostMsgParams& params) {
1896   GetContentClient()->browser()->ShowDesktopNotification(
1897       params, GetProcess()->GetID(), GetRoutingID(), false);
1898 }
1899
1900 void RenderViewHostImpl::OnCancelDesktopNotification(int notification_id) {
1901   GetContentClient()->browser()->CancelDesktopNotification(
1902       GetProcess()->GetID(), GetRoutingID(), notification_id);
1903 }
1904
1905 void RenderViewHostImpl::OnRunFileChooser(const FileChooserParams& params) {
1906   delegate_->RunFileChooser(this, params);
1907 }
1908
1909 void RenderViewHostImpl::OnDidAccessInitialDocument() {
1910   has_accessed_initial_document_ = true;
1911   delegate_->DidAccessInitialDocument();
1912 }
1913
1914 void RenderViewHostImpl::OnFocusedNodeTouched(bool editable) {
1915 #if defined(OS_WIN)
1916   if (editable) {
1917     virtual_keyboard_requested_ = base::win::DisplayVirtualKeyboard();
1918   } else {
1919     virtual_keyboard_requested_ = false;
1920     base::win::DismissVirtualKeyboard();
1921   }
1922 #endif
1923 }
1924
1925 #if defined(OS_MACOSX) || defined(OS_ANDROID)
1926 void RenderViewHostImpl::OnShowPopup(
1927     const ViewHostMsg_ShowPopup_Params& params) {
1928   RenderViewHostDelegateView* view = delegate_->GetDelegateView();
1929   if (view) {
1930     view->ShowPopupMenu(params.bounds,
1931                         params.item_height,
1932                         params.item_font_size,
1933                         params.selected_item,
1934                         params.popup_items,
1935                         params.right_aligned,
1936                         params.allow_multiple_selection);
1937   }
1938 }
1939 #endif
1940
1941 void RenderViewHostImpl::SetState(RenderViewHostImplState rvh_state) {
1942   // We update the number of RenderViews in a SiteInstance when the
1943   // swapped out status of this RenderView gets flipped to/from live.
1944   if (!IsRVHStateActive(rvh_state_) && IsRVHStateActive(rvh_state))
1945     instance_->increment_active_view_count();
1946   else if (IsRVHStateActive(rvh_state_) && !IsRVHStateActive(rvh_state))
1947     instance_->decrement_active_view_count();
1948
1949   // Whenever we change the RVH state to and from live or swapped out state, we
1950   // should not be waiting for beforeunload or unload acks.  We clear them here
1951   // to be safe, since they can cause navigations to be ignored in OnNavigate.
1952   if (rvh_state == STATE_DEFAULT ||
1953       rvh_state == STATE_SWAPPED_OUT ||
1954       rvh_state_ == STATE_DEFAULT ||
1955       rvh_state_ == STATE_SWAPPED_OUT) {
1956     is_waiting_for_beforeunload_ack_ = false;
1957   }
1958   rvh_state_ = rvh_state;
1959
1960 }
1961
1962 bool RenderViewHostImpl::CanAccessFilesOfPageState(
1963     const PageState& state) const {
1964   ChildProcessSecurityPolicyImpl* policy =
1965       ChildProcessSecurityPolicyImpl::GetInstance();
1966
1967   const std::vector<base::FilePath>& file_paths = state.GetReferencedFiles();
1968   for (std::vector<base::FilePath>::const_iterator file = file_paths.begin();
1969        file != file_paths.end(); ++file) {
1970     if (!policy->CanReadFile(GetProcess()->GetID(), *file))
1971       return false;
1972   }
1973   return true;
1974 }
1975
1976 void RenderViewHostImpl::AttachToFrameTree() {
1977   FrameTree* frame_tree = delegate_->GetFrameTree();
1978
1979   frame_tree->ResetForMainFrameSwap();
1980 }
1981
1982 }  // namespace content