1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "content/renderer/render_frame_proxy.h"
9 #include "base/command_line.h"
10 #include "base/lazy_instance.h"
11 #include "content/child/webmessageportchannel_impl.h"
12 #include "content/common/frame_messages.h"
13 #include "content/common/frame_replication_state.h"
14 #include "content/common/site_isolation_policy.h"
15 #include "content/common/swapped_out_messages.h"
16 #include "content/common/view_messages.h"
17 #include "content/renderer/child_frame_compositing_helper.h"
18 #include "content/renderer/render_frame_impl.h"
19 #include "content/renderer/render_thread_impl.h"
20 #include "content/renderer/render_view_impl.h"
21 #include "third_party/WebKit/public/platform/WebString.h"
22 #include "third_party/WebKit/public/web/WebLocalFrame.h"
23 #include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
24 #include "third_party/WebKit/public/web/WebView.h"
30 // Facilitates lookup of RenderFrameProxy by routing_id.
31 typedef std::map
<int, RenderFrameProxy
*> RoutingIDProxyMap
;
32 static base::LazyInstance
<RoutingIDProxyMap
> g_routing_id_proxy_map
=
33 LAZY_INSTANCE_INITIALIZER
;
35 // Facilitates lookup of RenderFrameProxy by WebFrame.
36 typedef std::map
<blink::WebFrame
*, RenderFrameProxy
*> FrameMap
;
37 base::LazyInstance
<FrameMap
> g_frame_map
= LAZY_INSTANCE_INITIALIZER
;
42 RenderFrameProxy
* RenderFrameProxy::CreateProxyToReplaceFrame(
43 RenderFrameImpl
* frame_to_replace
,
45 blink::WebTreeScopeType scope
) {
46 CHECK_NE(routing_id
, MSG_ROUTING_NONE
);
48 scoped_ptr
<RenderFrameProxy
> proxy(
49 new RenderFrameProxy(routing_id
, frame_to_replace
->GetRoutingID()));
51 // When a RenderFrame is replaced by a RenderProxy, the WebRemoteFrame should
52 // always come from WebRemoteFrame::create and a call to WebFrame::swap must
54 blink::WebRemoteFrame
* web_frame
=
55 blink::WebRemoteFrame::create(scope
, proxy
.get());
56 proxy
->Init(web_frame
, frame_to_replace
->render_view());
57 return proxy
.release();
60 RenderFrameProxy
* RenderFrameProxy::CreateFrameProxy(
62 int parent_routing_id
,
63 int render_view_routing_id
,
64 const FrameReplicationState
& replicated_state
) {
65 scoped_ptr
<RenderFrameProxy
> proxy(
66 new RenderFrameProxy(routing_id
, MSG_ROUTING_NONE
));
67 RenderViewImpl
* render_view
= NULL
;
68 blink::WebRemoteFrame
* web_frame
= NULL
;
69 if (parent_routing_id
== MSG_ROUTING_NONE
) {
70 // Create a top level WebRemoteFrame.
71 render_view
= RenderViewImpl::FromRoutingID(render_view_routing_id
);
73 blink::WebRemoteFrame::create(replicated_state
.scope
, proxy
.get());
74 render_view
->webview()->setMainFrame(web_frame
);
76 // Create a frame under an existing parent. The parent is always expected
77 // to be a RenderFrameProxy, because navigations initiated by local frames
78 // should not wind up here.
79 RenderFrameProxy
* parent
=
80 RenderFrameProxy::FromRoutingID(parent_routing_id
);
81 web_frame
= parent
->web_frame()->createRemoteChild(
82 replicated_state
.scope
,
83 blink::WebString::fromUTF8(replicated_state
.name
),
84 replicated_state
.sandbox_flags
, proxy
.get());
85 render_view
= parent
->render_view();
88 proxy
->Init(web_frame
, render_view
);
90 // Initialize proxy's WebRemoteFrame with the security origin and other
91 // replicated information.
92 // TODO(dcheng): Calling this when parent_routing_id != MSG_ROUTING_NONE is
93 // mostly redundant, since we already pass the name and sandbox flags in
94 // createLocalChild(). We should update the Blink interface so it also takes
95 // the origin. Then it will be clear that the replication call is only needed
96 // for the case of setting up a main frame proxy.
97 proxy
->SetReplicatedState(replicated_state
);
99 return proxy
.release();
103 RenderFrameProxy
* RenderFrameProxy::FromRoutingID(int32 routing_id
) {
104 RoutingIDProxyMap
* proxies
= g_routing_id_proxy_map
.Pointer();
105 RoutingIDProxyMap::iterator it
= proxies
->find(routing_id
);
106 return it
== proxies
->end() ? NULL
: it
->second
;
110 RenderFrameProxy
* RenderFrameProxy::FromWebFrame(blink::WebFrame
* web_frame
) {
111 FrameMap::iterator iter
= g_frame_map
.Get().find(web_frame
);
112 if (iter
!= g_frame_map
.Get().end()) {
113 RenderFrameProxy
* proxy
= iter
->second
;
114 DCHECK_EQ(web_frame
, proxy
->web_frame());
120 RenderFrameProxy::RenderFrameProxy(int routing_id
, int frame_routing_id
)
121 : routing_id_(routing_id
),
122 frame_routing_id_(frame_routing_id
),
125 std::pair
<RoutingIDProxyMap::iterator
, bool> result
=
126 g_routing_id_proxy_map
.Get().insert(std::make_pair(routing_id_
, this));
127 CHECK(result
.second
) << "Inserting a duplicate item.";
128 RenderThread::Get()->AddRoute(routing_id_
, this);
131 RenderFrameProxy::~RenderFrameProxy() {
132 // TODO(nasko): Set the render_frame_proxy to null to avoid a double deletion
133 // when detaching the main frame. This can be removed once RenderFrameImpl and
134 // RenderFrameProxy have been completely decoupled. See
135 // https://crbug.com/357747.
136 RenderFrameImpl
* render_frame
=
137 RenderFrameImpl::FromRoutingID(frame_routing_id_
);
139 render_frame
->set_render_frame_proxy(nullptr);
141 render_view()->UnregisterRenderFrameProxy(this);
144 RenderThread::Get()->RemoveRoute(routing_id_
);
145 g_routing_id_proxy_map
.Get().erase(routing_id_
);
148 void RenderFrameProxy::Init(blink::WebRemoteFrame
* web_frame
,
149 RenderViewImpl
* render_view
) {
153 web_frame_
= web_frame
;
154 render_view_
= render_view
;
156 // TODO(nick): Should all RenderFrameProxies remain observers of their views?
157 render_view_
->RegisterRenderFrameProxy(this);
159 std::pair
<FrameMap::iterator
, bool> result
=
160 g_frame_map
.Get().insert(std::make_pair(web_frame_
, this));
161 CHECK(result
.second
) << "Inserted a duplicate item.";
164 bool RenderFrameProxy::IsMainFrameDetachedFromTree() const {
165 return web_frame_
->top() == web_frame_
&&
166 render_view_
->webview()->mainFrame()->isWebLocalFrame();
169 void RenderFrameProxy::DidCommitCompositorFrame() {
170 if (compositing_helper_
.get())
171 compositing_helper_
->DidCommitCompositorFrame();
174 void RenderFrameProxy::SetReplicatedState(const FrameReplicationState
& state
) {
176 web_frame_
->setReplicatedOrigin(state
.origin
);
177 web_frame_
->setReplicatedSandboxFlags(state
.sandbox_flags
);
178 web_frame_
->setReplicatedName(blink::WebString::fromUTF8(state
.name
));
181 // Update the proxy's SecurityContext and FrameOwner with new sandbox flags
182 // that were set by its parent in another process.
184 // Normally, when a frame's sandbox attribute is changed dynamically, the
185 // frame's FrameOwner is updated with the new sandbox flags right away, while
186 // the frame's SecurityContext is updated when the frame is navigated and the
187 // new sandbox flags take effect.
189 // Currently, there is no use case for a proxy's pending FrameOwner sandbox
190 // flags, so there's no message sent to proxies when the sandbox attribute is
191 // first updated. Instead, the update message is sent and this function is
192 // called when the new flags take effect, so that the proxy updates its
193 // SecurityContext. This is needed to ensure that sandbox flags are inherited
194 // properly if this proxy ever parents a local frame. The proxy's FrameOwner
195 // flags are also updated here with the caveat that the FrameOwner won't learn
196 // about updates to its flags until they take effect.
197 void RenderFrameProxy::OnDidUpdateSandboxFlags(blink::WebSandboxFlags flags
) {
198 web_frame_
->setReplicatedSandboxFlags(flags
);
199 web_frame_
->setFrameOwnerSandboxFlags(flags
);
202 bool RenderFrameProxy::OnMessageReceived(const IPC::Message
& msg
) {
204 IPC_BEGIN_MESSAGE_MAP(RenderFrameProxy
, msg
)
205 IPC_MESSAGE_HANDLER(FrameMsg_DeleteProxy
, OnDeleteProxy
)
206 IPC_MESSAGE_HANDLER(FrameMsg_ChildFrameProcessGone
, OnChildFrameProcessGone
)
207 IPC_MESSAGE_HANDLER_GENERIC(FrameMsg_CompositorFrameSwapped
,
208 OnCompositorFrameSwapped(msg
))
209 IPC_MESSAGE_HANDLER(FrameMsg_SetChildFrameSurface
, OnSetChildFrameSurface
)
210 IPC_MESSAGE_HANDLER(FrameMsg_DisownOpener
, OnDisownOpener
)
211 IPC_MESSAGE_HANDLER(FrameMsg_DidStartLoading
, OnDidStartLoading
)
212 IPC_MESSAGE_HANDLER(FrameMsg_DidStopLoading
, OnDidStopLoading
)
213 IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateSandboxFlags
, OnDidUpdateSandboxFlags
)
214 IPC_MESSAGE_HANDLER(FrameMsg_DispatchLoad
, OnDispatchLoad
)
215 IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateName
, OnDidUpdateName
)
216 IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateOrigin
, OnDidUpdateOrigin
)
217 IPC_MESSAGE_UNHANDLED(handled
= false)
218 IPC_END_MESSAGE_MAP()
220 // Note: If |handled| is true, |this| may have been deleted.
224 bool RenderFrameProxy::Send(IPC::Message
* message
) {
225 return RenderThread::Get()->Send(message
);
228 void RenderFrameProxy::OnDeleteProxy() {
229 DCHECK(web_frame_
->isWebRemoteFrame());
230 web_frame_
->detach();
233 void RenderFrameProxy::OnChildFrameProcessGone() {
234 if (compositing_helper_
.get())
235 compositing_helper_
->ChildFrameGone();
238 void RenderFrameProxy::OnCompositorFrameSwapped(const IPC::Message
& message
) {
239 // If this WebFrame has already been detached, its parent will be null. This
240 // can happen when swapping a WebRemoteFrame with a WebLocalFrame, where this
241 // message may arrive after the frame was removed from the frame tree, but
242 // before the frame has been destroyed. http://crbug.com/446575.
243 if (!web_frame()->parent())
246 FrameMsg_CompositorFrameSwapped::Param param
;
247 if (!FrameMsg_CompositorFrameSwapped::Read(&message
, ¶m
))
250 scoped_ptr
<cc::CompositorFrame
> frame(new cc::CompositorFrame
);
251 base::get
<0>(param
).frame
.AssignTo(frame
.get());
253 if (!compositing_helper_
.get()) {
254 compositing_helper_
=
255 ChildFrameCompositingHelper::CreateForRenderFrameProxy(this);
256 compositing_helper_
->EnableCompositing(true);
258 compositing_helper_
->OnCompositorFrameSwapped(
260 base::get
<0>(param
).producing_route_id
,
261 base::get
<0>(param
).output_surface_id
,
262 base::get
<0>(param
).producing_host_id
,
263 base::get
<0>(param
).shared_memory_handle
);
266 void RenderFrameProxy::OnSetChildFrameSurface(
267 const cc::SurfaceId
& surface_id
,
268 const gfx::Size
& frame_size
,
270 const cc::SurfaceSequence
& sequence
) {
271 // If this WebFrame has already been detached, its parent will be null. This
272 // can happen when swapping a WebRemoteFrame with a WebLocalFrame, where this
273 // message may arrive after the frame was removed from the frame tree, but
274 // before the frame has been destroyed. http://crbug.com/446575.
275 if (!web_frame()->parent())
278 if (!compositing_helper_
.get()) {
279 compositing_helper_
=
280 ChildFrameCompositingHelper::CreateForRenderFrameProxy(this);
281 compositing_helper_
->EnableCompositing(true);
283 compositing_helper_
->OnSetSurface(surface_id
, frame_size
, scale_factor
,
287 void RenderFrameProxy::OnDisownOpener() {
288 // TODO(creis): We should only see this for main frames for now. To support
289 // disowning the opener on subframes, we will need to move WebContentsImpl's
290 // opener_ to FrameTreeNode.
291 CHECK(!web_frame_
->parent());
293 // When there is a RenderFrame for this proxy, tell it to disown its opener.
294 // TODO(creis): Remove this when we only have WebRemoteFrames and make sure
295 // they know they have an opener.
296 if (!SiteIsolationPolicy::IsSwappedOutStateForbidden()) {
297 RenderFrameImpl
* render_frame
=
298 RenderFrameImpl::FromRoutingID(frame_routing_id_
);
300 if (render_frame
->GetWebFrame()->opener())
301 render_frame
->GetWebFrame()->setOpener(NULL
);
306 if (web_frame_
->opener())
307 web_frame_
->setOpener(NULL
);
310 void RenderFrameProxy::OnDidStartLoading() {
311 if (IsMainFrameDetachedFromTree())
314 web_frame_
->didStartLoading();
317 void RenderFrameProxy::OnDidStopLoading() {
318 if (IsMainFrameDetachedFromTree())
321 web_frame_
->didStopLoading();
324 void RenderFrameProxy::OnDispatchLoad() {
325 web_frame_
->DispatchLoadEventForFrameOwner();
328 void RenderFrameProxy::OnDidUpdateName(const std::string
& name
) {
329 web_frame_
->setReplicatedName(blink::WebString::fromUTF8(name
));
332 void RenderFrameProxy::OnDidUpdateOrigin(const url::Origin
& origin
) {
333 web_frame_
->setReplicatedOrigin(origin
);
336 void RenderFrameProxy::frameDetached(DetachType type
) {
337 if (type
== DetachType::Remove
&& web_frame_
->parent()) {
338 web_frame_
->parent()->removeChild(web_frame_
);
340 // Let the browser process know this subframe is removed, so that it is
341 // destroyed in its current process.
342 Send(new FrameHostMsg_Detach(routing_id_
));
347 // Remove the entry in the WebFrame->RenderFrameProxy map, as the |web_frame_|
348 // is no longer valid.
349 FrameMap::iterator it
= g_frame_map
.Get().find(web_frame_
);
350 CHECK(it
!= g_frame_map
.Get().end());
351 CHECK_EQ(it
->second
, this);
352 g_frame_map
.Get().erase(it
);
354 web_frame_
= nullptr;
359 void RenderFrameProxy::postMessageEvent(
360 blink::WebLocalFrame
* source_frame
,
361 blink::WebRemoteFrame
* target_frame
,
362 blink::WebSecurityOrigin target_origin
,
363 blink::WebDOMMessageEvent event
) {
364 DCHECK(!web_frame_
|| web_frame_
== target_frame
);
366 FrameMsg_PostMessage_Params params
;
367 params
.is_data_raw_string
= false;
368 params
.data
= event
.data().toString();
369 params
.source_origin
= event
.origin();
370 if (!target_origin
.isNull())
371 params
.target_origin
= target_origin
.toString();
373 params
.message_ports
=
374 WebMessagePortChannelImpl::ExtractMessagePortIDs(event
.releaseChannels());
376 // Include the routing ID for the source frame (if one exists), which the
377 // browser process will translate into the routing ID for the equivalent
378 // frame in the target process.
379 params
.source_routing_id
= MSG_ROUTING_NONE
;
381 RenderFrameImpl
* source_render_frame
=
382 RenderFrameImpl::FromWebFrame(source_frame
);
383 if (source_render_frame
)
384 params
.source_routing_id
= source_render_frame
->GetRoutingID();
386 params
.source_view_routing_id
= MSG_ROUTING_NONE
;
388 Send(new FrameHostMsg_RouteMessageEvent(routing_id_
, params
));
391 void RenderFrameProxy::initializeChildFrame(
392 const blink::WebRect
& frame_rect
,
393 float scale_factor
) {
394 Send(new FrameHostMsg_InitializeChildFrame(
395 routing_id_
, frame_rect
, scale_factor
));
398 void RenderFrameProxy::navigate(const blink::WebURLRequest
& request
,
399 bool should_replace_current_entry
) {
400 FrameHostMsg_OpenURL_Params params
;
401 params
.url
= request
.url();
402 params
.referrer
= Referrer(
403 GURL(request
.httpHeaderField(blink::WebString::fromUTF8("Referer"))),
404 request
.referrerPolicy());
405 params
.disposition
= CURRENT_TAB
;
406 params
.should_replace_current_entry
= should_replace_current_entry
;
407 params
.user_gesture
=
408 blink::WebUserGestureIndicator::isProcessingUserGesture();
409 blink::WebUserGestureIndicator::consumeUserGesture();
410 Send(new FrameHostMsg_OpenURL(routing_id_
, params
));
413 void RenderFrameProxy::forwardInputEvent(const blink::WebInputEvent
* event
) {
414 Send(new FrameHostMsg_ForwardInputEvent(routing_id_
, event
));