content/renderer/render_frame_proxy.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/renderer/render_frame_proxy.h"
   6
   7 #include <map>
   8
   9 #include "base/command_line.h"
  10 #include "base/lazy_instance.h"
  11 #include "content/child/webmessageportchannel_impl.h"
  12 #include "content/common/frame_messages.h"
  13 #include "content/common/frame_replication_state.h"
  14 #include "content/common/site_isolation_policy.h"
  15 #include "content/common/swapped_out_messages.h"
  16 #include "content/common/view_messages.h"
  17 #include "content/renderer/child_frame_compositing_helper.h"
  18 #include "content/renderer/render_frame_impl.h"
  19 #include "content/renderer/render_thread_impl.h"
  20 #include "content/renderer/render_view_impl.h"
  21 #include "third_party/WebKit/public/platform/WebString.h"
  22 #include "third_party/WebKit/public/web/WebLocalFrame.h"
  23 #include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
  24 #include "third_party/WebKit/public/web/WebView.h"
  25
  26 namespace content {
  27
  28 namespace {
  29
  30 // Facilitates lookup of RenderFrameProxy by routing_id.
  31 typedef std::map<int, RenderFrameProxy*> RoutingIDProxyMap;
  32 static base::LazyInstance<RoutingIDProxyMap> g_routing_id_proxy_map =
  33     LAZY_INSTANCE_INITIALIZER;
  34
  35 // Facilitates lookup of RenderFrameProxy by WebFrame.
  36 typedef std::map<blink::WebFrame*, RenderFrameProxy*> FrameMap;
  37 base::LazyInstance<FrameMap> g_frame_map = LAZY_INSTANCE_INITIALIZER;
  38
  39 }  // namespace
  40
  41 // static
  42 RenderFrameProxy* RenderFrameProxy::CreateProxyToReplaceFrame(
  43     RenderFrameImpl* frame_to_replace,
  44     int routing_id,
  45     blink::WebTreeScopeType scope) {
  46   CHECK_NE(routing_id, MSG_ROUTING_NONE);
  47
  48   scoped_ptr<RenderFrameProxy> proxy(
  49       new RenderFrameProxy(routing_id, frame_to_replace->GetRoutingID()));
  50
  51   // When a RenderFrame is replaced by a RenderProxy, the WebRemoteFrame should
  52   // always come from WebRemoteFrame::create and a call to WebFrame::swap must
  53   // follow later.
  54   blink::WebRemoteFrame* web_frame =
  55       blink::WebRemoteFrame::create(scope, proxy.get());
  56   proxy->Init(web_frame, frame_to_replace->render_view());
  57   return proxy.release();
  58 }
  59
  60 RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
  61     int routing_id,
  62     int render_view_routing_id,
  63     int opener_routing_id,
  64     int parent_routing_id,
  65     const FrameReplicationState& replicated_state) {
  66   scoped_ptr<RenderFrameProxy> proxy(
  67       new RenderFrameProxy(routing_id, MSG_ROUTING_NONE));
  68   RenderViewImpl* render_view = NULL;
  69   blink::WebRemoteFrame* web_frame = NULL;
  70   if (parent_routing_id == MSG_ROUTING_NONE) {
  71     // Create a top level WebRemoteFrame.
  72     render_view = RenderViewImpl::FromRoutingID(render_view_routing_id);
  73     web_frame =
  74         blink::WebRemoteFrame::create(replicated_state.scope, proxy.get());
  75     render_view->webview()->setMainFrame(web_frame);
  76   } else {
  77     // Create a frame under an existing parent. The parent is always expected
  78     // to be a RenderFrameProxy, because navigations initiated by local frames
  79     // should not wind up here.
  80     RenderFrameProxy* parent =
  81         RenderFrameProxy::FromRoutingID(parent_routing_id);
  82     web_frame = parent->web_frame()->createRemoteChild(
  83         replicated_state.scope,
  84         blink::WebString::fromUTF8(replicated_state.name),
  85         replicated_state.sandbox_flags, proxy.get());
  86     render_view = parent->render_view();
  87   }
  88
  89   blink::WebFrame* opener =
  90       RenderFrameImpl::ResolveOpener(opener_routing_id, nullptr);
  91   web_frame->setOpener(opener);
  92
  93   proxy->Init(web_frame, render_view);
  94
  95   // Initialize proxy's WebRemoteFrame with the security origin and other
  96   // replicated information.
  97   // TODO(dcheng): Calling this when parent_routing_id != MSG_ROUTING_NONE is
  98   // mostly redundant, since we already pass the name and sandbox flags in
  99   // createLocalChild(). We should update the Blink interface so it also takes
 100   // the origin. Then it will be clear that the replication call is only needed
 101   // for the case of setting up a main frame proxy.
 102   proxy->SetReplicatedState(replicated_state);
 103
 104   return proxy.release();
 105 }
 106
 107 // static
 108 RenderFrameProxy* RenderFrameProxy::FromRoutingID(int32 routing_id) {
 109   RoutingIDProxyMap* proxies = g_routing_id_proxy_map.Pointer();
 110   RoutingIDProxyMap::iterator it = proxies->find(routing_id);
 111   return it == proxies->end() ? NULL : it->second;
 112 }
 113
 114 // static
 115 RenderFrameProxy* RenderFrameProxy::FromWebFrame(blink::WebFrame* web_frame) {
 116   FrameMap::iterator iter = g_frame_map.Get().find(web_frame);
 117   if (iter != g_frame_map.Get().end()) {
 118     RenderFrameProxy* proxy = iter->second;
 119     DCHECK_EQ(web_frame, proxy->web_frame());
 120     return proxy;
 121   }
 122   return NULL;
 123 }
 124
 125 RenderFrameProxy::RenderFrameProxy(int routing_id, int frame_routing_id)
 126     : routing_id_(routing_id),
 127       frame_routing_id_(frame_routing_id),
 128       web_frame_(NULL),
 129       render_view_(NULL) {
 130   std::pair<RoutingIDProxyMap::iterator, bool> result =
 131       g_routing_id_proxy_map.Get().insert(std::make_pair(routing_id_, this));
 132   CHECK(result.second) << "Inserting a duplicate item.";
 133   RenderThread::Get()->AddRoute(routing_id_, this);
 134 }
 135
 136 RenderFrameProxy::~RenderFrameProxy() {
 137   // TODO(nasko): Set the render_frame_proxy to null to avoid a double deletion
 138   // when detaching the main frame. This can be removed once RenderFrameImpl and
 139   // RenderFrameProxy have been completely decoupled. See
 140   // https://crbug.com/357747.
 141   RenderFrameImpl* render_frame =
 142       RenderFrameImpl::FromRoutingID(frame_routing_id_);
 143   if (render_frame)
 144     render_frame->set_render_frame_proxy(nullptr);
 145
 146   render_view()->UnregisterRenderFrameProxy(this);
 147
 148   CHECK(!web_frame_);
 149   RenderThread::Get()->RemoveRoute(routing_id_);
 150   g_routing_id_proxy_map.Get().erase(routing_id_);
 151 }
 152
 153 void RenderFrameProxy::Init(blink::WebRemoteFrame* web_frame,
 154                             RenderViewImpl* render_view) {
 155   CHECK(web_frame);
 156   CHECK(render_view);
 157
 158   web_frame_ = web_frame;
 159   render_view_ = render_view;
 160
 161   // TODO(nick): Should all RenderFrameProxies remain observers of their views?
 162   render_view_->RegisterRenderFrameProxy(this);
 163
 164   std::pair<FrameMap::iterator, bool> result =
 165       g_frame_map.Get().insert(std::make_pair(web_frame_, this));
 166   CHECK(result.second) << "Inserted a duplicate item.";
 167 }
 168
 169 bool RenderFrameProxy::IsMainFrameDetachedFromTree() const {
 170   return web_frame_->top() == web_frame_ &&
 171       render_view_->webview()->mainFrame()->isWebLocalFrame();
 172 }
 173
 174 void RenderFrameProxy::DidCommitCompositorFrame() {
 175   if (compositing_helper_.get())
 176     compositing_helper_->DidCommitCompositorFrame();
 177 }
 178
 179 void RenderFrameProxy::SetReplicatedState(const FrameReplicationState& state) {
 180   DCHECK(web_frame_);
 181   web_frame_->setReplicatedOrigin(state.origin);
 182   web_frame_->setReplicatedSandboxFlags(state.sandbox_flags);
 183   web_frame_->setReplicatedName(blink::WebString::fromUTF8(state.name));
 184 }
 185
 186 // Update the proxy's SecurityContext and FrameOwner with new sandbox flags
 187 // that were set by its parent in another process.
 188 //
 189 // Normally, when a frame's sandbox attribute is changed dynamically, the
 190 // frame's FrameOwner is updated with the new sandbox flags right away, while
 191 // the frame's SecurityContext is updated when the frame is navigated and the
 192 // new sandbox flags take effect.
 193 //
 194 // Currently, there is no use case for a proxy's pending FrameOwner sandbox
 195 // flags, so there's no message sent to proxies when the sandbox attribute is
 196 // first updated.  Instead, the update message is sent and this function is
 197 // called when the new flags take effect, so that the proxy updates its
 198 // SecurityContext. This is needed to ensure that sandbox flags are inherited
 199 // properly if this proxy ever parents a local frame.  The proxy's FrameOwner
 200 // flags are also updated here with the caveat that the FrameOwner won't learn
 201 // about updates to its flags until they take effect.
 202 void RenderFrameProxy::OnDidUpdateSandboxFlags(blink::WebSandboxFlags flags) {
 203   web_frame_->setReplicatedSandboxFlags(flags);
 204   web_frame_->setFrameOwnerSandboxFlags(flags);
 205 }
 206
 207 bool RenderFrameProxy::OnMessageReceived(const IPC::Message& msg) {
 208   bool handled = true;
 209   IPC_BEGIN_MESSAGE_MAP(RenderFrameProxy, msg)
 210     IPC_MESSAGE_HANDLER(FrameMsg_DeleteProxy, OnDeleteProxy)
 211     IPC_MESSAGE_HANDLER(FrameMsg_ChildFrameProcessGone, OnChildFrameProcessGone)
 212     IPC_MESSAGE_HANDLER_GENERIC(FrameMsg_CompositorFrameSwapped,
 213                                 OnCompositorFrameSwapped(msg))
 214     IPC_MESSAGE_HANDLER(FrameMsg_SetChildFrameSurface, OnSetChildFrameSurface)
 215     IPC_MESSAGE_HANDLER(FrameMsg_UpdateOpener, OnUpdateOpener)
 216     IPC_MESSAGE_HANDLER(FrameMsg_DidStartLoading, OnDidStartLoading)
 217     IPC_MESSAGE_HANDLER(FrameMsg_DidStopLoading, OnDidStopLoading)
 218     IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateSandboxFlags, OnDidUpdateSandboxFlags)
 219     IPC_MESSAGE_HANDLER(FrameMsg_DispatchLoad, OnDispatchLoad)
 220     IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateName, OnDidUpdateName)
 221     IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateOrigin, OnDidUpdateOrigin)
 222     IPC_MESSAGE_UNHANDLED(handled = false)
 223   IPC_END_MESSAGE_MAP()
 224
 225   // Note: If |handled| is true, |this| may have been deleted.
 226   return handled;
 227 }
 228
 229 bool RenderFrameProxy::Send(IPC::Message* message) {
 230   return RenderThread::Get()->Send(message);
 231 }
 232
 233 void RenderFrameProxy::OnDeleteProxy() {
 234   DCHECK(web_frame_->isWebRemoteFrame());
 235   web_frame_->detach();
 236 }
 237
 238 void RenderFrameProxy::OnChildFrameProcessGone() {
 239   if (compositing_helper_.get())
 240     compositing_helper_->ChildFrameGone();
 241 }
 242
 243 void RenderFrameProxy::OnCompositorFrameSwapped(const IPC::Message& message) {
 244   // If this WebFrame has already been detached, its parent will be null. This
 245   // can happen when swapping a WebRemoteFrame with a WebLocalFrame, where this
 246   // message may arrive after the frame was removed from the frame tree, but
 247   // before the frame has been destroyed. http://crbug.com/446575.
 248   if (!web_frame()->parent())
 249     return;
 250
 251   FrameMsg_CompositorFrameSwapped::Param param;
 252   if (!FrameMsg_CompositorFrameSwapped::Read(&message, &param))
 253     return;
 254
 255   scoped_ptr<cc::CompositorFrame> frame(new cc::CompositorFrame);
 256   base::get<0>(param).frame.AssignTo(frame.get());
 257
 258   if (!compositing_helper_.get()) {
 259     compositing_helper_ =
 260         ChildFrameCompositingHelper::CreateForRenderFrameProxy(this);
 261     compositing_helper_->EnableCompositing(true);
 262   }
 263   compositing_helper_->OnCompositorFrameSwapped(
 264       frame.Pass(),
 265       base::get<0>(param).producing_route_id,
 266       base::get<0>(param).output_surface_id,
 267       base::get<0>(param).producing_host_id,
 268       base::get<0>(param).shared_memory_handle);
 269 }
 270
 271 void RenderFrameProxy::OnSetChildFrameSurface(
 272     const cc::SurfaceId& surface_id,
 273     const gfx::Size& frame_size,
 274     float scale_factor,
 275     const cc::SurfaceSequence& sequence) {
 276   // If this WebFrame has already been detached, its parent will be null. This
 277   // can happen when swapping a WebRemoteFrame with a WebLocalFrame, where this
 278   // message may arrive after the frame was removed from the frame tree, but
 279   // before the frame has been destroyed. http://crbug.com/446575.
 280   if (!web_frame()->parent())
 281     return;
 282
 283   if (!compositing_helper_.get()) {
 284     compositing_helper_ =
 285         ChildFrameCompositingHelper::CreateForRenderFrameProxy(this);
 286     compositing_helper_->EnableCompositing(true);
 287   }
 288   compositing_helper_->OnSetSurface(surface_id, frame_size, scale_factor,
 289                                     sequence);
 290 }
 291
 292 void RenderFrameProxy::OnUpdateOpener(int opener_routing_id) {
 293   blink::WebFrame* opener =
 294       RenderFrameImpl::ResolveOpener(opener_routing_id, nullptr);
 295
 296   // When there is a RenderFrame for this proxy, tell it to update its opener.
 297   // TODO(alexmos, nasko): Remove this when we only have WebRemoteFrames.
 298   if (!SiteIsolationPolicy::IsSwappedOutStateForbidden()) {
 299     RenderFrameImpl* render_frame =
 300         RenderFrameImpl::FromRoutingID(frame_routing_id_);
 301     if (render_frame) {
 302       render_frame->GetWebFrame()->setOpener(opener);
 303       return;
 304     }
 305   }
 306
 307   web_frame_->setOpener(opener);
 308 }
 309
 310 void RenderFrameProxy::OnDidStartLoading() {
 311   if (IsMainFrameDetachedFromTree())
 312     return;
 313
 314   web_frame_->didStartLoading();
 315 }
 316
 317 void RenderFrameProxy::OnDidStopLoading() {
 318   if (IsMainFrameDetachedFromTree())
 319     return;
 320
 321   web_frame_->didStopLoading();
 322 }
 323
 324 void RenderFrameProxy::OnDispatchLoad() {
 325   web_frame_->DispatchLoadEventForFrameOwner();
 326 }
 327
 328 void RenderFrameProxy::OnDidUpdateName(const std::string& name) {
 329   web_frame_->setReplicatedName(blink::WebString::fromUTF8(name));
 330 }
 331
 332 void RenderFrameProxy::OnDidUpdateOrigin(const url::Origin& origin) {
 333   web_frame_->setReplicatedOrigin(origin);
 334 }
 335
 336 void RenderFrameProxy::frameDetached(DetachType type) {
 337   if (type == DetachType::Remove && web_frame_->parent()) {
 338     web_frame_->parent()->removeChild(web_frame_);
 339
 340     // Let the browser process know this subframe is removed, so that it is
 341     // destroyed in its current process.
 342     Send(new FrameHostMsg_Detach(routing_id_));
 343   }
 344
 345   web_frame_->close();
 346
 347   // Remove the entry in the WebFrame->RenderFrameProxy map, as the |web_frame_|
 348   // is no longer valid.
 349   FrameMap::iterator it = g_frame_map.Get().find(web_frame_);
 350   CHECK(it != g_frame_map.Get().end());
 351   CHECK_EQ(it->second, this);
 352   g_frame_map.Get().erase(it);
 353
 354   web_frame_ = nullptr;
 355
 356   delete this;
 357 }
 358
 359 void RenderFrameProxy::postMessageEvent(
 360     blink::WebLocalFrame* source_frame,
 361     blink::WebRemoteFrame* target_frame,
 362     blink::WebSecurityOrigin target_origin,
 363     blink::WebDOMMessageEvent event) {
 364   DCHECK(!web_frame_ || web_frame_ == target_frame);
 365
 366   FrameMsg_PostMessage_Params params;
 367   params.is_data_raw_string = false;
 368   params.data = event.data().toString();
 369   params.source_origin = event.origin();
 370   if (!target_origin.isNull())
 371     params.target_origin = target_origin.toString();
 372
 373   params.message_ports =
 374       WebMessagePortChannelImpl::ExtractMessagePortIDs(event.releaseChannels());
 375
 376   // Include the routing ID for the source frame (if one exists), which the
 377   // browser process will translate into the routing ID for the equivalent
 378   // frame in the target process.
 379   params.source_routing_id = MSG_ROUTING_NONE;
 380   if (source_frame) {
 381     RenderFrameImpl* source_render_frame =
 382         RenderFrameImpl::FromWebFrame(source_frame);
 383     if (source_render_frame)
 384       params.source_routing_id = source_render_frame->GetRoutingID();
 385   }
 386
 387   Send(new FrameHostMsg_RouteMessageEvent(routing_id_, params));
 388 }
 389
 390 void RenderFrameProxy::initializeChildFrame(
 391     const blink::WebRect& frame_rect,
 392     float scale_factor) {
 393   Send(new FrameHostMsg_InitializeChildFrame(
 394       routing_id_, frame_rect, scale_factor));
 395 }
 396
 397 void RenderFrameProxy::navigate(const blink::WebURLRequest& request,
 398                                 bool should_replace_current_entry) {
 399   FrameHostMsg_OpenURL_Params params;
 400   params.url = request.url();
 401   params.referrer = Referrer(
 402       GURL(request.httpHeaderField(blink::WebString::fromUTF8("Referer"))),
 403       request.referrerPolicy());
 404   params.disposition = CURRENT_TAB;
 405   params.should_replace_current_entry = should_replace_current_entry;
 406   params.user_gesture =
 407       blink::WebUserGestureIndicator::isProcessingUserGesture();
 408   blink::WebUserGestureIndicator::consumeUserGesture();
 409   Send(new FrameHostMsg_OpenURL(routing_id_, params));
 410 }
 411
 412 void RenderFrameProxy::forwardInputEvent(const blink::WebInputEvent* event) {
 413   Send(new FrameHostMsg_ForwardInputEvent(routing_id_, event));
 414 }
 415
 416 void RenderFrameProxy::frameRectsChanged(const blink::WebRect& frame_rect) {
 417   Send(new FrameHostMsg_FrameRectChanged(routing_id_, frame_rect));
 418 }
 419
 420 void RenderFrameProxy::didChangeOpener(blink::WebFrame* opener) {
 421   // A proxy shouldn't normally be disowning its opener.  It is possible to get
 422   // here when a proxy that is being detached clears its opener, in which case
 423   // there is no need to notify the browser process.
 424   if (!opener)
 425     return;
 426
 427   // Only a LocalFrame (i.e., the caller of window.open) should be able to
 428   // update another frame's opener.
 429   DCHECK(opener->isWebLocalFrame());
 430
 431   int opener_routing_id =
 432       RenderFrameImpl::FromWebFrame(opener->toWebLocalFrame())->GetRoutingID();
 433   Send(new FrameHostMsg_DidChangeOpener(routing_id_, opener_routing_id));
 434 }
 435
 436 }  // namespace