content/renderer/render_frame_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/renderer/render_frame_impl.h"
   6
   7 #include <map>
   8 #include <string>
   9
  10 #include "base/auto_reset.h"
  11 #include "base/command_line.h"
  12 #include "base/debug/alias.h"
  13 #include "base/debug/asan_invalid_access.h"
  14 #include "base/debug/dump_without_crashing.h"
  15 #include "base/i18n/char_iterator.h"
  16 #include "base/metrics/histogram.h"
  17 #include "base/process/process.h"
  18 #include "base/strings/string16.h"
  19 #include "base/strings/utf_string_conversions.h"
  20 #include "base/thread_task_runner_handle.h"
  21 #include "base/time/time.h"
  22 #include "cc/base/switches.h"
  23 #include "components/scheduler/renderer/renderer_scheduler.h"
  24 #include "content/child/appcache/appcache_dispatcher.h"
  25 #include "content/child/permissions/permission_dispatcher.h"
  26 #include "content/child/plugin_messages.h"
  27 #include "content/child/quota_dispatcher.h"
  28 #include "content/child/request_extra_data.h"
  29 #include "content/child/service_worker/service_worker_handle_reference.h"
  30 #include "content/child/service_worker/service_worker_network_provider.h"
  31 #include "content/child/service_worker/service_worker_provider_context.h"
  32 #include "content/child/service_worker/web_service_worker_provider_impl.h"
  33 #include "content/child/v8_value_converter_impl.h"
  34 #include "content/child/web_url_loader_impl.h"
  35 #include "content/child/web_url_request_util.h"
  36 #include "content/child/webmessageportchannel_impl.h"
  37 #include "content/child/websocket_bridge.h"
  38 #include "content/child/weburlresponse_extradata_impl.h"
  39 #include "content/common/accessibility_messages.h"
  40 #include "content/common/clipboard_messages.h"
  41 #include "content/common/frame_messages.h"
  42 #include "content/common/frame_replication_state.h"
  43 #include "content/common/input_messages.h"
  44 #include "content/common/navigation_params.h"
  45 #include "content/common/service_worker/service_worker_types.h"
  46 #include "content/common/site_isolation_policy.h"
  47 #include "content/common/swapped_out_messages.h"
  48 #include "content/common/view_messages.h"
  49 #include "content/public/common/bindings_policy.h"
  50 #include "content/public/common/content_constants.h"
  51 #include "content/public/common/content_switches.h"
  52 #include "content/public/common/context_menu_params.h"
  53 #include "content/public/common/isolated_world_ids.h"
  54 #include "content/public/common/page_state.h"
  55 #include "content/public/common/resource_response.h"
  56 #include "content/public/common/url_constants.h"
  57 #include "content/public/common/url_utils.h"
  58 #include "content/public/renderer/browser_plugin_delegate.h"
  59 #include "content/public/renderer/content_renderer_client.h"
  60 #include "content/public/renderer/context_menu_client.h"
  61 #include "content/public/renderer/document_state.h"
  62 #include "content/public/renderer/navigation_state.h"
  63 #include "content/public/renderer/render_frame_observer.h"
  64 #include "content/public/renderer/renderer_ppapi_host.h"
  65 #include "content/renderer/accessibility/renderer_accessibility.h"
  66 #include "content/renderer/bluetooth/web_bluetooth_impl.h"
  67 #include "content/renderer/browser_plugin/browser_plugin.h"
  68 #include "content/renderer/browser_plugin/browser_plugin_manager.h"
  69 #include "content/renderer/child_frame_compositing_helper.h"
  70 #include "content/renderer/context_menu_params_builder.h"
  71 #include "content/renderer/devtools/devtools_agent.h"
  72 #include "content/renderer/dom_automation_controller.h"
  73 #include "content/renderer/external_popup_menu.h"
  74 #include "content/renderer/geolocation_dispatcher.h"
  75 #include "content/renderer/gpu/gpu_benchmarking_extension.h"
  76 #include "content/renderer/history_controller.h"
  77 #include "content/renderer/history_serialization.h"
  78 #include "content/renderer/image_downloader/image_downloader_impl.h"
  79 #include "content/renderer/ime_event_guard.h"
  80 #include "content/renderer/internal_document_state_data.h"
  81 #include "content/renderer/manifest/manifest_manager.h"
  82 #include "content/renderer/media/audio_renderer_mixer_manager.h"
  83 #include "content/renderer/media/crypto/render_cdm_factory.h"
  84 #include "content/renderer/media/media_permission_dispatcher.h"
  85 #include "content/renderer/media/media_stream_dispatcher.h"
  86 #include "content/renderer/media/media_stream_renderer_factory_impl.h"
  87 #include "content/renderer/media/midi_dispatcher.h"
  88 #include "content/renderer/media/render_media_log.h"
  89 #include "content/renderer/media/user_media_client_impl.h"
  90 #include "content/renderer/media/webmediaplayer_ms.h"
  91 #include "content/renderer/memory_benchmarking_extension.h"
  92 #include "content/renderer/mojo/service_registry_js_wrapper.h"
  93 #include "content/renderer/navigation_state_impl.h"
  94 #include "content/renderer/notification_permission_dispatcher.h"
  95 #include "content/renderer/npapi/plugin_channel_host.h"
  96 #include "content/renderer/pepper/plugin_instance_throttler_impl.h"
  97 #include "content/renderer/presentation/presentation_dispatcher.h"
  98 #include "content/renderer/push_messaging/push_messaging_dispatcher.h"
  99 #include "content/renderer/render_frame_proxy.h"
 100 #include "content/renderer/render_process.h"
 101 #include "content/renderer/render_thread_impl.h"
 102 #include "content/renderer/render_view_impl.h"
 103 #include "content/renderer/render_widget_fullscreen_pepper.h"
 104 #include "content/renderer/renderer_webapplicationcachehost_impl.h"
 105 #include "content/renderer/renderer_webcolorchooser_impl.h"
 106 #include "content/renderer/screen_orientation/screen_orientation_dispatcher.h"
 107 #include "content/renderer/shared_worker_repository.h"
 108 #include "content/renderer/skia_benchmarking_extension.h"
 109 #include "content/renderer/stats_collection_controller.h"
 110 #include "content/renderer/web_ui_extension.h"
 111 #include "content/renderer/websharedworker_proxy.h"
 112 #include "gin/modules/module_registry.h"
 113 #include "media/base/audio_renderer_mixer_input.h"
 114 #include "media/base/media_log.h"
 115 #include "media/blink/webencryptedmediaclient_impl.h"
 116 #include "media/blink/webmediaplayer_impl.h"
 117 #include "media/renderers/gpu_video_accelerator_factories.h"
 118 #include "mojo/common/url_type_converters.h"
 119 #include "net/base/data_url.h"
 120 #include "net/base/net_errors.h"
 121 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 122 #include "net/http/http_util.h"
 123 #include "third_party/WebKit/public/platform/WebStorageQuotaCallbacks.h"
 124 #include "third_party/WebKit/public/platform/WebString.h"
 125 #include "third_party/WebKit/public/platform/WebURL.h"
 126 #include "third_party/WebKit/public/platform/WebURLError.h"
 127 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 128 #include "third_party/WebKit/public/platform/WebVector.h"
 129 #include "third_party/WebKit/public/platform/modules/webusb/WebUSBClient.h"
 130 #include "third_party/WebKit/public/web/WebColorSuggestion.h"
 131 #include "third_party/WebKit/public/web/WebDocument.h"
 132 #include "third_party/WebKit/public/web/WebFrameWidget.h"
 133 #include "third_party/WebKit/public/web/WebGlyphCache.h"
 134 #include "third_party/WebKit/public/web/WebKit.h"
 135 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 136 #include "third_party/WebKit/public/web/WebMediaStreamRegistry.h"
 137 #include "third_party/WebKit/public/web/WebNavigationPolicy.h"
 138 #include "third_party/WebKit/public/web/WebPlugin.h"
 139 #include "third_party/WebKit/public/web/WebPluginParams.h"
 140 #include "third_party/WebKit/public/web/WebRange.h"
 141 #include "third_party/WebKit/public/web/WebScopedUserGesture.h"
 142 #include "third_party/WebKit/public/web/WebScriptSource.h"
 143 #include "third_party/WebKit/public/web/WebSearchableFormData.h"
 144 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 145 #include "third_party/WebKit/public/web/WebSecurityPolicy.h"
 146 #include "third_party/WebKit/public/web/WebSerializedScriptValue.h"
 147 #include "third_party/WebKit/public/web/WebSettings.h"
 148 #include "third_party/WebKit/public/web/WebSurroundingText.h"
 149 #include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
 150 #include "third_party/WebKit/public/web/WebView.h"
 151 #include "third_party/mojo/src/mojo/edk/js/core.h"
 152 #include "third_party/mojo/src/mojo/edk/js/support.h"
 153 #include "url/url_util.h"
 154
 155 #if defined(ENABLE_PLUGINS)
 156 #include "content/renderer/npapi/webplugin_impl.h"
 157 #include "content/renderer/pepper/pepper_browser_connection.h"
 158 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 159 #include "content/renderer/pepper/pepper_webplugin_impl.h"
 160 #include "content/renderer/pepper/plugin_module.h"
 161 #endif
 162
 163 #if defined(ENABLE_WEBRTC)
 164 #include "content/renderer/media/rtc_peer_connection_handler.h"
 165 #endif
 166
 167 #if defined(OS_ANDROID)
 168 #include <cpu-features.h>
 169
 170 #include "content/common/gpu/client/context_provider_command_buffer.h"
 171 #include "content/renderer/android/synchronous_compositor_factory.h"
 172 #include "content/renderer/java/gin_java_bridge_dispatcher.h"
 173 #include "content/renderer/media/android/renderer_media_player_manager.h"
 174 #include "content/renderer/media/android/stream_texture_factory_impl.h"
 175 #include "content/renderer/media/android/webmediaplayer_android.h"
 176 #else
 177 #include "cc/blink/context_provider_web_context.h"
 178 #include "content/renderer/usb/web_usb_client_impl.h"
 179 #include "device/devices_app/public/cpp/constants.h"
 180 #endif
 181
 182 #if defined(ENABLE_PEPPER_CDMS)
 183 #include "content/renderer/media/crypto/pepper_cdm_wrapper_impl.h"
 184 #elif defined(ENABLE_BROWSER_CDMS)
 185 #include "content/renderer/media/crypto/renderer_cdm_manager.h"
 186 #endif
 187
 188 #if defined(ENABLE_MOJO_MEDIA)
 189 #include "media/mojo/services/mojo_cdm_factory.h"
 190 #include "media/mojo/services/mojo_renderer_factory.h"
 191 #include "mojo/application/public/cpp/connect.h"
 192 #include "mojo/application/public/interfaces/shell.mojom.h"
 193 #include "third_party/mojo/src/mojo/public/cpp/bindings/interface_request.h"
 194 #else
 195 #include "media/renderers/default_renderer_factory.h"
 196 #endif
 197
 198 #if defined(ENABLE_WEBVR)
 199 #include "content/renderer/vr/vr_dispatcher.h"
 200 #endif
 201
 202 using blink::WebContentDecryptionModule;
 203 using blink::WebContextMenuData;
 204 using blink::WebData;
 205 using blink::WebDataSource;
 206 using blink::WebDocument;
 207 using blink::WebDOMEvent;
 208 using blink::WebDOMMessageEvent;
 209 using blink::WebElement;
 210 using blink::WebExternalPopupMenu;
 211 using blink::WebExternalPopupMenuClient;
 212 using blink::WebFrame;
 213 using blink::WebHistoryItem;
 214 using blink::WebHTTPBody;
 215 using blink::WebLocalFrame;
 216 using blink::WebMediaPlayer;
 217 using blink::WebMediaPlayerClient;
 218 using blink::WebMediaPlayerEncryptedMediaClient;
 219 using blink::WebNavigationPolicy;
 220 using blink::WebNavigationType;
 221 using blink::WebNode;
 222 using blink::WebPluginParams;
 223 using blink::WebPopupMenuInfo;
 224 using blink::WebRange;
 225 using blink::WebReferrerPolicy;
 226 using blink::WebScriptSource;
 227 using blink::WebSearchableFormData;
 228 using blink::WebSecurityOrigin;
 229 using blink::WebSecurityPolicy;
 230 using blink::WebSerializedScriptValue;
 231 using blink::WebServiceWorkerProvider;
 232 using blink::WebSettings;
 233 using blink::WebStorageQuotaCallbacks;
 234 using blink::WebString;
 235 using blink::WebURL;
 236 using blink::WebURLError;
 237 using blink::WebURLRequest;
 238 using blink::WebURLResponse;
 239 using blink::WebUserGestureIndicator;
 240 using blink::WebVector;
 241 using blink::WebView;
 242 using base::Time;
 243 using base::TimeDelta;
 244
 245 namespace content {
 246
 247 namespace {
 248
 249 const char kDefaultAcceptHeader[] =
 250     "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/"
 251     "*;q=0.8";
 252 const char kAcceptHeader[] = "Accept";
 253
 254 const size_t kExtraCharsBeforeAndAfterSelection = 100;
 255
 256 typedef std::map<int, RenderFrameImpl*> RoutingIDFrameMap;
 257 static base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
 258     LAZY_INSTANCE_INITIALIZER;
 259
 260 typedef std::map<blink::WebFrame*, RenderFrameImpl*> FrameMap;
 261 base::LazyInstance<FrameMap> g_frame_map = LAZY_INSTANCE_INITIALIZER;
 262
 263 int64 ExtractPostId(HistoryEntry* entry) {
 264   if (!entry)
 265     return -1;
 266
 267   const WebHistoryItem& item = entry->root();
 268   if (item.isNull() || item.httpBody().isNull())
 269     return -1;
 270
 271   return item.httpBody().identifier();
 272 }
 273
 274 WebURLResponseExtraDataImpl* GetExtraDataFromResponse(
 275     const WebURLResponse& response) {
 276   return static_cast<WebURLResponseExtraDataImpl*>(response.extraData());
 277 }
 278
 279 void GetRedirectChain(WebDataSource* ds, std::vector<GURL>* result) {
 280   // Replace any occurrences of swappedout:// with about:blank.
 281   const WebURL& blank_url = GURL(url::kAboutBlankURL);
 282   WebVector<WebURL> urls;
 283   ds->redirectChain(urls);
 284   result->reserve(urls.size());
 285   for (size_t i = 0; i < urls.size(); ++i) {
 286     if (urls[i] != GURL(kSwappedOutURL))
 287       result->push_back(urls[i]);
 288     else
 289       result->push_back(blank_url);
 290   }
 291 }
 292
 293 // Returns the original request url. If there is no redirect, the original
 294 // url is the same as ds->request()->url(). If the WebDataSource belongs to a
 295 // frame was loaded by loadData, the original url will be ds->unreachableURL()
 296 GURL GetOriginalRequestURL(WebDataSource* ds) {
 297   // WebDataSource has unreachable URL means that the frame is loaded through
 298   // blink::WebFrame::loadData(), and the base URL will be in the redirect
 299   // chain. However, we never visited the baseURL. So in this case, we should
 300   // use the unreachable URL as the original URL.
 301   if (ds->hasUnreachableURL())
 302     return ds->unreachableURL();
 303
 304   std::vector<GURL> redirects;
 305   GetRedirectChain(ds, &redirects);
 306   if (!redirects.empty())
 307     return redirects.at(0);
 308
 309   return ds->originalRequest().url();
 310 }
 311
 312 NOINLINE void CrashIntentionally() {
 313   // NOTE(shess): Crash directly rather than using NOTREACHED() so
 314   // that the signature is easier to triage in crash reports.
 315   volatile int* zero = NULL;
 316   *zero = 0;
 317 }
 318
 319 NOINLINE void BadCastCrashIntentionally() {
 320   class A {
 321     virtual void f() {}
 322   };
 323
 324   class B {
 325     virtual void f() {}
 326   };
 327
 328   A a;
 329   (void)(B*)&a;
 330 }
 331
 332 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 333 NOINLINE void MaybeTriggerAsanError(const GURL& url) {
 334   // NOTE(rogerm): We intentionally perform an invalid heap access here in
 335   //     order to trigger an Address Sanitizer (ASAN) error report.
 336   const char kCrashDomain[] = "crash";
 337   const char kHeapOverflow[] = "/heap-overflow";
 338   const char kHeapUnderflow[] = "/heap-underflow";
 339   const char kUseAfterFree[] = "/use-after-free";
 340 #if defined(SYZYASAN)
 341   const char kCorruptHeapBlock[] = "/corrupt-heap-block";
 342   const char kCorruptHeap[] = "/corrupt-heap";
 343 #endif
 344
 345   if (!url.DomainIs(kCrashDomain))
 346     return;
 347
 348   if (!url.has_path())
 349     return;
 350
 351   std::string crash_type(url.path());
 352   if (crash_type == kHeapOverflow) {
 353     base::debug::AsanHeapOverflow();
 354   } else if (crash_type == kHeapUnderflow ) {
 355     base::debug::AsanHeapUnderflow();
 356   } else if (crash_type == kUseAfterFree) {
 357     base::debug::AsanHeapUseAfterFree();
 358 #if defined(SYZYASAN)
 359   } else if (crash_type == kCorruptHeapBlock) {
 360     base::debug::AsanCorruptHeapBlock();
 361   } else if (crash_type == kCorruptHeap) {
 362     base::debug::AsanCorruptHeap();
 363 #endif
 364   }
 365 }
 366 #endif  // ADDRESS_SANITIZER || SYZYASAN
 367
 368 void MaybeHandleDebugURL(const GURL& url) {
 369   if (!url.SchemeIs(kChromeUIScheme))
 370     return;
 371   if (url == GURL(kChromeUIBadCastCrashURL)) {
 372     BadCastCrashIntentionally();
 373   } else if (url == GURL(kChromeUICrashURL)) {
 374     CrashIntentionally();
 375   } else if (url == GURL(kChromeUIDumpURL)) {
 376     // This URL will only correctly create a crash dump file if content is
 377     // hosted in a process that has correctly called
 378     // base::debug::SetDumpWithoutCrashingFunction.  Refer to the documentation
 379     // of base::debug::DumpWithoutCrashing for more details.
 380     base::debug::DumpWithoutCrashing();
 381   } else if (url == GURL(kChromeUIKillURL)) {
 382     base::Process::Current().Terminate(1, false);
 383   } else if (url == GURL(kChromeUIHangURL)) {
 384     for (;;) {
 385       base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1));
 386     }
 387   } else if (url == GURL(kChromeUIShorthangURL)) {
 388     base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(20));
 389   }
 390
 391 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 392   MaybeTriggerAsanError(url);
 393 #endif  // ADDRESS_SANITIZER || SYZYASAN
 394 }
 395
 396 // Returns false unless this is a top-level navigation.
 397 bool IsTopLevelNavigation(WebFrame* frame) {
 398   return frame->parent() == NULL;
 399 }
 400
 401 // Returns false unless this is a top-level navigation that crosses origins.
 402 bool IsNonLocalTopLevelNavigation(const GURL& url,
 403                                   WebFrame* frame,
 404                                   WebNavigationType type,
 405                                   bool is_form_post) {
 406   if (!IsTopLevelNavigation(frame))
 407     return false;
 408
 409   // Navigations initiated within Webkit are not sent out to the external host
 410   // in the following cases.
 411   // 1. The url scheme is not http/https
 412   // 2. The origin of the url and the opener is the same in which case the
 413   //    opener relationship is maintained.
 414   // 3. Reloads/form submits/back forward navigations
 415   if (!url.SchemeIs(url::kHttpScheme) && !url.SchemeIs(url::kHttpsScheme))
 416     return false;
 417
 418   if (type != blink::WebNavigationTypeReload &&
 419       type != blink::WebNavigationTypeBackForward && !is_form_post) {
 420     // The opener relationship between the new window and the parent allows the
 421     // new window to script the parent and vice versa. This is not allowed if
 422     // the origins of the two domains are different. This can be treated as a
 423     // top level navigation and routed back to the host.
 424     blink::WebFrame* opener = frame->opener();
 425     if (!opener)
 426       return true;
 427
 428     if (url.GetOrigin() != GURL(opener->document().url()).GetOrigin())
 429       return true;
 430   }
 431   return false;
 432 }
 433
 434 WebURLRequest CreateURLRequestForNavigation(
 435     const CommonNavigationParams& common_params,
 436     scoped_ptr<StreamOverrideParameters> stream_override,
 437     bool is_view_source_mode_enabled) {
 438   WebURLRequest request(common_params.url);
 439   if (is_view_source_mode_enabled)
 440     request.setCachePolicy(WebURLRequest::ReturnCacheDataElseLoad);
 441
 442   if (common_params.referrer.url.is_valid()) {
 443     WebString web_referrer = WebSecurityPolicy::generateReferrerHeader(
 444         common_params.referrer.policy,
 445         common_params.url,
 446         WebString::fromUTF8(common_params.referrer.url.spec()));
 447     if (!web_referrer.isEmpty())
 448       request.setHTTPReferrer(web_referrer, common_params.referrer.policy);
 449   }
 450
 451   RequestExtraData* extra_data = new RequestExtraData();
 452   extra_data->set_stream_override(stream_override.Pass());
 453   request.setExtraData(extra_data);
 454
 455   // Set the ui timestamp for this navigation. Currently the timestamp here is
 456   // only non empty when the navigation was triggered by an Android intent. The
 457   // timestamp is converted to a double version supported by blink. It will be
 458   // passed back to the browser in the DidCommitProvisionalLoad and the
 459   // DocumentLoadComplete IPCs.
 460   base::TimeDelta ui_timestamp = common_params.ui_timestamp - base::TimeTicks();
 461   request.setUiStartTime(ui_timestamp.InSecondsF());
 462   request.setInputPerfMetricReportPolicy(
 463       static_cast<WebURLRequest::InputToLoadPerfMetricReportPolicy>(
 464           common_params.report_type));
 465   return request;
 466 }
 467
 468 void UpdateFrameNavigationTiming(WebFrame* frame,
 469                                  base::TimeTicks browser_navigation_start,
 470                                  base::TimeTicks renderer_navigation_start) {
 471   // The browser provides the navigation_start time to bootstrap the
 472   // Navigation Timing information for the browser-initiated navigations. In
 473   // case of cross-process navigations, this carries over the time of
 474   // finishing the onbeforeunload handler of the previous page.
 475   DCHECK(!browser_navigation_start.is_null());
 476   if (frame->provisionalDataSource()) {
 477     // |browser_navigation_start| is likely before this process existed, so we
 478     // can't use InterProcessTimeTicksConverter. We need at least to ensure
 479     // that the browser-side navigation start we set is not later than the one
 480     // on the renderer side.
 481     base::TimeTicks navigation_start = std::min(
 482         browser_navigation_start, renderer_navigation_start);
 483     double navigation_start_seconds =
 484         (navigation_start - base::TimeTicks()).InSecondsF();
 485     frame->provisionalDataSource()->setNavigationStartTime(
 486         navigation_start_seconds);
 487     // TODO(clamy): We need to provide additional timing values for the
 488     // Navigation Timing API to work with browser-side navigations.
 489   }
 490 }
 491
 492 // PlzNavigate
 493 CommonNavigationParams MakeCommonNavigationParams(
 494     blink::WebURLRequest* request,
 495     bool should_replace_current_entry) {
 496   const RequestExtraData kEmptyData;
 497   const RequestExtraData* extra_data =
 498       static_cast<RequestExtraData*>(request->extraData());
 499   if (!extra_data)
 500     extra_data = &kEmptyData;
 501   Referrer referrer(
 502       GURL(request->httpHeaderField(WebString::fromUTF8("Referer")).latin1()),
 503       request->referrerPolicy());
 504
 505   // Set the ui timestamp for this navigation. Currently the timestamp here is
 506   // only non empty when the navigation was triggered by an Android intent, or
 507   // by the user clicking on a link. The timestamp is converted from a double
 508   // version supported by blink. It will be passed back to the renderer in the
 509   // CommitNavigation IPC, and then back to the browser again in the
 510   // DidCommitProvisionalLoad and the DocumentLoadComplete IPCs.
 511   base::TimeTicks ui_timestamp =
 512       base::TimeTicks() + base::TimeDelta::FromSecondsD(request->uiStartTime());
 513   FrameMsg_UILoadMetricsReportType::Value report_type =
 514       static_cast<FrameMsg_UILoadMetricsReportType::Value>(
 515           request->inputPerfMetricReportPolicy());
 516   return CommonNavigationParams(
 517       request->url(), referrer, extra_data->transition_type(),
 518       FrameMsg_Navigate_Type::NORMAL, true, should_replace_current_entry,
 519       ui_timestamp, report_type, GURL(), GURL());
 520 }
 521
 522 #if !defined(OS_ANDROID) || defined(ENABLE_MEDIA_PIPELINE_ON_ANDROID)
 523 media::Context3D GetSharedMainThreadContext3D() {
 524   cc::ContextProvider* provider =
 525       RenderThreadImpl::current()->SharedMainThreadContextProvider().get();
 526   if (!provider)
 527     return media::Context3D();
 528   return media::Context3D(provider->ContextGL(), provider->GrContext());
 529 }
 530 #endif
 531
 532 bool IsReload(FrameMsg_Navigate_Type::Value navigation_type) {
 533   return navigation_type == FrameMsg_Navigate_Type::RELOAD ||
 534          navigation_type == FrameMsg_Navigate_Type::RELOAD_IGNORING_CACHE ||
 535          navigation_type == FrameMsg_Navigate_Type::RELOAD_ORIGINAL_REQUEST_URL;
 536 }
 537
 538 RenderFrameImpl::CreateRenderFrameImplFunction g_create_render_frame_impl =
 539     nullptr;
 540
 541 void OnGotContentHandlerID(uint32_t content_handler_id) {}
 542
 543 }  // namespace
 544
 545 // static
 546 RenderFrameImpl* RenderFrameImpl::Create(RenderViewImpl* render_view,
 547                                          int32 routing_id) {
 548   DCHECK(routing_id != MSG_ROUTING_NONE);
 549   CreateParams params(render_view, routing_id);
 550
 551   if (g_create_render_frame_impl)
 552     return g_create_render_frame_impl(params);
 553   else
 554     return new RenderFrameImpl(params);
 555 }
 556
 557 // static
 558 RenderFrame* RenderFrame::FromRoutingID(int routing_id) {
 559   return RenderFrameImpl::FromRoutingID(routing_id);
 560 }
 561
 562 // static
 563 RenderFrameImpl* RenderFrameImpl::FromRoutingID(int routing_id) {
 564   RoutingIDFrameMap::iterator iter =
 565       g_routing_id_frame_map.Get().find(routing_id);
 566   if (iter != g_routing_id_frame_map.Get().end())
 567     return iter->second;
 568   return NULL;
 569 }
 570
 571 // static
 572 RenderFrameImpl* RenderFrameImpl::CreateMainFrame(RenderViewImpl* render_view,
 573                                                   int32 routing_id) {
 574   RenderFrameImpl* render_frame =
 575       RenderFrameImpl::Create(render_view, routing_id);
 576   WebLocalFrame* web_frame =
 577       WebLocalFrame::create(blink::WebTreeScopeType::Document, render_frame);
 578   render_frame->SetWebFrame(web_frame);
 579   render_view->webview()->setMainFrame(web_frame);
 580   return render_frame;
 581 }
 582
 583 // static
 584 void RenderFrameImpl::CreateFrame(
 585     int routing_id,
 586     int proxy_routing_id,
 587     int opener_routing_id,
 588     int parent_routing_id,
 589     int previous_sibling_routing_id,
 590     const FrameReplicationState& replicated_state,
 591     CompositorDependencies* compositor_deps,
 592     const FrameMsg_NewFrame_WidgetParams& widget_params) {
 593   blink::WebLocalFrame* web_frame;
 594   RenderFrameImpl* render_frame;
 595   if (proxy_routing_id == MSG_ROUTING_NONE) {
 596     RenderFrameProxy* parent_proxy =
 597         RenderFrameProxy::FromRoutingID(parent_routing_id);
 598     // If the browser is sending a valid parent routing id, it should already
 599     // be created and registered.
 600     CHECK(parent_proxy);
 601     blink::WebRemoteFrame* parent_web_frame = parent_proxy->web_frame();
 602
 603     blink::WebFrame* previous_sibling_web_frame = nullptr;
 604     RenderFrameProxy* previous_sibling_proxy =
 605         RenderFrameProxy::FromRoutingID(previous_sibling_routing_id);
 606     if (previous_sibling_proxy)
 607       previous_sibling_web_frame = previous_sibling_proxy->web_frame();
 608
 609     // Create the RenderFrame and WebLocalFrame, linking the two.
 610     render_frame =
 611         RenderFrameImpl::Create(parent_proxy->render_view(), routing_id);
 612     web_frame = parent_web_frame->createLocalChild(
 613         replicated_state.scope, WebString::fromUTF8(replicated_state.name),
 614         replicated_state.sandbox_flags, render_frame,
 615         previous_sibling_web_frame);
 616   } else {
 617     RenderFrameProxy* proxy =
 618         RenderFrameProxy::FromRoutingID(proxy_routing_id);
 619     CHECK(proxy);
 620     render_frame = RenderFrameImpl::Create(proxy->render_view(), routing_id);
 621     web_frame =
 622         blink::WebLocalFrame::create(replicated_state.scope, render_frame);
 623     render_frame->proxy_routing_id_ = proxy_routing_id;
 624     web_frame->initializeToReplaceRemoteFrame(
 625         proxy->web_frame(), WebString::fromUTF8(replicated_state.name),
 626         replicated_state.sandbox_flags);
 627   }
 628   render_frame->SetWebFrame(web_frame);
 629   CHECK_IMPLIES(parent_routing_id == MSG_ROUTING_NONE, !web_frame->parent());
 630
 631   WebFrame* opener = ResolveOpener(opener_routing_id, nullptr);
 632   web_frame->setOpener(opener);
 633
 634   if (widget_params.routing_id != MSG_ROUTING_NONE) {
 635     CHECK(SiteIsolationPolicy::AreCrossProcessFramesPossible());
 636     render_frame->render_widget_ = RenderWidget::CreateForFrame(
 637         widget_params.routing_id, widget_params.surface_id,
 638         widget_params.hidden, render_frame->render_view_->screen_info(),
 639         compositor_deps, web_frame);
 640     // TODO(kenrb): Observing shouldn't be necessary when we sort out
 641     // WasShown and WasHidden, separating page-level visibility from
 642     // frame-level visibility.
 643     render_frame->render_widget_->RegisterRenderFrame(render_frame);
 644   }
 645
 646   render_frame->Initialize();
 647 }
 648
 649 // static
 650 RenderFrame* RenderFrame::FromWebFrame(blink::WebFrame* web_frame) {
 651   return RenderFrameImpl::FromWebFrame(web_frame);
 652 }
 653
 654 // static
 655 RenderFrameImpl* RenderFrameImpl::FromWebFrame(blink::WebFrame* web_frame) {
 656   FrameMap::iterator iter = g_frame_map.Get().find(web_frame);
 657   if (iter != g_frame_map.Get().end())
 658     return iter->second;
 659   return NULL;
 660 }
 661
 662 // static
 663 void RenderFrameImpl::InstallCreateHook(
 664     CreateRenderFrameImplFunction create_render_frame_impl) {
 665   CHECK(!g_create_render_frame_impl);
 666   g_create_render_frame_impl = create_render_frame_impl;
 667 }
 668
 669 // static
 670 blink::WebFrame* RenderFrameImpl::ResolveOpener(int opener_frame_routing_id,
 671                                                 int* opener_view_routing_id) {
 672   if (opener_view_routing_id)
 673     *opener_view_routing_id = MSG_ROUTING_NONE;
 674
 675   if (opener_frame_routing_id == MSG_ROUTING_NONE)
 676     return nullptr;
 677
 678   // Opener routing ID could refer to either a RenderFrameProxy or a
 679   // RenderFrame, so need to check both.
 680   RenderFrameProxy* opener_proxy =
 681       RenderFrameProxy::FromRoutingID(opener_frame_routing_id);
 682   if (opener_proxy) {
 683     if (opener_view_routing_id)
 684       *opener_view_routing_id = opener_proxy->render_view()->GetRoutingID();
 685
 686     // TODO(nasko,alexmos): This check won't be needed once swappedout:// is
 687     // gone.
 688     if (opener_proxy->IsMainFrameDetachedFromTree()) {
 689       DCHECK(!SiteIsolationPolicy::IsSwappedOutStateForbidden());
 690       return opener_proxy->render_view()->webview()->mainFrame();
 691     } else {
 692       return opener_proxy->web_frame();
 693     }
 694   }
 695
 696   RenderFrameImpl* opener_frame =
 697       RenderFrameImpl::FromRoutingID(opener_frame_routing_id);
 698   if (opener_frame) {
 699     if (opener_view_routing_id)
 700       *opener_view_routing_id = opener_frame->render_view()->GetRoutingID();
 701     return opener_frame->GetWebFrame();
 702   }
 703
 704   return nullptr;
 705 }
 706
 707 // RenderFrameImpl ----------------------------------------------------------
 708 RenderFrameImpl::RenderFrameImpl(const CreateParams& params)
 709     : frame_(NULL),
 710       is_subframe_(false),
 711       is_local_root_(false),
 712       render_view_(params.render_view->AsWeakPtr()),
 713       routing_id_(params.routing_id),
 714       is_swapped_out_(false),
 715       render_frame_proxy_(NULL),
 716       is_detaching_(false),
 717       proxy_routing_id_(MSG_ROUTING_NONE),
 718 #if defined(ENABLE_PLUGINS)
 719       plugin_power_saver_helper_(NULL),
 720 #endif
 721       cookie_jar_(this),
 722       selection_text_offset_(0),
 723       selection_range_(gfx::Range::InvalidRange()),
 724       handling_select_range_(false),
 725       notification_permission_dispatcher_(NULL),
 726       web_user_media_client_(NULL),
 727       media_permission_dispatcher_(NULL),
 728       midi_dispatcher_(NULL),
 729 #if defined(OS_ANDROID)
 730       media_player_manager_(NULL),
 731 #endif
 732 #if defined(ENABLE_BROWSER_CDMS)
 733       cdm_manager_(NULL),
 734 #endif
 735 #if defined(VIDEO_HOLE)
 736       contains_media_player_(false),
 737 #endif
 738       has_played_media_(false),
 739       devtools_agent_(nullptr),
 740       geolocation_dispatcher_(NULL),
 741       push_messaging_dispatcher_(NULL),
 742       presentation_dispatcher_(NULL),
 743       screen_orientation_dispatcher_(NULL),
 744       manifest_manager_(NULL),
 745       accessibility_mode_(AccessibilityModeOff),
 746       renderer_accessibility_(NULL),
 747       weak_factory_(this) {
 748   std::pair<RoutingIDFrameMap::iterator, bool> result =
 749       g_routing_id_frame_map.Get().insert(std::make_pair(routing_id_, this));
 750   CHECK(result.second) << "Inserting a duplicate item.";
 751
 752   RenderThread::Get()->AddRoute(routing_id_, this);
 753
 754   render_view_->RegisterRenderFrame(this);
 755
 756   // Everything below subclasses RenderFrameObserver and is automatically
 757   // deleted when the RenderFrame gets deleted.
 758 #if defined(OS_ANDROID)
 759   new GinJavaBridgeDispatcher(this);
 760 #endif
 761
 762 #if defined(ENABLE_PLUGINS)
 763   plugin_power_saver_helper_ = new PluginPowerSaverHelper(this);
 764 #endif
 765
 766   manifest_manager_ = new ManifestManager(this);
 767
 768   GetServiceRegistry()->ConnectToRemoteService(mojo::GetProxy(&mojo_shell_));
 769 }
 770
 771 RenderFrameImpl::~RenderFrameImpl() {
 772   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, RenderFrameGone());
 773   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnDestruct());
 774
 775   base::trace_event::TraceLog::GetInstance()->RemoveProcessLabel(routing_id_);
 776
 777 #if defined(VIDEO_HOLE)
 778   if (contains_media_player_)
 779     render_view_->UnregisterVideoHoleFrame(this);
 780 #endif
 781
 782   if (!is_subframe_) {
 783     // When using swapped out frames, RenderFrameProxy is owned by
 784     // RenderFrameImpl in the case it is the main frame. Ensure it is deleted
 785     // along with this object.
 786     if (render_frame_proxy_ &&
 787         !SiteIsolationPolicy::IsSwappedOutStateForbidden()) {
 788       // The following method calls back into this object and clears
 789       // |render_frame_proxy_|.
 790       render_frame_proxy_->frameDetached(
 791           blink::WebRemoteFrameClient::DetachType::Remove);
 792     }
 793
 794     // Ensure the RenderView doesn't point to this object, once it is destroyed.
 795     // TODO(nasko): Add a check that the |main_render_frame_| of |render_view_|
 796     // is |this|, once the object is no longer leaked.
 797     // See https://crbug.com/464764.
 798     render_view_->main_render_frame_ = nullptr;
 799   }
 800
 801   render_view_->UnregisterRenderFrame(this);
 802   g_routing_id_frame_map.Get().erase(routing_id_);
 803   RenderThread::Get()->RemoveRoute(routing_id_);
 804 }
 805
 806 void RenderFrameImpl::SetWebFrame(blink::WebLocalFrame* web_frame) {
 807   DCHECK(!frame_);
 808
 809   std::pair<FrameMap::iterator, bool> result = g_frame_map.Get().insert(
 810       std::make_pair(web_frame, this));
 811   CHECK(result.second) << "Inserting a duplicate item.";
 812
 813   frame_ = web_frame;
 814 }
 815
 816 void RenderFrameImpl::Initialize() {
 817   is_subframe_ = !!frame_->parent();
 818   is_local_root_ = !frame_->parent() || frame_->parent()->isWebRemoteFrame();
 819
 820 #if defined(ENABLE_PLUGINS)
 821   new PepperBrowserConnection(this);
 822 #endif
 823   new SharedWorkerRepository(this);
 824
 825   if (is_local_root_ && !render_frame_proxy_) {
 826     // DevToolsAgent is a RenderFrameObserver, and will destruct itself
 827     // when |this| is deleted.
 828     devtools_agent_ = new DevToolsAgent(this);
 829   }
 830
 831   RegisterMojoServices();
 832
 833   // We delay calling this until we have the WebFrame so that any observer or
 834   // embedder can call GetWebFrame on any RenderFrame.
 835   GetContentClient()->renderer()->RenderFrameCreated(this);
 836 }
 837
 838 RenderWidget* RenderFrameImpl::GetRenderWidget() {
 839   return render_view_.get();
 840 }
 841
 842 #if defined(ENABLE_PLUGINS)
 843 void RenderFrameImpl::PepperPluginCreated(RendererPpapiHost* host) {
 844   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
 845                     DidCreatePepperPlugin(host));
 846   if (host->GetPluginName() == kFlashPluginName) {
 847     RenderThread::Get()->RecordAction(
 848         base::UserMetricsAction("FrameLoadWithFlash"));
 849   }
 850 }
 851
 852 void RenderFrameImpl::PepperDidChangeCursor(
 853     PepperPluginInstanceImpl* instance,
 854     const blink::WebCursorInfo& cursor) {
 855   // Update the cursor appearance immediately if the requesting plugin is the
 856   // one which receives the last mouse event. Otherwise, the new cursor won't be
 857   // picked up until the plugin gets the next input event. That is bad if, e.g.,
 858   // the plugin would like to set an invisible cursor when there isn't any user
 859   // input for a while.
 860   if (instance == render_view_->pepper_last_mouse_event_target())
 861     GetRenderWidget()->didChangeCursor(cursor);
 862 }
 863
 864 void RenderFrameImpl::PepperDidReceiveMouseEvent(
 865     PepperPluginInstanceImpl* instance) {
 866   render_view_->set_pepper_last_mouse_event_target(instance);
 867 }
 868
 869 void RenderFrameImpl::PepperTextInputTypeChanged(
 870     PepperPluginInstanceImpl* instance) {
 871   if (instance != render_view_->focused_pepper_plugin())
 872     return;
 873
 874   GetRenderWidget()->UpdateTextInputState(
 875       RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
 876
 877   FocusedNodeChangedForAccessibility(WebNode());
 878 }
 879
 880 void RenderFrameImpl::PepperCaretPositionChanged(
 881     PepperPluginInstanceImpl* instance) {
 882   if (instance != render_view_->focused_pepper_plugin())
 883     return;
 884   GetRenderWidget()->UpdateSelectionBounds();
 885 }
 886
 887 void RenderFrameImpl::PepperCancelComposition(
 888     PepperPluginInstanceImpl* instance) {
 889   if (instance != render_view_->focused_pepper_plugin())
 890     return;
 891   Send(new InputHostMsg_ImeCancelComposition(render_view_->GetRoutingID()));;
 892 #if defined(OS_MACOSX) || defined(USE_AURA)
 893   GetRenderWidget()->UpdateCompositionInfo(true);
 894 #endif
 895 }
 896
 897 void RenderFrameImpl::PepperSelectionChanged(
 898     PepperPluginInstanceImpl* instance) {
 899   if (instance != render_view_->focused_pepper_plugin())
 900     return;
 901   SyncSelectionIfRequired();
 902 }
 903
 904 RenderWidgetFullscreenPepper* RenderFrameImpl::CreatePepperFullscreenContainer(
 905     PepperPluginInstanceImpl* plugin) {
 906   GURL active_url;
 907   if (render_view_->webview() && render_view_->webview()->mainFrame())
 908     active_url = GURL(render_view_->webview()->mainFrame()->document().url());
 909   RenderWidgetFullscreenPepper* widget = RenderWidgetFullscreenPepper::Create(
 910       GetRenderWidget()->routing_id(), GetRenderWidget()->compositor_deps(),
 911       plugin, active_url, GetRenderWidget()->screenInfo());
 912   widget->show(blink::WebNavigationPolicyIgnore);
 913   return widget;
 914 }
 915
 916 bool RenderFrameImpl::IsPepperAcceptingCompositionEvents() const {
 917   if (!render_view_->focused_pepper_plugin())
 918     return false;
 919   return render_view_->focused_pepper_plugin()->
 920       IsPluginAcceptingCompositionEvents();
 921 }
 922
 923 void RenderFrameImpl::PluginCrashed(const base::FilePath& plugin_path,
 924                                    base::ProcessId plugin_pid) {
 925   // TODO(jam): dispatch this IPC in RenderFrameHost and switch to use
 926   // routing_id_ as a result.
 927   Send(new FrameHostMsg_PluginCrashed(routing_id_, plugin_path, plugin_pid));
 928 }
 929
 930 void RenderFrameImpl::SimulateImeSetComposition(
 931     const base::string16& text,
 932     const std::vector<blink::WebCompositionUnderline>& underlines,
 933     int selection_start,
 934     int selection_end) {
 935   render_view_->OnImeSetComposition(
 936       text, underlines, selection_start, selection_end);
 937 }
 938
 939 void RenderFrameImpl::SimulateImeConfirmComposition(
 940     const base::string16& text,
 941     const gfx::Range& replacement_range) {
 942   render_view_->OnImeConfirmComposition(text, replacement_range, false);
 943 }
 944
 945 void RenderFrameImpl::OnImeSetComposition(
 946     const base::string16& text,
 947     const std::vector<blink::WebCompositionUnderline>& underlines,
 948     int selection_start,
 949     int selection_end) {
 950   // When a PPAPI plugin has focus, we bypass WebKit.
 951   if (!IsPepperAcceptingCompositionEvents()) {
 952     pepper_composition_text_ = text;
 953   } else {
 954     // TODO(kinaba) currently all composition events are sent directly to
 955     // plugins. Use DOM event mechanism after WebKit is made aware about
 956     // plugins that support composition.
 957     // The code below mimics the behavior of WebCore::Editor::setComposition.
 958
 959     // Empty -> nonempty: composition started.
 960     if (pepper_composition_text_.empty() && !text.empty()) {
 961       render_view_->focused_pepper_plugin()->HandleCompositionStart(
 962           base::string16());
 963     }
 964     // Nonempty -> empty: composition canceled.
 965     if (!pepper_composition_text_.empty() && text.empty()) {
 966       render_view_->focused_pepper_plugin()->HandleCompositionEnd(
 967           base::string16());
 968     }
 969     pepper_composition_text_ = text;
 970     // Nonempty: composition is ongoing.
 971     if (!pepper_composition_text_.empty()) {
 972       render_view_->focused_pepper_plugin()->HandleCompositionUpdate(
 973           pepper_composition_text_, underlines, selection_start,
 974           selection_end);
 975     }
 976   }
 977 }
 978
 979 void RenderFrameImpl::OnImeConfirmComposition(
 980     const base::string16& text,
 981     const gfx::Range& replacement_range,
 982     bool keep_selection) {
 983   // When a PPAPI plugin has focus, we bypass WebKit.
 984   // Here, text.empty() has a special meaning. It means to commit the last
 985   // update of composition text (see
 986   // RenderWidgetHost::ImeConfirmComposition()).
 987   const base::string16& last_text = text.empty() ? pepper_composition_text_
 988                                                  : text;
 989
 990   // last_text is empty only when both text and pepper_composition_text_ is.
 991   // Ignore it.
 992   if (last_text.empty())
 993     return;
 994
 995   if (!IsPepperAcceptingCompositionEvents()) {
 996     base::i18n::UTF16CharIterator iterator(&last_text);
 997     int32 i = 0;
 998     while (iterator.Advance()) {
 999       blink::WebKeyboardEvent char_event;
1000       char_event.type = blink::WebInputEvent::Char;
1001       char_event.timeStampSeconds = base::Time::Now().ToDoubleT();
1002       char_event.modifiers = 0;
1003       char_event.windowsKeyCode = last_text[i];
1004       char_event.nativeKeyCode = last_text[i];
1005
1006       const int32 char_start = i;
1007       for (; i < iterator.array_pos(); ++i) {
1008         char_event.text[i - char_start] = last_text[i];
1009         char_event.unmodifiedText[i - char_start] = last_text[i];
1010       }
1011
1012       if (GetRenderWidget()->webwidget())
1013         GetRenderWidget()->webwidget()->handleInputEvent(char_event);
1014     }
1015   } else {
1016     // Mimics the order of events sent by WebKit.
1017     // See WebCore::Editor::setComposition() for the corresponding code.
1018     render_view_->focused_pepper_plugin()->HandleCompositionEnd(last_text);
1019     render_view_->focused_pepper_plugin()->HandleTextInput(last_text);
1020   }
1021   pepper_composition_text_.clear();
1022 }
1023 #endif  // defined(ENABLE_PLUGINS)
1024
1025 MediaStreamDispatcher* RenderFrameImpl::GetMediaStreamDispatcher() {
1026   if (!web_user_media_client_)
1027     InitializeUserMediaClient();
1028   return web_user_media_client_ ?
1029       web_user_media_client_->media_stream_dispatcher() : NULL;
1030 }
1031
1032 bool RenderFrameImpl::Send(IPC::Message* message) {
1033   if (is_detaching_) {
1034     delete message;
1035     return false;
1036   }
1037   if (is_swapped_out_) {
1038     if (!SwappedOutMessages::CanSendWhileSwappedOut(message)) {
1039       delete message;
1040       return false;
1041     }
1042   }
1043
1044   return RenderThread::Get()->Send(message);
1045 }
1046
1047 #if defined(OS_MACOSX) || defined(OS_ANDROID)
1048 void RenderFrameImpl::DidHideExternalPopupMenu() {
1049   // We need to clear external_popup_menu_ as soon as ExternalPopupMenu::close
1050   // is called. Otherwise, createExternalPopupMenu() for new popup will fail.
1051   external_popup_menu_.reset();
1052 }
1053 #endif
1054
1055 bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
1056   // We may get here while detaching, when the WebFrame has been deleted.  Do
1057   // not process any messages in this state.
1058   if (!frame_)
1059     return false;
1060
1061   // TODO(kenrb): document() should not be null, but as a transitional step
1062   // we have RenderFrameProxy 'wrapping' a RenderFrameImpl, passing messages
1063   // to this method. This happens for a top-level remote frame, where a
1064   // document-less RenderFrame is replaced by a RenderFrameProxy but kept
1065   // around and is still able to receive messages.
1066   if (!frame_->document().isNull())
1067     GetContentClient()->SetActiveURL(frame_->document().url());
1068
1069   base::ObserverListBase<RenderFrameObserver>::Iterator it(&observers_);
1070   RenderFrameObserver* observer;
1071   while ((observer = it.GetNext()) != NULL) {
1072     if (observer->OnMessageReceived(msg))
1073       return true;
1074   }
1075
1076   bool handled = true;
1077   IPC_BEGIN_MESSAGE_MAP(RenderFrameImpl, msg)
1078     IPC_MESSAGE_HANDLER(FrameMsg_Navigate, OnNavigate)
1079     IPC_MESSAGE_HANDLER(FrameMsg_BeforeUnload, OnBeforeUnload)
1080     IPC_MESSAGE_HANDLER(FrameMsg_SwapOut, OnSwapOut)
1081     IPC_MESSAGE_HANDLER(FrameMsg_Stop, OnStop)
1082     IPC_MESSAGE_HANDLER(FrameMsg_ContextMenuClosed, OnContextMenuClosed)
1083     IPC_MESSAGE_HANDLER(FrameMsg_CustomContextMenuAction,
1084                         OnCustomContextMenuAction)
1085     IPC_MESSAGE_HANDLER(InputMsg_Undo, OnUndo)
1086     IPC_MESSAGE_HANDLER(InputMsg_Redo, OnRedo)
1087     IPC_MESSAGE_HANDLER(InputMsg_Cut, OnCut)
1088     IPC_MESSAGE_HANDLER(InputMsg_Copy, OnCopy)
1089     IPC_MESSAGE_HANDLER(InputMsg_Paste, OnPaste)
1090     IPC_MESSAGE_HANDLER(InputMsg_PasteAndMatchStyle, OnPasteAndMatchStyle)
1091     IPC_MESSAGE_HANDLER(InputMsg_Delete, OnDelete)
1092     IPC_MESSAGE_HANDLER(InputMsg_SelectAll, OnSelectAll)
1093     IPC_MESSAGE_HANDLER(InputMsg_SelectRange, OnSelectRange)
1094     IPC_MESSAGE_HANDLER(InputMsg_AdjustSelectionByCharacterOffset,
1095                         OnAdjustSelectionByCharacterOffset)
1096     IPC_MESSAGE_HANDLER(InputMsg_Unselect, OnUnselect)
1097     IPC_MESSAGE_HANDLER(InputMsg_MoveRangeSelectionExtent,
1098                         OnMoveRangeSelectionExtent)
1099     IPC_MESSAGE_HANDLER(InputMsg_Replace, OnReplace)
1100     IPC_MESSAGE_HANDLER(InputMsg_ReplaceMisspelling, OnReplaceMisspelling)
1101     IPC_MESSAGE_HANDLER(InputMsg_ExtendSelectionAndDelete,
1102                         OnExtendSelectionAndDelete)
1103     IPC_MESSAGE_HANDLER(InputMsg_SetCompositionFromExistingText,
1104                         OnSetCompositionFromExistingText)
1105     IPC_MESSAGE_HANDLER(InputMsg_ExecuteNoValueEditCommand,
1106                         OnExecuteNoValueEditCommand)
1107     IPC_MESSAGE_HANDLER(FrameMsg_CSSInsertRequest, OnCSSInsertRequest)
1108     IPC_MESSAGE_HANDLER(FrameMsg_AddMessageToConsole, OnAddMessageToConsole)
1109     IPC_MESSAGE_HANDLER(FrameMsg_JavaScriptExecuteRequest,
1110                         OnJavaScriptExecuteRequest)
1111     IPC_MESSAGE_HANDLER(FrameMsg_JavaScriptExecuteRequestForTests,
1112                         OnJavaScriptExecuteRequestForTests)
1113     IPC_MESSAGE_HANDLER(FrameMsg_JavaScriptExecuteRequestInIsolatedWorld,
1114                         OnJavaScriptExecuteRequestInIsolatedWorld)
1115     IPC_MESSAGE_HANDLER(FrameMsg_VisualStateRequest,
1116                         OnVisualStateRequest)
1117     IPC_MESSAGE_HANDLER(FrameMsg_SetEditableSelectionOffsets,
1118                         OnSetEditableSelectionOffsets)
1119     IPC_MESSAGE_HANDLER(FrameMsg_Reload, OnReload)
1120     IPC_MESSAGE_HANDLER(FrameMsg_TextSurroundingSelectionRequest,
1121                         OnTextSurroundingSelectionRequest)
1122     IPC_MESSAGE_HANDLER(FrameMsg_SetAccessibilityMode,
1123                         OnSetAccessibilityMode)
1124     IPC_MESSAGE_HANDLER(AccessibilityMsg_SnapshotTree,
1125                         OnSnapshotAccessibilityTree)
1126     IPC_MESSAGE_HANDLER(FrameMsg_UpdateOpener, OnUpdateOpener)
1127     IPC_MESSAGE_HANDLER(FrameMsg_CommitNavigation, OnCommitNavigation)
1128     IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateSandboxFlags, OnDidUpdateSandboxFlags)
1129     IPC_MESSAGE_HANDLER(FrameMsg_SetTextTrackSettings,
1130                         OnTextTrackSettingsChanged)
1131     IPC_MESSAGE_HANDLER(FrameMsg_PostMessageEvent, OnPostMessageEvent)
1132     IPC_MESSAGE_HANDLER(FrameMsg_FailedNavigation, OnFailedNavigation)
1133 #if defined(OS_ANDROID)
1134     IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItems, OnSelectPopupMenuItems)
1135 #elif defined(OS_MACOSX)
1136     IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItem, OnSelectPopupMenuItem)
1137     IPC_MESSAGE_HANDLER(InputMsg_CopyToFindPboard, OnCopyToFindPboard)
1138 #endif
1139   IPC_END_MESSAGE_MAP()
1140
1141   return handled;
1142 }
1143
1144 void RenderFrameImpl::OnNavigate(
1145     const CommonNavigationParams& common_params,
1146     const StartNavigationParams& start_params,
1147     const RequestNavigationParams& request_params) {
1148   RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
1149   // Can be NULL in tests.
1150   if (render_thread_impl)
1151       render_thread_impl->GetRendererScheduler()->OnPageLoadStarted();
1152   DCHECK(!base::CommandLine::ForCurrentProcess()->HasSwitch(
1153       switches::kEnableBrowserSideNavigation));
1154   TRACE_EVENT2("navigation", "RenderFrameImpl::OnNavigate", "id", routing_id_,
1155                "url", common_params.url.possibly_invalid_spec());
1156   NavigateInternal(common_params, start_params, request_params,
1157                    scoped_ptr<StreamOverrideParameters>());
1158 }
1159
1160 void RenderFrameImpl::NavigateToSwappedOutURL() {
1161   // We use loadRequest instead of loadHTMLString because the former commits
1162   // synchronously.  Otherwise a new navigation can interrupt the navigation
1163   // to kSwappedOutURL. If that happens to be to the page we had been
1164   // showing, then WebKit will never send a commit and we'll be left spinning.
1165   // Set the is_swapped_out_ bit to true, so IPC filtering is in effect and
1166   // the navigation to swappedout:// is not announced to the browser side.
1167   is_swapped_out_ = true;
1168   GURL swappedOutURL(kSwappedOutURL);
1169   WebURLRequest request(swappedOutURL);
1170   frame_->loadRequest(request);
1171 }
1172
1173 void RenderFrameImpl::BindServiceRegistry(
1174     mojo::InterfaceRequest<mojo::ServiceProvider> services,
1175     mojo::ServiceProviderPtr exposed_services) {
1176   service_registry_.Bind(services.Pass());
1177   service_registry_.BindRemoteServiceProvider(exposed_services.Pass());
1178 }
1179
1180 ManifestManager* RenderFrameImpl::manifest_manager() {
1181   return manifest_manager_;
1182 }
1183
1184 void RenderFrameImpl::SetPendingNavigationParams(
1185     scoped_ptr<NavigationParams> navigation_params) {
1186   pending_navigation_params_ = navigation_params.Pass();
1187 }
1188
1189 void RenderFrameImpl::OnBeforeUnload() {
1190   TRACE_EVENT1("navigation", "RenderFrameImpl::OnBeforeUnload",
1191                "id", routing_id_);
1192   // TODO(creis): Right now, this is only called on the main frame.  Make the
1193   // browser process send dispatchBeforeUnloadEvent to every frame that needs
1194   // it.
1195   CHECK(!frame_->parent());
1196
1197   base::TimeTicks before_unload_start_time = base::TimeTicks::Now();
1198   bool proceed = frame_->dispatchBeforeUnloadEvent();
1199   base::TimeTicks before_unload_end_time = base::TimeTicks::Now();
1200   Send(new FrameHostMsg_BeforeUnload_ACK(routing_id_, proceed,
1201                                          before_unload_start_time,
1202                                          before_unload_end_time));
1203 }
1204
1205 void RenderFrameImpl::OnSwapOut(
1206     int proxy_routing_id,
1207     bool is_loading,
1208     const FrameReplicationState& replicated_frame_state) {
1209   TRACE_EVENT1("navigation", "RenderFrameImpl::OnSwapOut", "id", routing_id_);
1210   RenderFrameProxy* proxy = NULL;
1211   bool swapped_out_forbidden =
1212       SiteIsolationPolicy::IsSwappedOutStateForbidden();
1213   bool is_main_frame = !frame_->parent();
1214
1215   // This codepath should only be hit for subframes when in --site-per-process.
1216   CHECK_IMPLIES(!is_main_frame,
1217                 SiteIsolationPolicy::AreCrossProcessFramesPossible());
1218
1219   // Only run unload if we're not swapped out yet, but send the ack either way.
1220   if (!is_swapped_out_) {
1221     // Swap this RenderFrame out so the frame can navigate to a page rendered by
1222     // a different process.  This involves running the unload handler and
1223     // clearing the page.  We also allow this process to exit if there are no
1224     // other active RenderFrames in it.
1225
1226     // Send an UpdateState message before we get swapped out.
1227     render_view_->SendUpdateState();
1228
1229     // If we need a proxy to replace this, create it now so its routing id is
1230     // registered for receiving IPC messages.
1231     if (proxy_routing_id != MSG_ROUTING_NONE) {
1232       proxy = RenderFrameProxy::CreateProxyToReplaceFrame(
1233           this, proxy_routing_id, replicated_frame_state.scope);
1234     }
1235
1236     // Synchronously run the unload handler before sending the ACK.
1237     // TODO(creis): Call dispatchUnloadEvent unconditionally here to support
1238     // unload on subframes as well.
1239     if (is_main_frame)
1240       frame_->dispatchUnloadEvent();
1241
1242     // Swap out and stop sending any IPC messages that are not ACKs.
1243     if (is_main_frame)
1244       render_view_->SetSwappedOut(true);
1245     is_swapped_out_ = true;
1246
1247     // Set the proxy here, since OnStop() below could cause an onload event
1248     // handler to execute, which could trigger code such as
1249     // willCheckAndDispatchMessageEvent() that needs the proxy.
1250     if (proxy)
1251       set_render_frame_proxy(proxy);
1252
1253     // Now that we're swapped out and filtering IPC messages, stop loading to
1254     // ensure that no other in-progress navigation continues.  We do this here
1255     // to avoid sending a DidStopLoading message to the browser process.
1256     // TODO(creis): Should we be stopping all frames here and using
1257     // StopAltErrorPageFetcher with RenderView::OnStop, or just stopping this
1258     // frame?
1259     if (!swapped_out_forbidden)
1260       OnStop();
1261
1262     // Transfer settings such as initial drawing parameters to the remote frame,
1263     // if one is created, that will replace this frame.
1264     if (!is_main_frame && proxy)
1265       proxy->web_frame()->initializeFromFrame(frame_);
1266
1267     // Replace the page with a blank dummy URL. The unload handler will not be
1268     // run a second time, thanks to a check in FrameLoader::stopLoading.
1269     // TODO(creis): Need to add a better way to do this that avoids running the
1270     // beforeunload handler. For now, we just run it a second time silently.
1271     if (!swapped_out_forbidden)
1272       NavigateToSwappedOutURL();
1273
1274     // Let WebKit know that this view is hidden so it can drop resources and
1275     // stop compositing.
1276     // TODO(creis): Support this for subframes as well.
1277     if (is_main_frame) {
1278       render_view_->webview()->setVisibilityState(
1279           blink::WebPageVisibilityStateHidden, false);
1280     }
1281   }
1282
1283   // It is now safe to show modal dialogs again.
1284   // TODO(creis): Deal with modal dialogs from subframes.
1285   if (is_main_frame)
1286     render_view_->suppress_dialogs_until_swap_out_ = false;
1287
1288   Send(new FrameHostMsg_SwapOut_ACK(routing_id_));
1289
1290   RenderViewImpl* render_view = render_view_.get();
1291
1292   // Now that all of the cleanup is complete and the browser side is notified,
1293   // start using the RenderFrameProxy, if one is created.
1294   if (proxy && swapped_out_forbidden) {
1295     frame_->swap(proxy->web_frame());
1296
1297     if (is_loading)
1298       proxy->OnDidStartLoading();
1299   }
1300
1301   // In --site-per-process, initialize the WebRemoteFrame with the replication
1302   // state passed by the process that is now rendering the frame.
1303   // TODO(alexmos): We cannot yet do this for swapped-out main frames, because
1304   // in that case we leave the LocalFrame as the main frame visible to Blink
1305   // and don't call swap() above. Because swap() is what creates a RemoteFrame
1306   // in proxy->web_frame(), the RemoteFrame will not exist for main frames.
1307   // When we do an unconditional swap for all frames, we can remove
1308   // !is_main_frame below.
1309   if (proxy && swapped_out_forbidden)
1310     proxy->SetReplicatedState(replicated_frame_state);
1311
1312   // Safe to exit if no one else is using the process.
1313   // TODO(nasko): Remove the dependency on RenderViewImpl here and ref count
1314   // the process based on the lifetime of this RenderFrameImpl object.
1315   if (is_main_frame) {
1316     render_view->WasSwappedOut();
1317   }
1318 }
1319
1320 void RenderFrameImpl::OnContextMenuClosed(
1321     const CustomContextMenuContext& custom_context) {
1322   if (custom_context.request_id) {
1323     // External request, should be in our map.
1324     ContextMenuClient* client =
1325         pending_context_menus_.Lookup(custom_context.request_id);
1326     if (client) {
1327       client->OnMenuClosed(custom_context.request_id);
1328       pending_context_menus_.Remove(custom_context.request_id);
1329     }
1330   } else {
1331     if (custom_context.link_followed.is_valid())
1332         frame_->sendPings(context_menu_node_, custom_context.link_followed);
1333     // Internal request, forward to WebKit.
1334     context_menu_node_.reset();
1335   }
1336 }
1337
1338 void RenderFrameImpl::OnCustomContextMenuAction(
1339     const CustomContextMenuContext& custom_context,
1340     unsigned action) {
1341   if (custom_context.request_id) {
1342     // External context menu request, look in our map.
1343     ContextMenuClient* client =
1344         pending_context_menus_.Lookup(custom_context.request_id);
1345     if (client)
1346       client->OnMenuAction(custom_context.request_id, action);
1347   } else {
1348     // Internal request, forward to WebKit.
1349     render_view_->webview()->performCustomContextMenuAction(action);
1350   }
1351 }
1352
1353 void RenderFrameImpl::OnUndo() {
1354   frame_->executeCommand(WebString::fromUTF8("Undo"), GetFocusedElement());
1355 }
1356
1357 void RenderFrameImpl::OnRedo() {
1358   frame_->executeCommand(WebString::fromUTF8("Redo"), GetFocusedElement());
1359 }
1360
1361 void RenderFrameImpl::OnCut() {
1362   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1363   frame_->executeCommand(WebString::fromUTF8("Cut"), GetFocusedElement());
1364 }
1365
1366 void RenderFrameImpl::OnCopy() {
1367   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1368   WebNode current_node = context_menu_node_.isNull() ?
1369       GetFocusedElement() : context_menu_node_;
1370   frame_->executeCommand(WebString::fromUTF8("Copy"), current_node);
1371 }
1372
1373 void RenderFrameImpl::OnPaste() {
1374   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1375   frame_->executeCommand(WebString::fromUTF8("Paste"), GetFocusedElement());
1376 }
1377
1378 void RenderFrameImpl::OnPasteAndMatchStyle() {
1379   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1380   frame_->executeCommand(
1381       WebString::fromUTF8("PasteAndMatchStyle"), GetFocusedElement());
1382 }
1383
1384 #if defined(OS_MACOSX)
1385 void RenderFrameImpl::OnCopyToFindPboard() {
1386   // Since the find pasteboard supports only plain text, this can be simpler
1387   // than the |OnCopy()| case.
1388   if (frame_->hasSelection()) {
1389     base::string16 selection = frame_->selectionAsText();
1390     RenderThread::Get()->Send(
1391         new ClipboardHostMsg_FindPboardWriteStringAsync(selection));
1392   }
1393 }
1394 #endif
1395
1396 void RenderFrameImpl::OnDelete() {
1397   frame_->executeCommand(WebString::fromUTF8("Delete"), GetFocusedElement());
1398 }
1399
1400 void RenderFrameImpl::OnSelectAll() {
1401   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1402   frame_->executeCommand(WebString::fromUTF8("SelectAll"), GetFocusedElement());
1403 }
1404
1405 void RenderFrameImpl::OnSelectRange(const gfx::Point& base,
1406                                     const gfx::Point& extent) {
1407   // This IPC is dispatched by RenderWidgetHost, so use its routing id.
1408   Send(new InputHostMsg_SelectRange_ACK(GetRenderWidget()->routing_id()));
1409
1410   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1411   frame_->selectRange(base, extent);
1412 }
1413
1414 void RenderFrameImpl::OnAdjustSelectionByCharacterOffset(int start_adjust,
1415                                                          int end_adjust) {
1416   size_t start, length;
1417   if (!GetRenderWidget()->webwidget()->caretOrSelectionRange(
1418       &start, &length)) {
1419     return;
1420   }
1421
1422   // Sanity checks to disallow empty and out of range selections.
1423   if (start_adjust - end_adjust > static_cast<int>(length)
1424       || static_cast<int>(start) + start_adjust < 0) {
1425     return;
1426   }
1427
1428   // A negative adjust amount moves the selection towards the beginning of
1429   // the document, a positive amount moves the selection towards the end of
1430   // the document.
1431   start += start_adjust;
1432   length += end_adjust - start_adjust;
1433
1434   frame_->selectRange(WebRange::fromDocumentRange(frame_, start, length));
1435 }
1436
1437 void RenderFrameImpl::OnUnselect() {
1438   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1439   frame_->executeCommand(WebString::fromUTF8("Unselect"), GetFocusedElement());
1440 }
1441
1442 void RenderFrameImpl::OnMoveRangeSelectionExtent(const gfx::Point& point) {
1443   // This IPC is dispatched by RenderWidgetHost, so use its routing id.
1444   Send(new InputHostMsg_MoveRangeSelectionExtent_ACK(
1445       GetRenderWidget()->routing_id()));
1446
1447   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1448   frame_->moveRangeSelectionExtent(point);
1449 }
1450
1451 void RenderFrameImpl::OnReplace(const base::string16& text) {
1452   if (!frame_->hasSelection())
1453     frame_->selectWordAroundCaret();
1454
1455   frame_->replaceSelection(text);
1456 }
1457
1458 void RenderFrameImpl::OnReplaceMisspelling(const base::string16& text) {
1459   if (!frame_->hasSelection())
1460     return;
1461
1462   frame_->replaceMisspelledRange(text);
1463 }
1464
1465 void RenderFrameImpl::OnCSSInsertRequest(const std::string& css) {
1466   frame_->document().insertStyleSheet(WebString::fromUTF8(css));
1467 }
1468
1469 void RenderFrameImpl::OnAddMessageToConsole(ConsoleMessageLevel level,
1470                                             const std::string& message) {
1471   AddMessageToConsole(level, message);
1472 }
1473
1474 void RenderFrameImpl::OnJavaScriptExecuteRequest(
1475     const base::string16& jscript,
1476     int id,
1477     bool notify_result) {
1478   TRACE_EVENT_INSTANT0("test_tracing", "OnJavaScriptExecuteRequest",
1479                        TRACE_EVENT_SCOPE_THREAD);
1480
1481   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
1482   v8::Local<v8::Value> result =
1483       frame_->executeScriptAndReturnValue(WebScriptSource(jscript));
1484
1485   HandleJavascriptExecutionResult(jscript, id, notify_result, result);
1486 }
1487
1488 void RenderFrameImpl::OnJavaScriptExecuteRequestForTests(
1489     const base::string16& jscript,
1490     int id,
1491     bool notify_result,
1492     bool has_user_gesture) {
1493   TRACE_EVENT_INSTANT0("test_tracing", "OnJavaScriptExecuteRequestForTests",
1494                        TRACE_EVENT_SCOPE_THREAD);
1495
1496   // A bunch of tests expect to run code in the context of a user gesture, which
1497   // can grant additional privileges (e.g. the ability to create popups).
1498   scoped_ptr<blink::WebScopedUserGesture> gesture(
1499       has_user_gesture ? new blink::WebScopedUserGesture : nullptr);
1500   v8::HandleScope handle_scope(blink::mainThreadIsolate());
1501   v8::Local<v8::Value> result =
1502       frame_->executeScriptAndReturnValue(WebScriptSource(jscript));
1503
1504   HandleJavascriptExecutionResult(jscript, id, notify_result, result);
1505 }
1506
1507 void RenderFrameImpl::OnJavaScriptExecuteRequestInIsolatedWorld(
1508     const base::string16& jscript,
1509     int id,
1510     bool notify_result,
1511     int world_id) {
1512   TRACE_EVENT_INSTANT0("test_tracing",
1513                        "OnJavaScriptExecuteRequestInIsolatedWorld",
1514                        TRACE_EVENT_SCOPE_THREAD);
1515
1516   if (world_id <= ISOLATED_WORLD_ID_GLOBAL ||
1517       world_id > ISOLATED_WORLD_ID_MAX) {
1518     // Return if the world_id is not valid. world_id is passed as a plain int
1519     // over IPC and needs to be verified here, in the IPC endpoint.
1520     NOTREACHED();
1521     return;
1522   }
1523
1524   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
1525   WebScriptSource script = WebScriptSource(jscript);
1526   JavaScriptIsolatedWorldRequest* request = new JavaScriptIsolatedWorldRequest(
1527       id, notify_result, routing_id_, weak_factory_.GetWeakPtr());
1528   frame_->requestExecuteScriptInIsolatedWorld(world_id, &script, 1, 0, false,
1529                                               request);
1530 }
1531
1532 RenderFrameImpl::JavaScriptIsolatedWorldRequest::JavaScriptIsolatedWorldRequest(
1533     int id,
1534     bool notify_result,
1535     int routing_id,
1536     base::WeakPtr<RenderFrameImpl> render_frame_impl)
1537     : id_(id),
1538       notify_result_(notify_result),
1539       routing_id_(routing_id),
1540       render_frame_impl_(render_frame_impl) {
1541 }
1542
1543 RenderFrameImpl::JavaScriptIsolatedWorldRequest::
1544     ~JavaScriptIsolatedWorldRequest() {
1545 }
1546
1547 void RenderFrameImpl::JavaScriptIsolatedWorldRequest::completed(
1548     const blink::WebVector<v8::Local<v8::Value>>& result) {
1549   if (!render_frame_impl_.get()) {
1550     return;
1551   }
1552
1553   if (notify_result_) {
1554     base::ListValue list;
1555     if (!result.isEmpty()) {
1556       // It's safe to always use the main world context when converting
1557       // here. V8ValueConverterImpl shouldn't actually care about the
1558       // context scope, and it switches to v8::Object's creation context
1559       // when encountered. (from extensions/renderer/script_injection.cc)
1560       v8::Local<v8::Context> context =
1561           render_frame_impl_.get()->frame_->mainWorldScriptContext();
1562       v8::Context::Scope context_scope(context);
1563       V8ValueConverterImpl converter;
1564       converter.SetDateAllowed(true);
1565       converter.SetRegExpAllowed(true);
1566       for (const auto& value : result) {
1567         scoped_ptr<base::Value> result_value(
1568             converter.FromV8Value(value, context));
1569         list.Append(result_value ? result_value.Pass()
1570                                  : base::Value::CreateNullValue());
1571       }
1572     } else {
1573       list.Set(0, base::Value::CreateNullValue());
1574     }
1575     render_frame_impl_.get()->Send(
1576         new FrameHostMsg_JavaScriptExecuteResponse(routing_id_, id_, list));
1577   }
1578
1579   delete this;
1580 }
1581
1582 void RenderFrameImpl::HandleJavascriptExecutionResult(
1583     const base::string16& jscript,
1584     int id,
1585     bool notify_result,
1586     v8::Local<v8::Value> result) {
1587   if (notify_result) {
1588     base::ListValue list;
1589     if (!result.IsEmpty()) {
1590       v8::Local<v8::Context> context = frame_->mainWorldScriptContext();
1591       v8::Context::Scope context_scope(context);
1592       V8ValueConverterImpl converter;
1593       converter.SetDateAllowed(true);
1594       converter.SetRegExpAllowed(true);
1595       scoped_ptr<base::Value> result_value(
1596           converter.FromV8Value(result, context));
1597       list.Set(0, result_value ? result_value.Pass()
1598                                : base::Value::CreateNullValue());
1599     } else {
1600       list.Set(0, base::Value::CreateNullValue());
1601     }
1602     Send(new FrameHostMsg_JavaScriptExecuteResponse(routing_id_, id, list));
1603   }
1604 }
1605
1606 void RenderFrameImpl::OnVisualStateRequest(uint64 id) {
1607   GetRenderWidget()->QueueMessage(
1608       new FrameHostMsg_VisualStateResponse(routing_id_, id),
1609       MESSAGE_DELIVERY_POLICY_WITH_VISUAL_STATE);
1610 }
1611
1612 void RenderFrameImpl::OnSetEditableSelectionOffsets(int start, int end) {
1613   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1614   if (!GetRenderWidget()->ShouldHandleImeEvent())
1615     return;
1616   ImeEventGuard guard(GetRenderWidget());
1617   frame_->setEditableSelectionOffsets(start, end);
1618 }
1619
1620 void RenderFrameImpl::OnSetCompositionFromExistingText(
1621     int start, int end,
1622     const std::vector<blink::WebCompositionUnderline>& underlines) {
1623   if (!GetRenderWidget()->ShouldHandleImeEvent())
1624     return;
1625   ImeEventGuard guard(GetRenderWidget());
1626   frame_->setCompositionFromExistingText(start, end, underlines);
1627 }
1628
1629 void RenderFrameImpl::OnExecuteNoValueEditCommand(const std::string& name) {
1630   frame_->executeCommand(WebString::fromUTF8(name), GetFocusedElement());
1631 }
1632
1633 void RenderFrameImpl::OnExtendSelectionAndDelete(int before, int after) {
1634   if (!GetRenderWidget()->ShouldHandleImeEvent())
1635     return;
1636
1637   DCHECK(!WebUserGestureIndicator::isProcessingUserGesture());
1638
1639   ImeEventGuard guard(GetRenderWidget());
1640   blink::WebScopedUserGesture gesture_indicator;
1641   frame_->extendSelectionAndDelete(before, after);
1642 }
1643
1644 void RenderFrameImpl::OnSetAccessibilityMode(AccessibilityMode new_mode) {
1645   if (accessibility_mode_ == new_mode)
1646     return;
1647   accessibility_mode_ = new_mode;
1648   if (renderer_accessibility_) {
1649     // Note: this isn't called automatically by the destructor because
1650     // there'd be no point in calling it in frame teardown, only if there's
1651     // an accessibility mode change but the frame is persisting.
1652     renderer_accessibility_->DisableAccessibility();
1653
1654     delete renderer_accessibility_;
1655     renderer_accessibility_ = NULL;
1656   }
1657   if (accessibility_mode_ == AccessibilityModeOff)
1658     return;
1659
1660   if (accessibility_mode_ & AccessibilityModeFlagFullTree)
1661     renderer_accessibility_ = new RendererAccessibility(this);
1662 }
1663
1664 void RenderFrameImpl::OnSnapshotAccessibilityTree(int callback_id) {
1665   ui::AXTreeUpdate<AXContentNodeData> response;
1666   RendererAccessibility::SnapshotAccessibilityTree(this, &response);
1667   Send(new AccessibilityHostMsg_SnapshotResponse(
1668       routing_id_, callback_id, response));
1669 }
1670
1671 void RenderFrameImpl::OnUpdateOpener(int opener_routing_id) {
1672   WebFrame* opener = ResolveOpener(opener_routing_id, nullptr);
1673   frame_->setOpener(opener);
1674 }
1675
1676 void RenderFrameImpl::OnDidUpdateSandboxFlags(blink::WebSandboxFlags flags) {
1677   frame_->setFrameOwnerSandboxFlags(flags);
1678 }
1679
1680 void RenderFrameImpl::OnTextTrackSettingsChanged(
1681     const FrameMsg_TextTrackSettings_Params& params) {
1682   DCHECK(!frame_->parent());
1683   if (!render_view_->webview())
1684     return;
1685
1686   if (params.text_tracks_enabled) {
1687       render_view_->webview()->settings()->setTextTrackKindUserPreference(
1688           WebSettings::TextTrackKindUserPreference::Captions);
1689   } else {
1690       render_view_->webview()->settings()->setTextTrackKindUserPreference(
1691           WebSettings::TextTrackKindUserPreference::Default);
1692   }
1693   render_view_->webview()->settings()->setTextTrackBackgroundColor(
1694       WebString::fromUTF8(params.text_track_background_color));
1695   render_view_->webview()->settings()->setTextTrackFontFamily(
1696       WebString::fromUTF8(params.text_track_font_family));
1697   render_view_->webview()->settings()->setTextTrackFontStyle(
1698       WebString::fromUTF8(params.text_track_font_style));
1699   render_view_->webview()->settings()->setTextTrackFontVariant(
1700       WebString::fromUTF8(params.text_track_font_variant));
1701   render_view_->webview()->settings()->setTextTrackTextColor(
1702       WebString::fromUTF8(params.text_track_text_color));
1703   render_view_->webview()->settings()->setTextTrackTextShadow(
1704       WebString::fromUTF8(params.text_track_text_shadow));
1705   render_view_->webview()->settings()->setTextTrackTextSize(
1706       WebString::fromUTF8(params.text_track_text_size));
1707 }
1708
1709 void RenderFrameImpl::OnPostMessageEvent(
1710     const FrameMsg_PostMessage_Params& params) {
1711   // Find the source frame if it exists.
1712   WebFrame* source_frame = NULL;
1713   if (params.source_routing_id != MSG_ROUTING_NONE) {
1714     RenderFrameProxy* source_proxy =
1715         RenderFrameProxy::FromRoutingID(params.source_routing_id);
1716     if (source_proxy) {
1717       // Currently, navigating a top-level frame cross-process does not swap
1718       // the WebLocalFrame for a WebRemoteFrame in the frame tree, and the
1719       // WebRemoteFrame will not have an associated blink::Frame. If this is
1720       // the case for |source_proxy|, use the corresponding (swapped-out)
1721       // WebLocalFrame instead, so that event.source for this message can be
1722       // set and used properly.
1723       if (source_proxy->IsMainFrameDetachedFromTree())
1724         source_frame = source_proxy->render_view()->webview()->mainFrame();
1725       else
1726         source_frame = source_proxy->web_frame();
1727     }
1728   }
1729
1730   // If the message contained MessagePorts, create the corresponding endpoints.
1731   blink::WebMessagePortChannelArray channels =
1732       WebMessagePortChannelImpl::CreatePorts(
1733           params.message_ports, params.new_routing_ids,
1734           base::ThreadTaskRunnerHandle::Get().get());
1735
1736   WebSerializedScriptValue serialized_script_value;
1737   if (params.is_data_raw_string) {
1738     v8::HandleScope handle_scope(blink::mainThreadIsolate());
1739     v8::Local<v8::Context> context = frame_->mainWorldScriptContext();
1740     v8::Context::Scope context_scope(context);
1741     V8ValueConverterImpl converter;
1742     converter.SetDateAllowed(true);
1743     converter.SetRegExpAllowed(true);
1744     scoped_ptr<base::Value> value(new base::StringValue(params.data));
1745     v8::Local<v8::Value> result_value = converter.ToV8Value(value.get(),
1746                                                              context);
1747     serialized_script_value = WebSerializedScriptValue::serialize(result_value);
1748   } else {
1749     serialized_script_value = WebSerializedScriptValue::fromString(params.data);
1750   }
1751
1752   // Create an event with the message.  The next-to-last parameter to
1753   // initMessageEvent is the last event ID, which is not used with postMessage.
1754   WebDOMEvent event = frame_->document().createEvent("MessageEvent");
1755   WebDOMMessageEvent msg_event = event.to<WebDOMMessageEvent>();
1756   msg_event.initMessageEvent("message",
1757                              // |canBubble| and |cancellable| are always false
1758                              false, false,
1759                              serialized_script_value,
1760                              params.source_origin, source_frame,
1761                              frame_->document(), "", channels);
1762
1763   // We must pass in the target_origin to do the security check on this side,
1764   // since it may have changed since the original postMessage call was made.
1765   WebSecurityOrigin target_origin;
1766   if (!params.target_origin.empty()) {
1767     target_origin =
1768         WebSecurityOrigin::createFromString(WebString(params.target_origin));
1769   }
1770   frame_->dispatchMessageEventWithOriginCheck(target_origin, msg_event);
1771 }
1772
1773 #if defined(OS_ANDROID)
1774 void RenderFrameImpl::OnSelectPopupMenuItems(
1775     bool canceled,
1776     const std::vector<int>& selected_indices) {
1777   // It is possible to receive more than one of these calls if the user presses
1778   // a select faster than it takes for the show-select-popup IPC message to make
1779   // it to the browser UI thread. Ignore the extra-messages.
1780   // TODO(jcivelli): http:/b/5793321 Implement a better fix, as detailed in bug.
1781   if (!external_popup_menu_)
1782     return;
1783
1784   external_popup_menu_->DidSelectItems(canceled, selected_indices);
1785   external_popup_menu_.reset();
1786 }
1787 #endif
1788
1789 #if defined(OS_MACOSX)
1790 void RenderFrameImpl::OnSelectPopupMenuItem(int selected_index) {
1791   if (external_popup_menu_ == NULL)
1792     return;
1793   external_popup_menu_->DidSelectItem(selected_index);
1794   external_popup_menu_.reset();
1795 }
1796 #endif
1797
1798 void RenderFrameImpl::OnReload(bool ignore_cache) {
1799   frame_->reload(ignore_cache);
1800 }
1801
1802 void RenderFrameImpl::OnTextSurroundingSelectionRequest(size_t max_length) {
1803   blink::WebSurroundingText surroundingText;
1804   surroundingText.initialize(frame_->selectionRange(), max_length);
1805
1806   if (surroundingText.isNull()) {
1807     // |surroundingText| might not be correctly initialized, for example if
1808     // |frame_->selectionRange().isNull()|, in other words, if there was no
1809     // selection.
1810     Send(new FrameHostMsg_TextSurroundingSelectionResponse(
1811         routing_id_, base::string16(), 0, 0));
1812     return;
1813   }
1814
1815   Send(new FrameHostMsg_TextSurroundingSelectionResponse(
1816       routing_id_,
1817       surroundingText.textContent(),
1818       surroundingText.startOffsetInTextContent(),
1819       surroundingText.endOffsetInTextContent()));
1820 }
1821
1822 bool RenderFrameImpl::RunJavaScriptMessage(JavaScriptMessageType type,
1823                                            const base::string16& message,
1824                                            const base::string16& default_value,
1825                                            const GURL& frame_url,
1826                                            base::string16* result) {
1827   // Don't allow further dialogs if we are waiting to swap out, since the
1828   // PageGroupLoadDeferrer in our stack prevents it.
1829   if (render_view()->suppress_dialogs_until_swap_out_)
1830     return false;
1831
1832   bool success = false;
1833   base::string16 result_temp;
1834   if (!result)
1835     result = &result_temp;
1836
1837   render_view()->SendAndRunNestedMessageLoop(
1838       new FrameHostMsg_RunJavaScriptMessage(
1839         routing_id_, message, default_value, frame_url, type, &success,
1840         result));
1841   return success;
1842 }
1843
1844 void RenderFrameImpl::LoadNavigationErrorPage(
1845     const WebURLRequest& failed_request,
1846     const WebURLError& error,
1847     bool replace) {
1848   std::string error_html;
1849   GetContentClient()->renderer()->GetNavigationErrorStrings(
1850       render_view(), frame_, failed_request, error, &error_html, NULL);
1851
1852   frame_->loadHTMLString(error_html,
1853                          GURL(kUnreachableWebDataURL),
1854                          error.unreachableURL,
1855                          replace);
1856 }
1857
1858 void RenderFrameImpl::DidCommitCompositorFrame() {
1859   if (BrowserPluginManager::Get())
1860     BrowserPluginManager::Get()->DidCommitCompositorFrame(GetRoutingID());
1861   FOR_EACH_OBSERVER(
1862       RenderFrameObserver, observers_, DidCommitCompositorFrame());
1863 }
1864
1865 RenderView* RenderFrameImpl::GetRenderView() {
1866   return render_view_.get();
1867 }
1868
1869 int RenderFrameImpl::GetRoutingID() {
1870   return routing_id_;
1871 }
1872
1873 blink::WebLocalFrame* RenderFrameImpl::GetWebFrame() {
1874   DCHECK(frame_);
1875   return frame_;
1876 }
1877
1878 WebElement RenderFrameImpl::GetFocusedElement() const {
1879   WebDocument doc = frame_->document();
1880   if (!doc.isNull())
1881     return doc.focusedElement();
1882
1883   return WebElement();
1884 }
1885
1886 WebPreferences& RenderFrameImpl::GetWebkitPreferences() {
1887   return render_view_->GetWebkitPreferences();
1888 }
1889
1890 int RenderFrameImpl::ShowContextMenu(ContextMenuClient* client,
1891                                      const ContextMenuParams& params) {
1892   DCHECK(client);  // A null client means "internal" when we issue callbacks.
1893   ContextMenuParams our_params(params);
1894   our_params.custom_context.request_id = pending_context_menus_.Add(client);
1895   Send(new FrameHostMsg_ContextMenu(routing_id_, our_params));
1896   return our_params.custom_context.request_id;
1897 }
1898
1899 void RenderFrameImpl::CancelContextMenu(int request_id) {
1900   DCHECK(pending_context_menus_.Lookup(request_id));
1901   pending_context_menus_.Remove(request_id);
1902 }
1903
1904 blink::WebNode RenderFrameImpl::GetContextMenuNode() const {
1905   return context_menu_node_;
1906 }
1907
1908 blink::WebPlugin* RenderFrameImpl::CreatePlugin(
1909     blink::WebFrame* frame,
1910     const WebPluginInfo& info,
1911     const blink::WebPluginParams& params,
1912     scoped_ptr<content::PluginInstanceThrottler> throttler) {
1913   DCHECK_EQ(frame_, frame);
1914 #if defined(ENABLE_PLUGINS)
1915   if (info.type == WebPluginInfo::PLUGIN_TYPE_BROWSER_PLUGIN) {
1916     return BrowserPluginManager::Get()->CreateBrowserPlugin(
1917         this, GetContentClient()
1918                   ->renderer()
1919                   ->CreateBrowserPluginDelegate(this, params.mimeType.utf8(),
1920                                                 GURL(params.url))
1921                   ->GetWeakPtr());
1922   }
1923
1924   bool pepper_plugin_was_registered = false;
1925   scoped_refptr<PluginModule> pepper_module(PluginModule::Create(
1926       this, info, &pepper_plugin_was_registered));
1927   if (pepper_plugin_was_registered) {
1928     if (pepper_module.get()) {
1929       return new PepperWebPluginImpl(
1930           pepper_module.get(), params, this,
1931           make_scoped_ptr(
1932               static_cast<PluginInstanceThrottlerImpl*>(throttler.release())));
1933     }
1934   }
1935 #if defined(OS_CHROMEOS)
1936   LOG(WARNING) << "Pepper module/plugin creation failed.";
1937 #else
1938   if (info.type == WebPluginInfo::PLUGIN_TYPE_NPAPI) {
1939     // TODO(jam): change to take RenderFrame.
1940     return new WebPluginImpl(frame, params, info.path, render_view_, this);
1941   }
1942 #endif
1943 #endif
1944   return NULL;
1945 }
1946
1947 void RenderFrameImpl::LoadURLExternally(blink::WebLocalFrame* frame,
1948                                         const blink::WebURLRequest& request,
1949                                         blink::WebNavigationPolicy policy) {
1950   DCHECK(!frame_ || frame_ == frame);
1951   loadURLExternally(frame, request, policy, WebString());
1952 }
1953
1954 void RenderFrameImpl::ExecuteJavaScript(const base::string16& javascript) {
1955   OnJavaScriptExecuteRequest(javascript, 0, false);
1956 }
1957
1958 ServiceRegistry* RenderFrameImpl::GetServiceRegistry() {
1959   return &service_registry_;
1960 }
1961
1962 #if defined(ENABLE_PLUGINS)
1963 void RenderFrameImpl::RegisterPeripheralPlugin(
1964     const GURL& content_origin,
1965     const base::Closure& unthrottle_callback) {
1966   return plugin_power_saver_helper_->RegisterPeripheralPlugin(
1967       content_origin, unthrottle_callback);
1968 }
1969 #endif  // defined(ENABLE_PLUGINS)
1970
1971 bool RenderFrameImpl::IsFTPDirectoryListing() {
1972   WebURLResponseExtraDataImpl* extra_data =
1973       GetExtraDataFromResponse(frame_->dataSource()->response());
1974   return extra_data ? extra_data->is_ftp_directory_listing() : false;
1975 }
1976
1977 void RenderFrameImpl::AttachGuest(int element_instance_id) {
1978   BrowserPluginManager::Get()->Attach(element_instance_id);
1979 }
1980
1981 void RenderFrameImpl::DetachGuest(int element_instance_id) {
1982   BrowserPluginManager::Get()->Detach(element_instance_id);
1983 }
1984
1985 void RenderFrameImpl::SetSelectedText(const base::string16& selection_text,
1986                                       size_t offset,
1987                                       const gfx::Range& range) {
1988   // Use the routing id of Render Widget Host.
1989   Send(new ViewHostMsg_SelectionChanged(GetRenderWidget()->routing_id(),
1990                                         selection_text,
1991                                         offset,
1992                                         range));
1993 }
1994
1995 void RenderFrameImpl::EnsureMojoBuiltinsAreAvailable(
1996     v8::Isolate* isolate,
1997     v8::Local<v8::Context> context) {
1998   gin::ModuleRegistry* registry = gin::ModuleRegistry::From(context);
1999   if (registry->available_modules().count(mojo::js::Core::kModuleName))
2000     return;
2001
2002   v8::HandleScope handle_scope(isolate);
2003   registry->AddBuiltinModule(
2004       isolate, mojo::js::Core::kModuleName, mojo::js::Core::GetModule(isolate));
2005   registry->AddBuiltinModule(isolate,
2006                              mojo::js::Support::kModuleName,
2007                              mojo::js::Support::GetModule(isolate));
2008   registry->AddBuiltinModule(
2009       isolate,
2010       ServiceRegistryJsWrapper::kModuleName,
2011       ServiceRegistryJsWrapper::Create(isolate, &service_registry_).ToV8());
2012 }
2013
2014 void RenderFrameImpl::AddMessageToConsole(ConsoleMessageLevel level,
2015                                           const std::string& message) {
2016   if (devtools_agent_)
2017     devtools_agent_->AddMessageToConsole(level, message);
2018 }
2019
2020 // blink::WebFrameClient implementation ----------------------------------------
2021
2022 blink::WebPlugin* RenderFrameImpl::createPlugin(
2023     blink::WebLocalFrame* frame,
2024     const blink::WebPluginParams& params) {
2025   DCHECK_EQ(frame_, frame);
2026   blink::WebPlugin* plugin = NULL;
2027   if (GetContentClient()->renderer()->OverrideCreatePlugin(
2028           this, frame, params, &plugin)) {
2029     return plugin;
2030   }
2031
2032   if (base::UTF16ToUTF8(base::StringPiece16(params.mimeType)) ==
2033       kBrowserPluginMimeType) {
2034     return BrowserPluginManager::Get()->CreateBrowserPlugin(
2035         this, GetContentClient()
2036                   ->renderer()
2037                   ->CreateBrowserPluginDelegate(this, kBrowserPluginMimeType,
2038                                                 GURL(params.url))
2039                   ->GetWeakPtr());
2040   }
2041
2042 #if defined(ENABLE_PLUGINS)
2043   WebPluginInfo info;
2044   std::string mime_type;
2045   bool found = false;
2046   WebString top_origin = frame->top()->securityOrigin().toString();
2047   Send(new FrameHostMsg_GetPluginInfo(routing_id_, params.url, GURL(top_origin),
2048                                       params.mimeType.utf8(), &found, &info,
2049                                       &mime_type));
2050   if (!found)
2051     return NULL;
2052
2053   WebPluginParams params_to_use = params;
2054   params_to_use.mimeType = WebString::fromUTF8(mime_type);
2055   return CreatePlugin(frame, info, params_to_use, nullptr /* throttler */);
2056 #else
2057   return NULL;
2058 #endif  // defined(ENABLE_PLUGINS)
2059 }
2060
2061 blink::WebMediaPlayer* RenderFrameImpl::createMediaPlayer(
2062     blink::WebLocalFrame* frame,
2063     const blink::WebURL& url,
2064     WebMediaPlayerClient* client,
2065     WebMediaPlayerEncryptedMediaClient* encrypted_client,
2066     WebContentDecryptionModule* initial_cdm) {
2067 #if defined(VIDEO_HOLE)
2068   if (!contains_media_player_) {
2069     render_view_->RegisterVideoHoleFrame(this);
2070     contains_media_player_ = true;
2071   }
2072 #endif  // defined(VIDEO_HOLE)
2073
2074   blink::WebMediaStream web_stream(
2075       blink::WebMediaStreamRegistry::lookupMediaStreamDescriptor(url));
2076   if (!web_stream.isNull())
2077     return CreateWebMediaPlayerForMediaStream(client);
2078
2079   RenderThreadImpl* render_thread = RenderThreadImpl::current();
2080
2081 #if defined(OS_ANDROID) && !defined(ENABLE_MEDIA_PIPELINE_ON_ANDROID)
2082   scoped_refptr<media::AudioRendererSink> audio_renderer_sink;
2083   media::WebMediaPlayerParams::Context3DCB context_3d_cb;
2084 #else
2085   scoped_refptr<media::AudioRendererSink> audio_renderer_sink =
2086       render_thread->GetAudioRendererMixerManager()->CreateInput(routing_id_);
2087   media::WebMediaPlayerParams::Context3DCB context_3d_cb =
2088       base::Bind(&GetSharedMainThreadContext3D);
2089 #endif  // defined(OS_ANDROID) && !defined(ENABLE_MEDIA_PIPELINE_ON_ANDROID)
2090
2091   scoped_refptr<media::MediaLog> media_log(new RenderMediaLog());
2092   media::WebMediaPlayerParams params(
2093       base::Bind(&ContentRendererClient::DeferMediaLoad,
2094                  base::Unretained(GetContentClient()->renderer()),
2095                  static_cast<RenderFrame*>(this), has_played_media_),
2096       audio_renderer_sink, media_log, render_thread->GetMediaThreadTaskRunner(),
2097       render_thread->GetWorkerTaskRunner(),
2098       render_thread->compositor_task_runner(), context_3d_cb,
2099       GetMediaPermission(), initial_cdm);
2100
2101 #if defined(OS_ANDROID) && !defined(ENABLE_MEDIA_PIPELINE_ON_ANDROID)
2102   return CreateAndroidWebMediaPlayer(client, encrypted_client, params);
2103 #else
2104 #if defined(ENABLE_MOJO_MEDIA)
2105   scoped_ptr<media::RendererFactory> media_renderer_factory(
2106       new media::MojoRendererFactory(GetMediaServiceFactory()));
2107 #else
2108   scoped_ptr<media::RendererFactory> media_renderer_factory =
2109       GetContentClient()->renderer()->CreateMediaRendererFactory(
2110           this, render_thread->GetGpuFactories(), media_log);
2111
2112   if (!media_renderer_factory.get()) {
2113     media_renderer_factory.reset(new media::DefaultRendererFactory(
2114         media_log, render_thread->GetGpuFactories(),
2115         *render_thread->GetAudioHardwareConfig()));
2116   }
2117 #endif  // defined(ENABLE_MOJO_MEDIA)
2118
2119   return new media::WebMediaPlayerImpl(
2120       frame, client, encrypted_client, weak_factory_.GetWeakPtr(),
2121       media_renderer_factory.Pass(), GetCdmFactory(), params);
2122 #endif  // defined(OS_ANDROID) && !defined(ENABLE_MEDIA_PIPELINE_ON_ANDROID)
2123 }
2124
2125 blink::WebApplicationCacheHost* RenderFrameImpl::createApplicationCacheHost(
2126     blink::WebLocalFrame* frame,
2127     blink::WebApplicationCacheHostClient* client) {
2128   if (!frame || !frame->view())
2129     return NULL;
2130   DCHECK(!frame_ || frame_ == frame);
2131   return new RendererWebApplicationCacheHostImpl(
2132       RenderViewImpl::FromWebView(frame->view()), client,
2133       RenderThreadImpl::current()->appcache_dispatcher()->backend_proxy());
2134 }
2135
2136 blink::WebWorkerContentSettingsClientProxy*
2137 RenderFrameImpl::createWorkerContentSettingsClientProxy(
2138     blink::WebLocalFrame* frame) {
2139   if (!frame || !frame->view())
2140     return NULL;
2141   DCHECK(!frame_ || frame_ == frame);
2142   return GetContentClient()->renderer()->CreateWorkerContentSettingsClientProxy(
2143       this, frame);
2144 }
2145
2146 WebExternalPopupMenu* RenderFrameImpl::createExternalPopupMenu(
2147     const WebPopupMenuInfo& popup_menu_info,
2148     WebExternalPopupMenuClient* popup_menu_client) {
2149 #if defined(OS_MACOSX) || defined(OS_ANDROID)
2150   // An IPC message is sent to the browser to build and display the actual
2151   // popup. The user could have time to click a different select by the time
2152   // the popup is shown. In that case external_popup_menu_ is non NULL.
2153   // By returning NULL in that case, we instruct Blink to cancel that new
2154   // popup. So from the user perspective, only the first one will show, and
2155   // will have to close the first one before another one can be shown.
2156   if (external_popup_menu_)
2157     return NULL;
2158   external_popup_menu_.reset(
2159       new ExternalPopupMenu(this, popup_menu_info, popup_menu_client));
2160   if (render_view_->screen_metrics_emulator_) {
2161     render_view_->SetExternalPopupOriginAdjustmentsForEmulation(
2162         external_popup_menu_.get(),
2163         render_view_->screen_metrics_emulator_.get());
2164   }
2165   return external_popup_menu_.get();
2166 #else
2167   return NULL;
2168 #endif
2169 }
2170
2171 blink::WebCookieJar* RenderFrameImpl::cookieJar(blink::WebLocalFrame* frame) {
2172   DCHECK(!frame_ || frame_ == frame);
2173   return &cookie_jar_;
2174 }
2175
2176 blink::WebServiceWorkerProvider* RenderFrameImpl::createServiceWorkerProvider(
2177     blink::WebLocalFrame* frame) {
2178   DCHECK(!frame_ || frame_ == frame);
2179   // At this point we should have non-null data source.
2180   DCHECK(frame->dataSource());
2181   if (!ChildThreadImpl::current())
2182     return NULL;  // May be null in some tests.
2183   ServiceWorkerNetworkProvider* provider =
2184       ServiceWorkerNetworkProvider::FromDocumentState(
2185           DocumentState::FromDataSource(frame->dataSource()));
2186   DCHECK(provider);
2187   return new WebServiceWorkerProviderImpl(
2188       ChildThreadImpl::current()->thread_safe_sender(),
2189       provider->context());
2190 }
2191
2192 void RenderFrameImpl::didAccessInitialDocument(blink::WebLocalFrame* frame) {
2193   DCHECK(!frame_ || frame_ == frame);
2194   // If the request hasn't yet committed, notify the browser process that it is
2195   // no longer safe to show the pending URL of the main frame, since a URL spoof
2196   // is now possible. (If the request has committed, the browser already knows.)
2197   if (!frame->parent()) {
2198     DocumentState* document_state =
2199         DocumentState::FromDataSource(frame->dataSource());
2200     NavigationStateImpl* navigation_state =
2201         static_cast<NavigationStateImpl*>(document_state->navigation_state());
2202
2203     if (!navigation_state->request_committed()) {
2204       Send(new FrameHostMsg_DidAccessInitialDocument(routing_id_));
2205     }
2206   }
2207 }
2208
2209 blink::WebFrame* RenderFrameImpl::createChildFrame(
2210     blink::WebLocalFrame* parent,
2211     blink::WebTreeScopeType scope,
2212     const blink::WebString& name,
2213     blink::WebSandboxFlags sandbox_flags) {
2214   // Synchronously notify the browser of a child frame creation to get the
2215   // routing_id for the RenderFrame.
2216   int child_routing_id = MSG_ROUTING_NONE;
2217   Send(new FrameHostMsg_CreateChildFrame(
2218       routing_id_, scope,
2219       base::UTF16ToUTF8(base::StringPiece16(name)), sandbox_flags,
2220       &child_routing_id));
2221
2222   // Allocation of routing id failed, so we can't create a child frame. This can
2223   // happen if this RenderFrameImpl's IPCs are being filtered when in swapped
2224   // out state or synchronous IPC message above has failed.
2225   if (child_routing_id == MSG_ROUTING_NONE) {
2226     NOTREACHED() << "Failed to allocate routing id for child frame.";
2227     return nullptr;
2228   }
2229
2230   // Create the RenderFrame and WebLocalFrame, linking the two.
2231   RenderFrameImpl* child_render_frame = RenderFrameImpl::Create(
2232       render_view_.get(), child_routing_id);
2233   blink::WebLocalFrame* web_frame =
2234       WebLocalFrame::create(scope, child_render_frame);
2235   child_render_frame->SetWebFrame(web_frame);
2236
2237   // Add the frame to the frame tree and initialize it.
2238   parent->appendChild(web_frame);
2239   child_render_frame->Initialize();
2240
2241   return web_frame;
2242 }
2243
2244 void RenderFrameImpl::didChangeOpener(blink::WebFrame* opener) {
2245   // Only active frames are able to disown their opener.
2246   if (!opener && is_swapped_out_)
2247     return;
2248
2249   // Only a local frame should be able to update another frame's opener.
2250   DCHECK(!opener || opener->isWebLocalFrame());
2251
2252   int opener_routing_id = opener ?
2253       RenderFrameImpl::FromWebFrame(opener->toWebLocalFrame())->GetRoutingID() :
2254       MSG_ROUTING_NONE;
2255   Send(new FrameHostMsg_DidChangeOpener(routing_id_, opener_routing_id));
2256 }
2257
2258 void RenderFrameImpl::frameDetached(blink::WebFrame* frame, DetachType type) {
2259   // NOTE: This function is called on the frame that is being detached and not
2260   // the parent frame.  This is different from createChildFrame() which is
2261   // called on the parent frame.
2262   CHECK(!is_detaching_);
2263   DCHECK(!frame_ || frame_ == frame);
2264
2265   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, FrameDetached());
2266   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2267                     FrameDetached(frame));
2268
2269   // We only notify the browser process when the frame is being detached for
2270   // removal. If the frame is being detached for swap, we don't need to do this
2271   // since we are not modifiying the frame tree.
2272   if (type == DetachType::Remove)
2273     Send(new FrameHostMsg_Detach(routing_id_));
2274
2275   // The |is_detaching_| flag disables Send(). FrameHostMsg_Detach must be
2276   // sent before setting |is_detaching_| to true.
2277   is_detaching_ = true;
2278
2279   // Clean up the associated RenderWidget for the frame, if there is one.
2280   if (render_widget_) {
2281     render_widget_->UnregisterRenderFrame(this);
2282     render_widget_->CloseForFrame();
2283   }
2284
2285   // We need to clean up subframes by removing them from the map and deleting
2286   // the RenderFrameImpl.  In contrast, the main frame is owned by its
2287   // containing RenderViewHost (so that they have the same lifetime), so only
2288   // removal from the map is needed and no deletion.
2289   FrameMap::iterator it = g_frame_map.Get().find(frame);
2290   CHECK(it != g_frame_map.Get().end());
2291   CHECK_EQ(it->second, this);
2292   g_frame_map.Get().erase(it);
2293
2294   // Only remove the frame from the renderer's frame tree if the frame is
2295   // being detached for removal. In the case of a swap, the frame needs to
2296   // remain in the tree so WebFrame::swap() can replace it with the new frame.
2297   if (is_subframe_ && type == DetachType::Remove)
2298     frame->parent()->removeChild(frame);
2299
2300   // |frame| is invalid after here.  Be sure to clear frame_ as well, since this
2301   // object may not be deleted immediately and other methods may try to access
2302   // it.
2303   frame->close();
2304   frame_ = nullptr;
2305
2306   delete this;
2307   // Object is invalid after this point.
2308 }
2309
2310 void RenderFrameImpl::frameFocused() {
2311   Send(new FrameHostMsg_FrameFocused(routing_id_));
2312 }
2313
2314 void RenderFrameImpl::willClose(blink::WebFrame* frame) {
2315   DCHECK(!frame_ || frame_ == frame);
2316
2317   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, FrameWillClose());
2318   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2319                     FrameWillClose(frame));
2320 }
2321
2322 void RenderFrameImpl::didChangeName(blink::WebLocalFrame* frame,
2323                                     const blink::WebString& name) {
2324   DCHECK(!frame_ || frame_ == frame);
2325
2326   // TODO(alexmos): According to https://crbug.com/169110, sending window.name
2327   // updates may have performance implications for benchmarks like SunSpider.
2328   // For now, send these updates only for --site-per-process, which needs to
2329   // replicate frame names to frame proxies, and when
2330   // |report_frame_name_changes| is set (used by <webview>).  If needed, this
2331   // can be optimized further by only sending the update if there are any
2332   // remote frames in the frame tree, or delaying and batching up IPCs if
2333   // updates are happening too frequently.
2334   if (SiteIsolationPolicy::AreCrossProcessFramesPossible() ||
2335       render_view_->renderer_preferences_.report_frame_name_changes) {
2336     Send(new FrameHostMsg_DidChangeName(
2337         routing_id_, base::UTF16ToUTF8(base::StringPiece16(name))));
2338   }
2339 }
2340
2341 void RenderFrameImpl::didChangeSandboxFlags(blink::WebFrame* child_frame,
2342                                             blink::WebSandboxFlags flags) {
2343   int frame_routing_id = MSG_ROUTING_NONE;
2344   if (child_frame->isWebRemoteFrame()) {
2345     frame_routing_id =
2346         RenderFrameProxy::FromWebFrame(child_frame)->routing_id();
2347   } else {
2348     frame_routing_id =
2349         RenderFrameImpl::FromWebFrame(child_frame)->GetRoutingID();
2350   }
2351
2352   Send(new FrameHostMsg_DidChangeSandboxFlags(routing_id_, frame_routing_id,
2353                                               flags));
2354 }
2355
2356 void RenderFrameImpl::didMatchCSS(
2357     blink::WebLocalFrame* frame,
2358     const blink::WebVector<blink::WebString>& newly_matching_selectors,
2359     const blink::WebVector<blink::WebString>& stopped_matching_selectors) {
2360   DCHECK(!frame_ || frame_ == frame);
2361
2362   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
2363                     DidMatchCSS(newly_matching_selectors,
2364                                 stopped_matching_selectors));
2365 }
2366
2367 bool RenderFrameImpl::shouldReportDetailedMessageForSource(
2368     const blink::WebString& source) {
2369   return GetContentClient()->renderer()->ShouldReportDetailedMessageForSource(
2370       source);
2371 }
2372
2373 void RenderFrameImpl::didAddMessageToConsole(
2374     const blink::WebConsoleMessage& message,
2375     const blink::WebString& source_name,
2376     unsigned source_line,
2377     const blink::WebString& stack_trace) {
2378   logging::LogSeverity log_severity = logging::LOG_VERBOSE;
2379   switch (message.level) {
2380     case blink::WebConsoleMessage::LevelDebug:
2381       log_severity = logging::LOG_VERBOSE;
2382       break;
2383     case blink::WebConsoleMessage::LevelLog:
2384     case blink::WebConsoleMessage::LevelInfo:
2385       log_severity = logging::LOG_INFO;
2386       break;
2387     case blink::WebConsoleMessage::LevelWarning:
2388       log_severity = logging::LOG_WARNING;
2389       break;
2390     case blink::WebConsoleMessage::LevelError:
2391       log_severity = logging::LOG_ERROR;
2392       break;
2393     default:
2394       log_severity = logging::LOG_VERBOSE;
2395   }
2396
2397   if (shouldReportDetailedMessageForSource(source_name)) {
2398     FOR_EACH_OBSERVER(
2399         RenderFrameObserver, observers_,
2400         DetailedConsoleMessageAdded(message.text,
2401                                     source_name,
2402                                     stack_trace,
2403                                     source_line,
2404                                     static_cast<int32>(log_severity)));
2405   }
2406
2407   Send(new FrameHostMsg_AddMessageToConsole(routing_id_,
2408                                             static_cast<int32>(log_severity),
2409                                             message.text,
2410                                             static_cast<int32>(source_line),
2411                                             source_name));
2412 }
2413
2414 void RenderFrameImpl::loadURLExternally(
2415     blink::WebLocalFrame* frame,
2416     const blink::WebURLRequest& request,
2417     blink::WebNavigationPolicy policy,
2418     const blink::WebString& suggested_name) {
2419   DCHECK(!frame_ || frame_ == frame);
2420   Referrer referrer(RenderViewImpl::GetReferrerFromRequest(frame, request));
2421   if (policy == blink::WebNavigationPolicyDownload) {
2422     render_view_->Send(new ViewHostMsg_DownloadUrl(render_view_->GetRoutingID(),
2423                                                    GetRoutingID(),
2424                                                    request.url(), referrer,
2425                                                    suggested_name));
2426   } else {
2427     OpenURL(frame, request.url(), referrer, policy);
2428   }
2429 }
2430
2431 blink::WebNavigationPolicy RenderFrameImpl::decidePolicyForNavigation(
2432     const NavigationPolicyInfo& info) {
2433   DCHECK(!frame_ || frame_ == info.frame);
2434   return DecidePolicyForNavigation(this, info);
2435 }
2436
2437 blink::WebHistoryItem RenderFrameImpl::historyItemForNewChildFrame(
2438     blink::WebFrame* frame) {
2439   DCHECK(!frame_ || frame_ == frame);
2440   return render_view_->history_controller()->GetItemForNewChildFrame(this);
2441 }
2442
2443 void RenderFrameImpl::willSendSubmitEvent(blink::WebLocalFrame* frame,
2444                                           const blink::WebFormElement& form) {
2445   DCHECK(!frame_ || frame_ == frame);
2446
2447   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WillSendSubmitEvent(form));
2448 }
2449
2450 void RenderFrameImpl::willSubmitForm(blink::WebLocalFrame* frame,
2451                                      const blink::WebFormElement& form) {
2452   DCHECK(!frame_ || frame_ == frame);
2453   DocumentState* document_state =
2454       DocumentState::FromDataSource(frame->provisionalDataSource());
2455   NavigationStateImpl* navigation_state =
2456       static_cast<NavigationStateImpl*>(document_state->navigation_state());
2457   InternalDocumentStateData* internal_data =
2458       InternalDocumentStateData::FromDocumentState(document_state);
2459
2460   if (ui::PageTransitionCoreTypeIs(navigation_state->GetTransitionType(),
2461                                    ui::PAGE_TRANSITION_LINK)) {
2462     navigation_state->set_transition_type(ui::PAGE_TRANSITION_FORM_SUBMIT);
2463   }
2464
2465   // Save these to be processed when the ensuing navigation is committed.
2466   WebSearchableFormData web_searchable_form_data(form);
2467   internal_data->set_searchable_form_url(web_searchable_form_data.url());
2468   internal_data->set_searchable_form_encoding(
2469       web_searchable_form_data.encoding().utf8());
2470
2471   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WillSubmitForm(form));
2472 }
2473
2474 void RenderFrameImpl::didCreateDataSource(blink::WebLocalFrame* frame,
2475                                           blink::WebDataSource* datasource) {
2476   DCHECK(!frame_ || frame_ == frame);
2477
2478   bool content_initiated = !pending_navigation_params_.get();
2479
2480   // Make sure any previous redirect URLs end up in our new data source.
2481   if (pending_navigation_params_.get()) {
2482     for (const auto& i :
2483          pending_navigation_params_->request_params.redirects) {
2484       datasource->appendRedirect(i);
2485     }
2486   }
2487
2488   DocumentState* document_state = DocumentState::FromDataSource(datasource);
2489   if (!document_state) {
2490     document_state = new DocumentState;
2491     datasource->setExtraData(document_state);
2492     if (!content_initiated)
2493       PopulateDocumentStateFromPending(document_state);
2494   }
2495
2496   // Carry over the user agent override flag, if it exists.
2497   blink::WebView* webview = render_view_->webview();
2498   if (content_initiated && webview && webview->mainFrame() &&
2499       webview->mainFrame()->isWebLocalFrame() &&
2500       webview->mainFrame()->dataSource()) {
2501     DocumentState* old_document_state =
2502         DocumentState::FromDataSource(webview->mainFrame()->dataSource());
2503     if (old_document_state) {
2504       InternalDocumentStateData* internal_data =
2505           InternalDocumentStateData::FromDocumentState(document_state);
2506       InternalDocumentStateData* old_internal_data =
2507           InternalDocumentStateData::FromDocumentState(old_document_state);
2508       internal_data->set_is_overriding_user_agent(
2509           old_internal_data->is_overriding_user_agent());
2510     }
2511   }
2512
2513   // The rest of RenderView assumes that a WebDataSource will always have a
2514   // non-null NavigationState.
2515   if (content_initiated) {
2516     document_state->set_navigation_state(
2517         NavigationStateImpl::CreateContentInitiated());
2518   } else {
2519     document_state->set_navigation_state(CreateNavigationStateFromPending());
2520     pending_navigation_params_.reset();
2521   }
2522
2523   // DocumentState::referred_by_prefetcher_ is true if we are
2524   // navigating from a page that used prefetching using a link on that
2525   // page.  We are early enough in the request process here that we
2526   // can still see the DocumentState of the previous page and set
2527   // this value appropriately.
2528   // TODO(gavinp): catch the important case of navigation in a new
2529   // renderer process.
2530   if (webview) {
2531     if (WebFrame* old_frame = webview->mainFrame()) {
2532       const WebURLRequest& original_request = datasource->originalRequest();
2533       const GURL referrer(
2534           original_request.httpHeaderField(WebString::fromUTF8("Referer")));
2535       if (!referrer.is_empty() && old_frame->isWebLocalFrame() &&
2536           DocumentState::FromDataSource(old_frame->dataSource())
2537               ->was_prefetcher()) {
2538         for (; old_frame; old_frame = old_frame->traverseNext(false)) {
2539           WebDataSource* old_frame_datasource = old_frame->dataSource();
2540           if (old_frame_datasource &&
2541               referrer == GURL(old_frame_datasource->request().url())) {
2542             document_state->set_was_referred_by_prefetcher(true);
2543             break;
2544           }
2545         }
2546       }
2547     }
2548   }
2549
2550   if (content_initiated) {
2551     const WebURLRequest& request = datasource->request();
2552     switch (request.cachePolicy()) {
2553       case WebURLRequest::UseProtocolCachePolicy:  // normal load.
2554         document_state->set_load_type(DocumentState::LINK_LOAD_NORMAL);
2555         break;
2556       case WebURLRequest::ReloadIgnoringCacheData:  // reload.
2557       case WebURLRequest::ReloadBypassingCache:     // end-to-end reload.
2558         document_state->set_load_type(DocumentState::LINK_LOAD_RELOAD);
2559         break;
2560       case WebURLRequest::ReturnCacheDataElseLoad:  // allow stale data.
2561         document_state->set_load_type(DocumentState::LINK_LOAD_CACHE_STALE_OK);
2562         break;
2563       case WebURLRequest::ReturnCacheDataDontLoad:  // Don't re-post.
2564         document_state->set_load_type(DocumentState::LINK_LOAD_CACHE_ONLY);
2565         break;
2566       default:
2567         NOTREACHED();
2568     }
2569   }
2570
2571   // Create the serviceworker's per-document network observing object if it
2572   // does not exist (When navigation happens within a page, the provider already
2573   // exists).
2574   if (!ServiceWorkerNetworkProvider::FromDocumentState(
2575           DocumentState::FromDataSource(datasource))) {
2576     ServiceWorkerProviderType provider_type =
2577         SERVICE_WORKER_PROVIDER_FOR_WINDOW;
2578     if ((frame->effectiveSandboxFlags() & blink::WebSandboxFlags::Origin) ==
2579         blink::WebSandboxFlags::Origin) {
2580       provider_type = SERVICE_WORKER_PROVIDER_FOR_SANDBOXED_FRAME;
2581     }
2582     scoped_ptr<ServiceWorkerNetworkProvider> network_provider(
2583         new ServiceWorkerNetworkProvider(routing_id_, provider_type));
2584     ServiceWorkerNetworkProvider::AttachToDocumentState(
2585         DocumentState::FromDataSource(datasource),
2586         network_provider.Pass());
2587   }
2588 }
2589
2590 void RenderFrameImpl::didStartProvisionalLoad(blink::WebLocalFrame* frame,
2591                                               double triggering_event_time) {
2592   DCHECK(!frame_ || frame_ == frame);
2593   WebDataSource* ds = frame->provisionalDataSource();
2594
2595   // In fast/loader/stop-provisional-loads.html, we abort the load before this
2596   // callback is invoked.
2597   if (!ds)
2598     return;
2599
2600   TRACE_EVENT2("navigation", "RenderFrameImpl::didStartProvisionalLoad",
2601                "id", routing_id_, "url", ds->request().url().string().utf8());
2602   DocumentState* document_state = DocumentState::FromDataSource(ds);
2603
2604   // We should only navigate to swappedout:// when is_swapped_out_ is true.
2605   CHECK_IMPLIES(ds->request().url() == GURL(kSwappedOutURL), is_swapped_out_)
2606       << "Heard swappedout:// when not swapped out.";
2607
2608   // Update the request time if WebKit has better knowledge of it.
2609   if (document_state->request_time().is_null() &&
2610           triggering_event_time != 0.0) {
2611     document_state->set_request_time(Time::FromDoubleT(triggering_event_time));
2612   }
2613
2614   // Start time is only set after request time.
2615   document_state->set_start_load_time(Time::Now());
2616
2617   bool is_top_most = !frame->parent();
2618   if (is_top_most) {
2619     render_view_->set_navigation_gesture(
2620         WebUserGestureIndicator::isProcessingUserGesture() ?
2621             NavigationGestureUser : NavigationGestureAuto);
2622   } else if (ds->replacesCurrentHistoryItem()) {
2623     // Subframe navigations that don't add session history items must be
2624     // marked with AUTO_SUBFRAME. See also didFailProvisionalLoad for how we
2625     // handle loading of error pages.
2626     static_cast<NavigationStateImpl*>(document_state->navigation_state())
2627         ->set_transition_type(ui::PAGE_TRANSITION_AUTO_SUBFRAME);
2628   }
2629
2630   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2631                     DidStartProvisionalLoad(frame));
2632   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidStartProvisionalLoad());
2633
2634   Send(new FrameHostMsg_DidStartProvisionalLoadForFrame(
2635        routing_id_, ds->request().url()));
2636 }
2637
2638 void RenderFrameImpl::didReceiveServerRedirectForProvisionalLoad(
2639     blink::WebLocalFrame* frame) {
2640   DCHECK(!frame_ || frame_ == frame);
2641   render_view_->history_controller()->RemoveChildrenForRedirect(this);
2642 }
2643
2644 void RenderFrameImpl::didFailProvisionalLoad(
2645     blink::WebLocalFrame* frame,
2646     const blink::WebURLError& error,
2647     blink::WebHistoryCommitType commit_type) {
2648   TRACE_EVENT1("navigation", "RenderFrameImpl::didFailProvisionalLoad",
2649                "id", routing_id_);
2650   DCHECK(!frame_ || frame_ == frame);
2651   WebDataSource* ds = frame->provisionalDataSource();
2652   DCHECK(ds);
2653
2654   const WebURLRequest& failed_request = ds->request();
2655
2656   // Notify the browser that we failed a provisional load with an error.
2657   //
2658   // Note: It is important this notification occur before DidStopLoading so the
2659   //       SSL manager can react to the provisional load failure before being
2660   //       notified the load stopped.
2661   //
2662   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2663                     DidFailProvisionalLoad(frame, error));
2664   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
2665                     DidFailProvisionalLoad(error));
2666
2667   SendFailedProvisionalLoad(failed_request, error, frame);
2668
2669   if (!ShouldDisplayErrorPageForFailedLoad(error.reason, error.unreachableURL))
2670     return;
2671
2672   // Make sure we never show errors in view source mode.
2673   frame->enableViewSourceMode(false);
2674
2675   DocumentState* document_state = DocumentState::FromDataSource(ds);
2676   NavigationStateImpl* navigation_state =
2677       static_cast<NavigationStateImpl*>(document_state->navigation_state());
2678
2679   // If this is a failed back/forward/reload navigation, then we need to do a
2680   // 'replace' load.  This is necessary to avoid messing up session history.
2681   // Otherwise, we do a normal load, which simulates a 'go' navigation as far
2682   // as session history is concerned.
2683   bool replace = commit_type != blink::WebStandardCommit;
2684
2685   // If we failed on a browser initiated request, then make sure that our error
2686   // page load is regarded as the same browser initiated request.
2687   if (!navigation_state->IsContentInitiated()) {
2688     pending_navigation_params_.reset(new NavigationParams(
2689         navigation_state->common_params(), navigation_state->start_params(),
2690         navigation_state->request_params()));
2691     pending_navigation_params_->request_params.request_time =
2692         document_state->request_time();
2693   }
2694
2695   // Load an error page.
2696   LoadNavigationErrorPage(failed_request, error, replace);
2697 }
2698
2699 void RenderFrameImpl::didCommitProvisionalLoad(
2700     blink::WebLocalFrame* frame,
2701     const blink::WebHistoryItem& item,
2702     blink::WebHistoryCommitType commit_type) {
2703   TRACE_EVENT2("navigation", "RenderFrameImpl::didCommitProvisionalLoad",
2704                "id", routing_id_,
2705                "url", GetLoadingUrl().possibly_invalid_spec());
2706   DCHECK(!frame_ || frame_ == frame);
2707   DocumentState* document_state =
2708       DocumentState::FromDataSource(frame->dataSource());
2709   NavigationStateImpl* navigation_state =
2710       static_cast<NavigationStateImpl*>(document_state->navigation_state());
2711
2712   if (proxy_routing_id_ != MSG_ROUTING_NONE) {
2713     RenderFrameProxy* proxy =
2714         RenderFrameProxy::FromRoutingID(proxy_routing_id_);
2715     CHECK(proxy);
2716     proxy->web_frame()->swap(frame_);
2717     proxy_routing_id_ = MSG_ROUTING_NONE;
2718
2719     // If this is the main frame going from a remote frame to a local frame,
2720     // it needs to set RenderViewImpl's pointer for the main frame to itself
2721     // and ensure RenderWidget is no longer in swapped out mode.
2722     if (!is_subframe_) {
2723       CHECK(!render_view_->main_render_frame_);
2724       render_view_->main_render_frame_ = this;
2725       if (render_view_->is_swapped_out())
2726         render_view_->SetSwappedOut(false);
2727     }
2728   }
2729
2730   // When we perform a new navigation, we need to update the last committed
2731   // session history entry with state for the page we are leaving. Do this
2732   // before updating the HistoryController state.
2733   render_view_->SendUpdateState();
2734
2735   render_view_->history_controller()->UpdateForCommit(
2736       this, item, commit_type, navigation_state->WasWithinSamePage());
2737
2738   InternalDocumentStateData* internal_data =
2739       InternalDocumentStateData::FromDocumentState(document_state);
2740
2741   if (document_state->commit_load_time().is_null())
2742     document_state->set_commit_load_time(Time::Now());
2743
2744   if (internal_data->must_reset_scroll_and_scale_state()) {
2745     render_view_->webview()->resetScrollAndScaleState();
2746     internal_data->set_must_reset_scroll_and_scale_state(false);
2747   }
2748
2749   bool is_new_navigation = commit_type == blink::WebStandardCommit;
2750   if (is_new_navigation) {
2751     // We bump our Page ID to correspond with the new session history entry.
2752     render_view_->page_id_ = render_view_->next_page_id_++;
2753
2754     // Don't update history list values for kSwappedOutURL, since
2755     // we don't want to forget the entry that was there, and since we will
2756     // never come back to kSwappedOutURL.  Note that we have to call
2757     // SendUpdateState and update page_id_ even in this case, so that
2758     // the current entry gets a state update and so that we don't send a
2759     // state update to the wrong entry when we swap back in.
2760     DCHECK_IMPLIES(
2761         navigation_state->common_params().should_replace_current_entry,
2762         render_view_->history_list_length_ > 0);
2763     if (GetLoadingUrl() != GURL(kSwappedOutURL) &&
2764         !navigation_state->common_params().should_replace_current_entry) {
2765       // Advance our offset in session history, applying the length limit.
2766       // There is now no forward history.
2767       render_view_->history_list_offset_++;
2768       if (render_view_->history_list_offset_ >= kMaxSessionHistoryEntries)
2769         render_view_->history_list_offset_ = kMaxSessionHistoryEntries - 1;
2770       render_view_->history_list_length_ =
2771           render_view_->history_list_offset_ + 1;
2772     }
2773   } else {
2774     const RequestNavigationParams& request_params =
2775         navigation_state->request_params();
2776     if (request_params.nav_entry_id != 0 &&
2777         !request_params.intended_as_new_entry) {
2778       // This is a successful session history navigation!
2779       render_view_->page_id_ = request_params.page_id;
2780
2781       render_view_->history_list_offset_ =
2782           request_params.pending_history_list_offset;
2783     }
2784   }
2785
2786   bool sent = Send(
2787       new FrameHostMsg_DidAssignPageId(routing_id_, render_view_->page_id_));
2788   CHECK(sent);  // http://crbug.com/407376
2789
2790   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers_,
2791                     DidCommitProvisionalLoad(frame, is_new_navigation));
2792   FOR_EACH_OBSERVER(
2793       RenderFrameObserver, observers_,
2794       DidCommitProvisionalLoad(is_new_navigation,
2795                                navigation_state->WasWithinSamePage()));
2796
2797   if (!frame->parent()) {  // Only for top frames.
2798     RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
2799     if (render_thread_impl) {  // Can be NULL in tests.
2800       render_thread_impl->histogram_customizer()->
2801           RenderViewNavigatedToHost(GURL(GetLoadingUrl()).host(),
2802                                     RenderView::GetRenderViewCount());
2803       render_thread_impl->GetRendererScheduler()->OnPageLoadStarted();
2804     }
2805   }
2806
2807   // Remember that we've already processed this request, so we don't update
2808   // the session history again.  We do this regardless of whether this is
2809   // a session history navigation, because if we attempted a session history
2810   // navigation without valid HistoryItem state, WebCore will think it is a
2811   // new navigation.
2812   navigation_state->set_request_committed(true);
2813
2814   SendDidCommitProvisionalLoad(frame, commit_type, item);
2815
2816   // Check whether we have new encoding name.
2817   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2818 }
2819
2820 void RenderFrameImpl::didCreateNewDocument(blink::WebLocalFrame* frame) {
2821   DCHECK(!frame_ || frame_ == frame);
2822
2823   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidCreateNewDocument());
2824   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2825                     DidCreateNewDocument(frame));
2826 }
2827
2828 void RenderFrameImpl::didClearWindowObject(blink::WebLocalFrame* frame) {
2829   DCHECK(!frame_ || frame_ == frame);
2830
2831   int enabled_bindings = render_view_->GetEnabledBindings();
2832
2833   if (enabled_bindings & BINDINGS_POLICY_WEB_UI)
2834     WebUIExtension::Install(frame);
2835
2836   if (enabled_bindings & BINDINGS_POLICY_DOM_AUTOMATION)
2837     DomAutomationController::Install(this, frame);
2838
2839   if (enabled_bindings & BINDINGS_POLICY_STATS_COLLECTION)
2840     StatsCollectionController::Install(frame);
2841
2842   const base::CommandLine& command_line =
2843       *base::CommandLine::ForCurrentProcess();
2844
2845   if (command_line.HasSwitch(cc::switches::kEnableGpuBenchmarking))
2846     GpuBenchmarking::Install(frame);
2847
2848   if (command_line.HasSwitch(switches::kEnableMemoryBenchmarking))
2849     MemoryBenchmarkingExtension::Install(frame);
2850
2851   if (command_line.HasSwitch(switches::kEnableSkiaBenchmarking))
2852     SkiaBenchmarking::Install(frame);
2853
2854   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2855                     DidClearWindowObject(frame));
2856   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidClearWindowObject());
2857 }
2858
2859 void RenderFrameImpl::didCreateDocumentElement(blink::WebLocalFrame* frame) {
2860   DCHECK(!frame_ || frame_ == frame);
2861
2862   // Notify the browser about non-blank documents loading in the top frame.
2863   GURL url = frame->document().url();
2864   if (url.is_valid() && url.spec() != url::kAboutBlankURL) {
2865     // TODO(nasko): Check if webview()->mainFrame() is the same as the
2866     // frame->tree()->top().
2867     blink::WebFrame* main_frame = render_view_->webview()->mainFrame();
2868     if (frame == main_frame) {
2869       // For now, don't remember plugin zoom values.  We don't want to mix them
2870       // with normal web content (i.e. a fixed layout plugin would usually want
2871       // them different).
2872       render_view_->Send(new ViewHostMsg_DocumentAvailableInMainFrame(
2873           render_view_->GetRoutingID(),
2874           main_frame->document().isPluginDocument()));
2875     }
2876   }
2877
2878   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
2879                     DidCreateDocumentElement());
2880   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2881                     DidCreateDocumentElement(frame));
2882 }
2883
2884 void RenderFrameImpl::didReceiveTitle(blink::WebLocalFrame* frame,
2885                                       const blink::WebString& title,
2886                                       blink::WebTextDirection direction) {
2887   DCHECK(!frame_ || frame_ == frame);
2888   // Ignore all but top level navigations.
2889   if (!frame->parent()) {
2890     base::string16 title16 = title;
2891     base::trace_event::TraceLog::GetInstance()->UpdateProcessLabel(
2892         routing_id_, base::UTF16ToUTF8(title16));
2893
2894     base::string16 shortened_title = title16.substr(0, kMaxTitleChars);
2895     Send(new FrameHostMsg_UpdateTitle(routing_id_,
2896                                       shortened_title, direction));
2897   }
2898
2899   // Also check whether we have new encoding name.
2900   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2901 }
2902
2903 void RenderFrameImpl::didChangeIcon(blink::WebLocalFrame* frame,
2904                                     blink::WebIconURL::Type icon_type) {
2905   DCHECK(!frame_ || frame_ == frame);
2906   // TODO(nasko): Investigate wheather implementation should move here.
2907   render_view_->didChangeIcon(frame, icon_type);
2908 }
2909
2910 void RenderFrameImpl::didFinishDocumentLoad(blink::WebLocalFrame* frame,
2911                                             bool document_is_empty) {
2912   TRACE_EVENT1("navigation", "RenderFrameImpl::didFinishDocumentLoad",
2913                "id", routing_id_);
2914   DCHECK(!frame_ || frame_ == frame);
2915   WebDataSource* ds = frame->dataSource();
2916   DocumentState* document_state = DocumentState::FromDataSource(ds);
2917   document_state->set_finish_document_load_time(Time::Now());
2918
2919   Send(new FrameHostMsg_DidFinishDocumentLoad(routing_id_));
2920
2921   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2922                     DidFinishDocumentLoad(frame));
2923   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishDocumentLoad());
2924
2925   // Check whether we have new encoding name.
2926   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2927
2928   // If this is an empty document with an http status code indicating an error,
2929   // we may want to display our own error page, so the user doesn't end up
2930   // with an unexplained blank page.
2931   if (!document_is_empty)
2932     return;
2933
2934   // Do not show error page when DevTools is attached.
2935   RenderFrameImpl* localRoot = this;
2936   while (localRoot->frame_ && localRoot->frame_->parent() &&
2937          localRoot->frame_->parent()->isWebLocalFrame()) {
2938     localRoot = RenderFrameImpl::FromWebFrame(localRoot->frame_->parent());
2939     DCHECK(localRoot);
2940   }
2941   if (localRoot->devtools_agent_ && localRoot->devtools_agent_->IsAttached())
2942     return;
2943
2944   // Display error page instead of a blank page, if appropriate.
2945   std::string error_domain = "http";
2946   InternalDocumentStateData* internal_data =
2947       InternalDocumentStateData::FromDataSource(frame->dataSource());
2948   int http_status_code = internal_data->http_status_code();
2949   if (GetContentClient()->renderer()->HasErrorPage(http_status_code,
2950                                                    &error_domain)) {
2951     WebURLError error;
2952     error.unreachableURL = frame->document().url();
2953     error.domain = WebString::fromUTF8(error_domain);
2954     error.reason = http_status_code;
2955     LoadNavigationErrorPage(frame->dataSource()->request(), error, true);
2956   }
2957 }
2958
2959 void RenderFrameImpl::didHandleOnloadEvents(blink::WebLocalFrame* frame) {
2960   DCHECK(!frame_ || frame_ == frame);
2961   if (!frame->parent()) {
2962     FrameMsg_UILoadMetricsReportType::Value report_type =
2963         static_cast<FrameMsg_UILoadMetricsReportType::Value>(
2964             frame->dataSource()->request().inputPerfMetricReportPolicy());
2965     base::TimeTicks ui_timestamp = base::TimeTicks() +
2966         base::TimeDelta::FromSecondsD(
2967             frame->dataSource()->request().uiStartTime());
2968
2969     Send(new FrameHostMsg_DocumentOnLoadCompleted(
2970         routing_id_, report_type, ui_timestamp));
2971   }
2972 }
2973
2974 void RenderFrameImpl::didFailLoad(blink::WebLocalFrame* frame,
2975                                   const blink::WebURLError& error,
2976                                   blink::WebHistoryCommitType commit_type) {
2977   TRACE_EVENT1("navigation", "RenderFrameImpl::didFailLoad",
2978                "id", routing_id_);
2979   DCHECK(!frame_ || frame_ == frame);
2980   // TODO(nasko): Move implementation here. No state needed.
2981   WebDataSource* ds = frame->dataSource();
2982   DCHECK(ds);
2983
2984   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2985                     DidFailLoad(frame, error));
2986
2987   const WebURLRequest& failed_request = ds->request();
2988   base::string16 error_description;
2989   GetContentClient()->renderer()->GetNavigationErrorStrings(
2990       render_view_.get(),
2991       frame,
2992       failed_request,
2993       error,
2994       NULL,
2995       &error_description);
2996   Send(new FrameHostMsg_DidFailLoadWithError(routing_id_,
2997                                              failed_request.url(),
2998                                              error.reason,
2999                                              error_description,
3000                                              error.wasIgnoredByHandler));
3001 }
3002
3003 void RenderFrameImpl::didFinishLoad(blink::WebLocalFrame* frame) {
3004   TRACE_EVENT1("navigation", "RenderFrameImpl::didFinishLoad",
3005                "id", routing_id_);
3006   DCHECK(!frame_ || frame_ == frame);
3007   WebDataSource* ds = frame->dataSource();
3008   DocumentState* document_state = DocumentState::FromDataSource(ds);
3009   if (document_state->finish_load_time().is_null()) {
3010     if (!frame->parent()) {
3011       TRACE_EVENT_INSTANT0("WebCore", "LoadFinished",
3012                            TRACE_EVENT_SCOPE_PROCESS);
3013     }
3014     document_state->set_finish_load_time(Time::Now());
3015   }
3016
3017   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
3018                     DidFinishLoad(frame));
3019   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishLoad());
3020
3021   // Don't send this message while the frame is swapped out.
3022   if (is_swapped_out())
3023     return;
3024
3025   Send(new FrameHostMsg_DidFinishLoad(routing_id_,
3026                                       ds->request().url()));
3027 }
3028
3029 void RenderFrameImpl::didNavigateWithinPage(blink::WebLocalFrame* frame,
3030     const blink::WebHistoryItem& item,
3031     blink::WebHistoryCommitType commit_type) {
3032   TRACE_EVENT1("navigation", "RenderFrameImpl::didNavigateWithinPage",
3033                "id", routing_id_);
3034   DCHECK(!frame_ || frame_ == frame);
3035   // If this was a reference fragment navigation that we initiated, then we
3036   // could end up having a non-null pending navigation params.  We just need to
3037   // update the ExtraData on the datasource so that others who read the
3038   // ExtraData will get the new NavigationState.  Similarly, if we did not
3039   // initiate this navigation, then we need to take care to reset any pre-
3040   // existing navigation state to a content-initiated navigation state.
3041   // didCreateDataSource conveniently takes care of this for us.
3042   didCreateDataSource(frame, frame->dataSource());
3043
3044   DocumentState* document_state =
3045       DocumentState::FromDataSource(frame->dataSource());
3046   static_cast<NavigationStateImpl*>(document_state->navigation_state())
3047       ->set_was_within_same_page(true);
3048
3049   didCommitProvisionalLoad(frame, item, commit_type);
3050 }
3051
3052 void RenderFrameImpl::didUpdateCurrentHistoryItem(blink::WebLocalFrame* frame) {
3053   DCHECK(!frame_ || frame_ == frame);
3054   // TODO(nasko): Move implementation here. Needed methods:
3055   // * StartNavStateSyncTimerIfNecessary
3056   render_view_->didUpdateCurrentHistoryItem(frame);
3057 }
3058
3059 void RenderFrameImpl::didChangeThemeColor() {
3060   if (frame_->parent())
3061     return;
3062
3063   Send(new FrameHostMsg_DidChangeThemeColor(
3064       routing_id_, frame_->document().themeColor()));
3065 }
3066
3067 void RenderFrameImpl::dispatchLoad() {
3068   Send(new FrameHostMsg_DispatchLoad(routing_id_));
3069 }
3070
3071 void RenderFrameImpl::requestNotificationPermission(
3072     const blink::WebSecurityOrigin& origin,
3073     blink::WebNotificationPermissionCallback* callback) {
3074   if (!notification_permission_dispatcher_) {
3075     notification_permission_dispatcher_ =
3076         new NotificationPermissionDispatcher(this);
3077   }
3078
3079   notification_permission_dispatcher_->RequestPermission(origin, callback);
3080 }
3081
3082 void RenderFrameImpl::didChangeSelection(bool is_empty_selection) {
3083   if (!GetRenderWidget()->handling_input_event() && !handling_select_range_)
3084     return;
3085
3086   if (is_empty_selection)
3087     selection_text_.clear();
3088
3089   // UpdateTextInputState should be called before SyncSelectionIfRequired.
3090   // UpdateTextInputState may send TextInputStateChanged to notify the focus
3091   // was changed, and SyncSelectionIfRequired may send SelectionChanged
3092   // to notify the selection was changed.  Focus change should be notified
3093   // before selection change.
3094   GetRenderWidget()->UpdateTextInputState(
3095       RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
3096   SyncSelectionIfRequired();
3097 }
3098
3099 blink::WebColorChooser* RenderFrameImpl::createColorChooser(
3100     blink::WebColorChooserClient* client,
3101     const blink::WebColor& initial_color,
3102     const blink::WebVector<blink::WebColorSuggestion>& suggestions) {
3103   RendererWebColorChooserImpl* color_chooser =
3104       new RendererWebColorChooserImpl(this, client);
3105   std::vector<ColorSuggestion> color_suggestions;
3106   for (size_t i = 0; i < suggestions.size(); i++) {
3107     color_suggestions.push_back(ColorSuggestion(suggestions[i]));
3108   }
3109   color_chooser->Open(static_cast<SkColor>(initial_color), color_suggestions);
3110   return color_chooser;
3111 }
3112
3113 void RenderFrameImpl::runModalAlertDialog(const blink::WebString& message) {
3114   RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_ALERT,
3115                        message,
3116                        base::string16(),
3117                        frame_->document().url(),
3118                        NULL);
3119 }
3120
3121 bool RenderFrameImpl::runModalConfirmDialog(const blink::WebString& message) {
3122   return RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_CONFIRM,
3123                               message,
3124                               base::string16(),
3125                               frame_->document().url(),
3126                               NULL);
3127 }
3128
3129 bool RenderFrameImpl::runModalPromptDialog(
3130     const blink::WebString& message,
3131     const blink::WebString& default_value,
3132     blink::WebString* actual_value) {
3133   base::string16 result;
3134   bool ok = RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_PROMPT,
3135                                  message,
3136                                  default_value,
3137                                  frame_->document().url(),
3138                                  &result);
3139   if (ok)
3140     actual_value->assign(result);
3141   return ok;
3142 }
3143
3144 bool RenderFrameImpl::runModalBeforeUnloadDialog(
3145     bool is_reload,
3146     const blink::WebString& message) {
3147   // If we are swapping out, we have already run the beforeunload handler.
3148   // TODO(creis): Fix OnSwapOut to clear the frame without running beforeunload
3149   // at all, to avoid running it twice.
3150   if (is_swapped_out_)
3151     return true;
3152
3153   // Don't allow further dialogs if we are waiting to swap out, since the
3154   // PageGroupLoadDeferrer in our stack prevents it.
3155   if (render_view()->suppress_dialogs_until_swap_out_)
3156     return false;
3157
3158   bool success = false;
3159   // This is an ignored return value, but is included so we can accept the same
3160   // response as RunJavaScriptMessage.
3161   base::string16 ignored_result;
3162   render_view()->SendAndRunNestedMessageLoop(
3163       new FrameHostMsg_RunBeforeUnloadConfirm(
3164           routing_id_, frame_->document().url(), message, is_reload,
3165           &success, &ignored_result));
3166   return success;
3167 }
3168
3169 void RenderFrameImpl::showContextMenu(const blink::WebContextMenuData& data) {
3170   ContextMenuParams params = ContextMenuParamsBuilder::Build(data);
3171   params.source_type = GetRenderWidget()->context_menu_source_type();
3172   GetRenderWidget()->OnShowHostContextMenu(&params);
3173   if (GetRenderWidget()->has_host_context_menu_location()) {
3174     params.x = GetRenderWidget()->host_context_menu_location().x();
3175     params.y = GetRenderWidget()->host_context_menu_location().y();
3176   }
3177
3178   // Serializing a GURL longer than kMaxURLChars will fail, so don't do
3179   // it.  We replace it with an empty GURL so the appropriate items are disabled
3180   // in the context menu.
3181   // TODO(jcivelli): http://crbug.com/45160 This prevents us from saving large
3182   //                 data encoded images.  We should have a way to save them.
3183   if (params.src_url.spec().size() > GetMaxURLChars())
3184     params.src_url = GURL();
3185   context_menu_node_ = data.node;
3186
3187 #if defined(OS_ANDROID)
3188   gfx::Rect start_rect;
3189   gfx::Rect end_rect;
3190   GetRenderWidget()->GetSelectionBounds(&start_rect, &end_rect);
3191   params.selection_start = gfx::Point(start_rect.x(), start_rect.bottom());
3192   params.selection_end = gfx::Point(end_rect.right(), end_rect.bottom());
3193 #endif
3194
3195   Send(new FrameHostMsg_ContextMenu(routing_id_, params));
3196 }
3197
3198 void RenderFrameImpl::clearContextMenu() {
3199   context_menu_node_.reset();
3200 }
3201
3202 void RenderFrameImpl::willSendRequest(
3203     blink::WebLocalFrame* frame,
3204     unsigned identifier,
3205     blink::WebURLRequest& request,
3206     const blink::WebURLResponse& redirect_response) {
3207   DCHECK(!frame_ || frame_ == frame);
3208   // The request my be empty during tests.
3209   if (request.url().isEmpty())
3210     return;
3211
3212   // Set the first party for cookies url if it has not been set yet (new
3213   // requests). For redirects, it is updated by WebURLLoaderImpl.
3214   if (request.firstPartyForCookies().isEmpty()) {
3215     if (request.frameType() == blink::WebURLRequest::FrameTypeTopLevel) {
3216       request.setFirstPartyForCookies(request.url());
3217     } else {
3218       // TODO(nasko): When the top-level frame is remote, there is no document.
3219       // This is broken and should be fixed to propagate the first party.
3220       WebFrame* top = frame->top();
3221       if (top->isWebLocalFrame()) {
3222         request.setFirstPartyForCookies(
3223             frame->top()->document().firstPartyForCookies());
3224       }
3225     }
3226   }
3227
3228   WebDataSource* provisional_data_source = frame->provisionalDataSource();
3229   WebDataSource* data_source =
3230       provisional_data_source ? provisional_data_source : frame->dataSource();
3231
3232   DocumentState* document_state = DocumentState::FromDataSource(data_source);
3233   DCHECK(document_state);
3234   InternalDocumentStateData* internal_data =
3235       InternalDocumentStateData::FromDocumentState(document_state);
3236   NavigationStateImpl* navigation_state =
3237       static_cast<NavigationStateImpl*>(document_state->navigation_state());
3238   ui::PageTransition transition_type = navigation_state->GetTransitionType();
3239   if (provisional_data_source && provisional_data_source->isClientRedirect()) {
3240     transition_type = ui::PageTransitionFromInt(
3241         transition_type | ui::PAGE_TRANSITION_CLIENT_REDIRECT);
3242   }
3243
3244   GURL request_url(request.url());
3245   GURL new_url;
3246   if (GetContentClient()->renderer()->WillSendRequest(
3247           frame,
3248           transition_type,
3249           request_url,
3250           request.firstPartyForCookies(),
3251           &new_url)) {
3252     request.setURL(WebURL(new_url));
3253   }
3254
3255   if (internal_data->is_cache_policy_override_set())
3256     request.setCachePolicy(internal_data->cache_policy_override());
3257
3258   // The request's extra data may indicate that we should set a custom user
3259   // agent. This needs to be done here, after WebKit is through with setting the
3260   // user agent on its own. Similarly, it may indicate that we should set an
3261   // X-Requested-With header. This must be done here to avoid breaking CORS
3262   // checks.
3263   // PlzNavigate: there may also be a stream url associated with the request.
3264   WebString custom_user_agent;
3265   WebString requested_with;
3266   scoped_ptr<StreamOverrideParameters> stream_override;
3267   if (request.extraData()) {
3268     RequestExtraData* old_extra_data =
3269         static_cast<RequestExtraData*>(request.extraData());
3270
3271     custom_user_agent = old_extra_data->custom_user_agent();
3272     if (!custom_user_agent.isNull()) {
3273       if (custom_user_agent.isEmpty())
3274         request.clearHTTPHeaderField("User-Agent");
3275       else
3276         request.setHTTPHeaderField("User-Agent", custom_user_agent);
3277     }
3278
3279     requested_with = old_extra_data->requested_with();
3280     if (!requested_with.isNull()) {
3281       if (requested_with.isEmpty())
3282         request.clearHTTPHeaderField("X-Requested-With");
3283       else
3284         request.setHTTPHeaderField("X-Requested-With", requested_with);
3285     }
3286     stream_override = old_extra_data->TakeStreamOverrideOwnership();
3287   }
3288
3289   // Add the default accept header for frame request if it has not been set
3290   // already.
3291   if ((request.frameType() == blink::WebURLRequest::FrameTypeTopLevel ||
3292        request.frameType() == blink::WebURLRequest::FrameTypeNested) &&
3293       request.httpHeaderField(WebString::fromUTF8(kAcceptHeader)).isEmpty()) {
3294     request.setHTTPHeaderField(WebString::fromUTF8(kAcceptHeader),
3295                                WebString::fromUTF8(kDefaultAcceptHeader));
3296   }
3297
3298   // Add an empty HTTP origin header for non GET methods if none is currently
3299   // present.
3300   request.addHTTPOriginIfNeeded(WebString());
3301
3302   // Attach |should_replace_current_entry| state to requests so that, should
3303   // this navigation later require a request transfer, all state is preserved
3304   // when it is re-created in the new process.
3305   bool should_replace_current_entry = false;
3306   if (navigation_state->IsContentInitiated()) {
3307     should_replace_current_entry = data_source->replacesCurrentHistoryItem();
3308   } else {
3309     // If the navigation is browser-initiated, the NavigationState contains the
3310     // correct value instead of the WebDataSource.
3311     //
3312     // TODO(davidben): Avoid this awkward duplication of state. See comment on
3313     // NavigationState::should_replace_current_entry().
3314     should_replace_current_entry =
3315         navigation_state->common_params().should_replace_current_entry;
3316   }
3317
3318   int provider_id = kInvalidServiceWorkerProviderId;
3319   if (request.frameType() == blink::WebURLRequest::FrameTypeTopLevel ||
3320       request.frameType() == blink::WebURLRequest::FrameTypeNested) {
3321     // |provisionalDataSource| may be null in some content::ResourceFetcher
3322     // use cases, we don't hook those requests.
3323     if (frame->provisionalDataSource()) {
3324       ServiceWorkerNetworkProvider* provider =
3325           ServiceWorkerNetworkProvider::FromDocumentState(
3326               DocumentState::FromDataSource(frame->provisionalDataSource()));
3327       provider_id = provider->provider_id();
3328     }
3329   } else if (frame->dataSource()) {
3330     ServiceWorkerNetworkProvider* provider =
3331         ServiceWorkerNetworkProvider::FromDocumentState(
3332             DocumentState::FromDataSource(frame->dataSource()));
3333     provider_id = provider->provider_id();
3334   }
3335
3336   WebFrame* parent = frame->parent();
3337   int parent_routing_id = MSG_ROUTING_NONE;
3338   if (!parent) {
3339     parent_routing_id = -1;
3340   } else if (parent->isWebLocalFrame()) {
3341     parent_routing_id = FromWebFrame(parent)->GetRoutingID();
3342   } else {
3343     parent_routing_id = RenderFrameProxy::FromWebFrame(parent)->routing_id();
3344   }
3345
3346   RequestExtraData* extra_data = new RequestExtraData();
3347   extra_data->set_visibility_state(render_view_->visibilityState());
3348   extra_data->set_custom_user_agent(custom_user_agent);
3349   extra_data->set_requested_with(requested_with);
3350   extra_data->set_render_frame_id(routing_id_);
3351   extra_data->set_is_main_frame(!parent);
3352   extra_data->set_frame_origin(
3353       GURL(frame->document().securityOrigin().toString()));
3354   extra_data->set_parent_is_main_frame(parent && !parent->parent());
3355   extra_data->set_parent_render_frame_id(parent_routing_id);
3356   extra_data->set_allow_download(
3357       navigation_state->common_params().allow_download);
3358   extra_data->set_transition_type(transition_type);
3359   extra_data->set_should_replace_current_entry(should_replace_current_entry);
3360   extra_data->set_transferred_request_child_id(
3361       navigation_state->start_params().transferred_request_child_id);
3362   extra_data->set_transferred_request_request_id(
3363       navigation_state->start_params().transferred_request_request_id);
3364   extra_data->set_service_worker_provider_id(provider_id);
3365   extra_data->set_stream_override(stream_override.Pass());
3366   request.setExtraData(extra_data);
3367
3368   // TODO(creis): Update prefetching to work with out-of-process iframes.
3369   WebFrame* top_frame = frame->top();
3370   if (top_frame && top_frame->isWebLocalFrame()) {
3371     DocumentState* top_document_state =
3372         DocumentState::FromDataSource(top_frame->dataSource());
3373     if (top_document_state) {
3374       // TODO(gavinp): separate out prefetching and prerender field trials
3375       // if the rel=prerender rel type is sticking around.
3376       if (request.requestContext() == WebURLRequest::RequestContextPrefetch)
3377         top_document_state->set_was_prefetcher(true);
3378     }
3379   }
3380
3381   // This is an instance where we embed a copy of the routing id
3382   // into the data portion of the message. This can cause problems if we
3383   // don't register this id on the browser side, since the download manager
3384   // expects to find a RenderViewHost based off the id.
3385   request.setRequestorID(render_view_->GetRoutingID());
3386   request.setHasUserGesture(WebUserGestureIndicator::isProcessingUserGesture());
3387
3388   if (!navigation_state->start_params().extra_headers.empty()) {
3389     for (net::HttpUtil::HeadersIterator i(
3390              navigation_state->start_params().extra_headers.begin(),
3391              navigation_state->start_params().extra_headers.end(), "\n");
3392          i.GetNext();) {
3393       if (base::LowerCaseEqualsASCII(i.name(), "referer")) {
3394         WebString referrer = WebSecurityPolicy::generateReferrerHeader(
3395             blink::WebReferrerPolicyDefault,
3396             request.url(),
3397             WebString::fromUTF8(i.values()));
3398         request.setHTTPReferrer(referrer, blink::WebReferrerPolicyDefault);
3399       } else {
3400         request.setHTTPHeaderField(WebString::fromUTF8(i.name()),
3401                                    WebString::fromUTF8(i.values()));
3402       }
3403     }
3404   }
3405
3406   if (!render_view_->renderer_preferences_.enable_referrers)
3407     request.setHTTPReferrer(WebString(), blink::WebReferrerPolicyDefault);
3408 }
3409
3410 void RenderFrameImpl::didReceiveResponse(
3411     blink::WebLocalFrame* frame,
3412     unsigned identifier,
3413     const blink::WebURLResponse& response) {
3414   DCHECK(!frame_ || frame_ == frame);
3415   // Only do this for responses that correspond to a provisional data source
3416   // of the top-most frame.  If we have a provisional data source, then we
3417   // can't have any sub-resources yet, so we know that this response must
3418   // correspond to a frame load.
3419   if (!frame->provisionalDataSource() || frame->parent())
3420     return;
3421
3422   // If we are in view source mode, then just let the user see the source of
3423   // the server's error page.
3424   if (frame->isViewSourceModeEnabled())
3425     return;
3426
3427   DocumentState* document_state =
3428       DocumentState::FromDataSource(frame->provisionalDataSource());
3429   int http_status_code = response.httpStatusCode();
3430
3431   // Record page load flags.
3432   WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
3433   if (extra_data) {
3434     document_state->set_was_fetched_via_spdy(
3435         extra_data->was_fetched_via_spdy());
3436     document_state->set_was_npn_negotiated(
3437         extra_data->was_npn_negotiated());
3438     document_state->set_npn_negotiated_protocol(
3439         extra_data->npn_negotiated_protocol());
3440     document_state->set_was_alternate_protocol_available(
3441         extra_data->was_alternate_protocol_available());
3442     document_state->set_connection_info(
3443         extra_data->connection_info());
3444     document_state->set_was_fetched_via_proxy(
3445         extra_data->was_fetched_via_proxy());
3446     document_state->set_proxy_server(
3447         extra_data->proxy_server());
3448   }
3449   InternalDocumentStateData* internal_data =
3450       InternalDocumentStateData::FromDocumentState(document_state);
3451   internal_data->set_http_status_code(http_status_code);
3452 }
3453
3454 void RenderFrameImpl::didLoadResourceFromMemoryCache(
3455     blink::WebLocalFrame* frame,
3456     const blink::WebURLRequest& request,
3457     const blink::WebURLResponse& response) {
3458   DCHECK(!frame_ || frame_ == frame);
3459   // The recipients of this message have no use for data: URLs: they don't
3460   // affect the page's insecure content list and are not in the disk cache. To
3461   // prevent large (1M+) data: URLs from crashing in the IPC system, we simply
3462   // filter them out here.
3463   GURL url(request.url());
3464   if (url.SchemeIs(url::kDataScheme))
3465     return;
3466
3467   // Let the browser know we loaded a resource from the memory cache.  This
3468   // message is needed to display the correct SSL indicators.
3469   Send(new FrameHostMsg_DidLoadResourceFromMemoryCache(
3470       routing_id_, url, response.securityInfo(), request.httpMethod().utf8(),
3471       response.mimeType().utf8(), WebURLRequestToResourceType(request)));
3472 }
3473
3474 void RenderFrameImpl::didDisplayInsecureContent(blink::WebLocalFrame* frame) {
3475   DCHECK(!frame_ || frame_ == frame);
3476   Send(new FrameHostMsg_DidDisplayInsecureContent(routing_id_));
3477 }
3478
3479 void RenderFrameImpl::didRunInsecureContent(
3480     blink::WebLocalFrame* frame,
3481     const blink::WebSecurityOrigin& origin,
3482     const blink::WebURL& target) {
3483   DCHECK(!frame_ || frame_ == frame);
3484   Send(new FrameHostMsg_DidRunInsecureContent(
3485       routing_id_, origin.toString().utf8(), target));
3486   GetContentClient()->renderer()->RecordRapporURL(
3487       "ContentSettings.MixedScript.RanMixedScript",
3488       GURL(origin.toString().utf8()));
3489 }
3490
3491 void RenderFrameImpl::didChangePerformanceTiming() {
3492   FOR_EACH_OBSERVER(RenderFrameObserver,
3493                     observers_,
3494                     DidChangePerformanceTiming());
3495 }
3496
3497 void RenderFrameImpl::didAbortLoading(blink::WebLocalFrame* frame) {
3498   DCHECK(!frame_ || frame_ == frame);
3499 #if defined(ENABLE_PLUGINS)
3500   if (frame != render_view_->webview()->mainFrame())
3501     return;
3502   PluginChannelHost::Broadcast(
3503       new PluginHostMsg_DidAbortLoading(render_view_->GetRoutingID()));
3504 #endif
3505 }
3506
3507 void RenderFrameImpl::didCreateScriptContext(blink::WebLocalFrame* frame,
3508                                              v8::Local<v8::Context> context,
3509                                              int extension_group,
3510                                              int world_id) {
3511   DCHECK(!frame_ || frame_ == frame);
3512
3513   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
3514                     DidCreateScriptContext(context, extension_group, world_id));
3515 }
3516
3517 void RenderFrameImpl::willReleaseScriptContext(blink::WebLocalFrame* frame,
3518                                                v8::Local<v8::Context> context,
3519                                                int world_id) {
3520   DCHECK(!frame_ || frame_ == frame);
3521
3522   FOR_EACH_OBSERVER(RenderFrameObserver,
3523                     observers_,
3524                     WillReleaseScriptContext(context, world_id));
3525 }
3526
3527 void RenderFrameImpl::didChangeScrollOffset(blink::WebLocalFrame* frame) {
3528   DCHECK(!frame_ || frame_ == frame);
3529   // TODO(nasko): Move implementation here. Needed methods:
3530   // * StartNavStateSyncTimerIfNecessary
3531   render_view_->didChangeScrollOffset(frame);
3532
3533   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidChangeScrollOffset());
3534 }
3535
3536 void RenderFrameImpl::willInsertBody(blink::WebLocalFrame* frame) {
3537   DCHECK(!frame_ || frame_ == frame);
3538   if (!frame->parent()) {
3539     render_view_->Send(new ViewHostMsg_WillInsertBody(
3540         render_view_->GetRoutingID()));
3541   }
3542 }
3543
3544 void RenderFrameImpl::reportFindInPageMatchCount(int request_id,
3545                                                  int count,
3546                                                  bool final_update) {
3547   int active_match_ordinal = -1;  // -1 = don't update active match ordinal
3548   if (!count)
3549     active_match_ordinal = 0;
3550
3551   render_view_->Send(new ViewHostMsg_Find_Reply(
3552       render_view_->GetRoutingID(), request_id, count,
3553       gfx::Rect(), active_match_ordinal, final_update));
3554 }
3555
3556 void RenderFrameImpl::reportFindInPageSelection(
3557     int request_id,
3558     int active_match_ordinal,
3559     const blink::WebRect& selection_rect) {
3560   render_view_->Send(new ViewHostMsg_Find_Reply(
3561       render_view_->GetRoutingID(), request_id, -1, selection_rect,
3562       active_match_ordinal, false));
3563 }
3564
3565 void RenderFrameImpl::requestStorageQuota(
3566     blink::WebLocalFrame* frame,
3567     blink::WebStorageQuotaType type,
3568     unsigned long long requested_size,
3569     blink::WebStorageQuotaCallbacks callbacks) {
3570   DCHECK(!frame_ || frame_ == frame);
3571   WebSecurityOrigin origin = frame->document().securityOrigin();
3572   if (origin.isUnique()) {
3573     // Unique origins cannot store persistent state.
3574     callbacks.didFail(blink::WebStorageQuotaErrorAbort);
3575     return;
3576   }
3577   ChildThreadImpl::current()->quota_dispatcher()->RequestStorageQuota(
3578       render_view_->GetRoutingID(),
3579       GURL(origin.toString()),
3580       static_cast<storage::StorageType>(type),
3581       requested_size,
3582       QuotaDispatcher::CreateWebStorageQuotaCallbacksWrapper(callbacks));
3583 }
3584
3585 void RenderFrameImpl::willOpenWebSocket(blink::WebSocketHandle* handle) {
3586   WebSocketBridge* impl = static_cast<WebSocketBridge*>(handle);
3587   impl->set_render_frame_id(routing_id_);
3588 }
3589
3590 blink::WebGeolocationClient* RenderFrameImpl::geolocationClient() {
3591   if (!geolocation_dispatcher_)
3592     geolocation_dispatcher_ = new GeolocationDispatcher(this);
3593   return geolocation_dispatcher_;
3594 }
3595
3596 blink::WebPresentationClient* RenderFrameImpl::presentationClient() {
3597   if (!presentation_dispatcher_)
3598     presentation_dispatcher_ = new PresentationDispatcher(this);
3599   return presentation_dispatcher_;
3600 }
3601
3602 blink::WebPushClient* RenderFrameImpl::pushClient() {
3603   if (!push_messaging_dispatcher_)
3604     push_messaging_dispatcher_ = new PushMessagingDispatcher(this);
3605   return push_messaging_dispatcher_;
3606 }
3607
3608 void RenderFrameImpl::willStartUsingPeerConnectionHandler(
3609     blink::WebLocalFrame* frame,
3610     blink::WebRTCPeerConnectionHandler* handler) {
3611   DCHECK(!frame_ || frame_ == frame);
3612 #if defined(ENABLE_WEBRTC)
3613   static_cast<RTCPeerConnectionHandler*>(handler)->associateWithFrame(frame);
3614 #endif
3615 }
3616
3617 blink::WebUserMediaClient* RenderFrameImpl::userMediaClient() {
3618   if (!web_user_media_client_)
3619     InitializeUserMediaClient();
3620   return web_user_media_client_;
3621 }
3622
3623 blink::WebEncryptedMediaClient* RenderFrameImpl::encryptedMediaClient() {
3624   if (!web_encrypted_media_client_) {
3625     web_encrypted_media_client_.reset(new media::WebEncryptedMediaClientImpl(
3626         // base::Unretained(this) is safe because WebEncryptedMediaClientImpl
3627         // is destructed before |this|, and does not give away ownership of the
3628         // callback.
3629         base::Bind(&RenderFrameImpl::AreSecureCodecsSupported,
3630                    base::Unretained(this)),
3631         GetCdmFactory(), GetMediaPermission()));
3632   }
3633   return web_encrypted_media_client_.get();
3634 }
3635
3636 blink::WebMIDIClient* RenderFrameImpl::webMIDIClient() {
3637   if (!midi_dispatcher_)
3638     midi_dispatcher_ = new MidiDispatcher(this);
3639   return midi_dispatcher_;
3640 }
3641
3642 bool RenderFrameImpl::willCheckAndDispatchMessageEvent(
3643     blink::WebLocalFrame* source_frame,
3644     blink::WebFrame* target_frame,
3645     blink::WebSecurityOrigin target_origin,
3646     blink::WebDOMMessageEvent event) {
3647   DCHECK(!frame_ || frame_ == target_frame);
3648
3649   // Currently, a postMessage that targets a cross-process frame can be plumbed
3650   // either through this function or RenderFrameProxy::postMessageEvent. This
3651   // function is used when the target cross-process frame is a top-level frame
3652   // which has been swapped out.  In that case, the corresponding WebLocalFrame
3653   // currently remains in the frame tree even in site-per-process mode (see
3654   // OnSwapOut). RenderFrameProxy::postMessageEvent is used in
3655   // --site-per-process mode for all other cases.
3656   //
3657   // TODO(alexmos, nasko): When swapped-out:// disappears, this should be
3658   // cleaned up so that RenderFrameProxy::postMessageEvent is the only path for
3659   // cross-process postMessages.
3660   if (!is_swapped_out_)
3661     return false;
3662
3663   // It is possible to get here on a swapped-out frame without a
3664   // |render_frame_proxy_|. This happens when:
3665   // - This process only has one active RenderView and is about to go away
3666   //   (e.g., due to cross-process navigation).
3667   // - The top frame has a subframe with an unload handler.
3668   // - The subframe sends a postMessage to the top-level frame in its unload
3669   //   handler.
3670   // See https://crbug.com/475651 for details.  We return false here, since we
3671   // don't want to deliver the message to the new process in this case.
3672   if (!render_frame_proxy_)
3673     return false;
3674
3675   render_frame_proxy_->postMessageEvent(
3676       source_frame, render_frame_proxy_->web_frame(), target_origin, event);
3677   return true;
3678 }
3679
3680 blink::WebString RenderFrameImpl::userAgentOverride(blink::WebLocalFrame* frame,
3681                                                     const blink::WebURL& url) {
3682   DCHECK(!frame_ || frame_ == frame);
3683   std::string user_agent_override_for_url =
3684       GetContentClient()->renderer()->GetUserAgentOverrideForURL(GURL(url));
3685   if (!user_agent_override_for_url.empty())
3686     return WebString::fromUTF8(user_agent_override_for_url);
3687
3688   if (!render_view_->webview() || !render_view_->webview()->mainFrame() ||
3689       render_view_->renderer_preferences_.user_agent_override.empty()) {
3690     return blink::WebString();
3691   }
3692
3693   // TODO(nasko): When the top-level frame is remote, there is no WebDataSource
3694   // associated with it, so the checks below are not valid. Temporarily
3695   // return early and fix properly as part of https://crbug.com/426555.
3696   if (render_view_->webview()->mainFrame()->isWebRemoteFrame())
3697     return blink::WebString();
3698
3699   // If we're in the middle of committing a load, the data source we need
3700   // will still be provisional.
3701   WebFrame* main_frame = render_view_->webview()->mainFrame();
3702   WebDataSource* data_source = NULL;
3703   if (main_frame->provisionalDataSource())
3704     data_source = main_frame->provisionalDataSource();
3705   else
3706     data_source = main_frame->dataSource();
3707
3708   InternalDocumentStateData* internal_data = data_source ?
3709       InternalDocumentStateData::FromDataSource(data_source) : NULL;
3710   if (internal_data && internal_data->is_overriding_user_agent())
3711     return WebString::fromUTF8(
3712         render_view_->renderer_preferences_.user_agent_override);
3713   return blink::WebString();
3714 }
3715
3716 blink::WebString RenderFrameImpl::doNotTrackValue(blink::WebLocalFrame* frame) {
3717   DCHECK(!frame_ || frame_ == frame);
3718   if (render_view_->renderer_preferences_.enable_do_not_track)
3719     return WebString::fromUTF8("1");
3720   return WebString();
3721 }
3722
3723 bool RenderFrameImpl::allowWebGL(blink::WebLocalFrame* frame,
3724                                  bool default_value) {
3725   DCHECK(!frame_ || frame_ == frame);
3726   if (!default_value)
3727     return false;
3728
3729   bool blocked = true;
3730   Send(new FrameHostMsg_Are3DAPIsBlocked(
3731       routing_id_,
3732       GURL(frame->top()->securityOrigin().toString()),
3733       THREE_D_API_TYPE_WEBGL,
3734       &blocked));
3735   return !blocked;
3736 }
3737
3738 void RenderFrameImpl::didLoseWebGLContext(blink::WebLocalFrame* frame,
3739                                           int arb_robustness_status_code) {
3740   DCHECK(!frame_ || frame_ == frame);
3741   Send(new FrameHostMsg_DidLose3DContext(
3742       GURL(frame->top()->securityOrigin().toString()),
3743       THREE_D_API_TYPE_WEBGL,
3744       arb_robustness_status_code));
3745 }
3746
3747 blink::WebScreenOrientationClient*
3748     RenderFrameImpl::webScreenOrientationClient() {
3749   if (!screen_orientation_dispatcher_)
3750     screen_orientation_dispatcher_ = new ScreenOrientationDispatcher(this);
3751   return screen_orientation_dispatcher_;
3752 }
3753
3754 bool RenderFrameImpl::isControlledByServiceWorker(WebDataSource& data_source) {
3755   ServiceWorkerNetworkProvider* provider =
3756       ServiceWorkerNetworkProvider::FromDocumentState(
3757           DocumentState::FromDataSource(&data_source));
3758   if (!provider->context())
3759     return false;
3760   return provider->context()->controller_handle_id() !=
3761       kInvalidServiceWorkerHandleId;
3762 }
3763
3764 int64_t RenderFrameImpl::serviceWorkerID(WebDataSource& data_source) {
3765   ServiceWorkerNetworkProvider* provider =
3766       ServiceWorkerNetworkProvider::FromDocumentState(
3767           DocumentState::FromDataSource(&data_source));
3768   if (provider->context() && provider->context()->controller())
3769     return provider->context()->controller()->version_id();
3770   return kInvalidServiceWorkerVersionId;
3771 }
3772
3773 void RenderFrameImpl::postAccessibilityEvent(const blink::WebAXObject& obj,
3774                                              blink::WebAXEvent event) {
3775   HandleWebAccessibilityEvent(obj, event);
3776 }
3777
3778 void RenderFrameImpl::handleAccessibilityFindInPageResult(
3779     int identifier,
3780     int match_index,
3781     const blink::WebAXObject& start_object,
3782     int start_offset,
3783     const blink::WebAXObject& end_object,
3784     int end_offset) {
3785   if (renderer_accessibility_) {
3786     renderer_accessibility_->HandleAccessibilityFindInPageResult(
3787         identifier, match_index, start_object, start_offset,
3788         end_object, end_offset);
3789   }
3790 }
3791
3792 void RenderFrameImpl::didChangeManifest(blink::WebLocalFrame* frame) {
3793   DCHECK(!frame_ || frame_ == frame);
3794
3795   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidChangeManifest());
3796 }
3797
3798 bool RenderFrameImpl::enterFullscreen() {
3799   Send(new FrameHostMsg_ToggleFullscreen(routing_id_, true));
3800   return true;
3801 }
3802
3803 bool RenderFrameImpl::exitFullscreen() {
3804   Send(new FrameHostMsg_ToggleFullscreen(routing_id_, false));
3805   return true;
3806 }
3807
3808 blink::WebPermissionClient* RenderFrameImpl::permissionClient() {
3809   if (!permission_client_)
3810     permission_client_.reset(new PermissionDispatcher(GetServiceRegistry()));
3811
3812   return permission_client_.get();
3813 }
3814
3815 blink::WebAppBannerClient* RenderFrameImpl::appBannerClient() {
3816   if (!app_banner_client_) {
3817     app_banner_client_ =
3818         GetContentClient()->renderer()->CreateAppBannerClient(this);
3819   }
3820
3821   return app_banner_client_.get();
3822 }
3823
3824 void RenderFrameImpl::registerProtocolHandler(const WebString& scheme,
3825                                               const WebURL& url,
3826                                               const WebString& title) {
3827   bool user_gesture = WebUserGestureIndicator::isProcessingUserGesture();
3828   Send(new FrameHostMsg_RegisterProtocolHandler(
3829       routing_id_,
3830       base::UTF16ToUTF8(base::StringPiece16(scheme)),
3831       url,
3832       title,
3833       user_gesture));
3834 }
3835
3836 void RenderFrameImpl::unregisterProtocolHandler(const WebString& scheme,
3837                                                 const WebURL& url) {
3838   bool user_gesture = WebUserGestureIndicator::isProcessingUserGesture();
3839   Send(new FrameHostMsg_UnregisterProtocolHandler(
3840       routing_id_,
3841       base::UTF16ToUTF8(base::StringPiece16(scheme)),
3842       url,
3843       user_gesture));
3844 }
3845
3846 blink::WebBluetooth* RenderFrameImpl::bluetooth() {
3847   if (!bluetooth_) {
3848     bluetooth_.reset(new WebBluetoothImpl(
3849         ChildThreadImpl::current()->thread_safe_sender(), routing_id_));
3850   }
3851
3852   return bluetooth_.get();
3853 }
3854
3855 blink::WebUSBClient* RenderFrameImpl::usbClient() {
3856 #if !defined(OS_ANDROID)
3857   if (!usb_client_) {
3858     mojo::ServiceProviderPtr device_services =
3859         ConnectToApplication(GURL(device::kDevicesMojoAppUrl));
3860     usb_client_.reset(new WebUSBClientImpl(device_services.Pass()));
3861   }
3862 #endif
3863   return usb_client_.get();
3864 }
3865
3866 #if defined(ENABLE_WEBVR)
3867 blink::WebVRClient* RenderFrameImpl::webVRClient() {
3868   if (!vr_dispatcher_)
3869     vr_dispatcher_.reset(new VRDispatcher(GetServiceRegistry()));
3870
3871   return vr_dispatcher_.get();
3872 }
3873 #endif
3874
3875 void RenderFrameImpl::DidPlay(WebMediaPlayer* player) {
3876   has_played_media_ = true;
3877   Send(new FrameHostMsg_MediaPlayingNotification(
3878       routing_id_, reinterpret_cast<int64>(player), player->hasVideo(),
3879       player->hasAudio(), player->isRemote()));
3880 }
3881
3882 void RenderFrameImpl::DidPause(WebMediaPlayer* player) {
3883   Send(new FrameHostMsg_MediaPausedNotification(
3884       routing_id_, reinterpret_cast<int64>(player)));
3885 }
3886
3887 void RenderFrameImpl::PlayerGone(WebMediaPlayer* player) {
3888   DidPause(player);
3889 }
3890
3891 void RenderFrameImpl::AddObserver(RenderFrameObserver* observer) {
3892   observers_.AddObserver(observer);
3893 }
3894
3895 void RenderFrameImpl::RemoveObserver(RenderFrameObserver* observer) {
3896   observer->RenderFrameGone();
3897   observers_.RemoveObserver(observer);
3898 }
3899
3900 void RenderFrameImpl::OnStop() {
3901   DCHECK(frame_);
3902   frame_->stopLoading();
3903   if (!frame_->parent())
3904     FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers_, OnStop());
3905
3906   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnStop());
3907 }
3908
3909 void RenderFrameImpl::WasHidden() {
3910   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WasHidden());
3911 }
3912
3913 void RenderFrameImpl::WasShown() {
3914   // TODO(kenrb): Need to figure out how to do this better. Should
3915   // VisibilityState remain a page-level concept or move to frames?
3916   // The semantics of 'Show' might have to change here.
3917   if (render_widget_) {
3918     static_cast<blink::WebFrameWidget*>(render_widget_->webwidget())->
3919         setVisibilityState(blink::WebPageVisibilityStateVisible, false);
3920   }
3921   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WasShown());
3922 }
3923
3924 void RenderFrameImpl::WidgetWillClose() {
3925   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WidgetWillClose());
3926 }
3927
3928 bool RenderFrameImpl::IsHidden() {
3929   return GetRenderWidget()->is_hidden();
3930 }
3931
3932 // Tell the embedding application that the URL of the active page has changed.
3933 void RenderFrameImpl::SendDidCommitProvisionalLoad(
3934     blink::WebFrame* frame,
3935     blink::WebHistoryCommitType commit_type,
3936     const blink::WebHistoryItem& item) {
3937   DCHECK(!frame_ || frame_ == frame);
3938   WebDataSource* ds = frame->dataSource();
3939   DCHECK(ds);
3940
3941   const WebURLRequest& request = ds->request();
3942   const WebURLResponse& response = ds->response();
3943
3944   DocumentState* document_state = DocumentState::FromDataSource(ds);
3945   NavigationStateImpl* navigation_state =
3946       static_cast<NavigationStateImpl*>(document_state->navigation_state());
3947   InternalDocumentStateData* internal_data =
3948       InternalDocumentStateData::FromDocumentState(document_state);
3949
3950   FrameHostMsg_DidCommitProvisionalLoad_Params params;
3951   params.http_status_code = response.httpStatusCode();
3952   params.url_is_unreachable = ds->hasUnreachableURL();
3953   params.is_post = false;
3954   params.intended_as_new_entry =
3955       navigation_state->request_params().intended_as_new_entry;
3956   params.did_create_new_entry = commit_type == blink::WebStandardCommit;
3957   params.post_id = -1;
3958   params.page_id = render_view_->page_id_;
3959   params.nav_entry_id = navigation_state->request_params().nav_entry_id;
3960   // We need to track the RenderViewHost routing_id because of downstream
3961   // dependencies (crbug.com/392171 DownloadRequestHandle, SaveFileManager,
3962   // ResourceDispatcherHostImpl, MediaStreamUIProxy,
3963   // SpeechRecognitionDispatcherHost and possibly others). They look up the view
3964   // based on the ID stored in the resource requests. Once those dependencies
3965   // are unwound or moved to RenderFrameHost (crbug.com/304341) we can move the
3966   // client to be based on the routing_id of the RenderFrameHost.
3967   params.render_view_routing_id = render_view_->routing_id();
3968   params.socket_address.set_host(response.remoteIPAddress().utf8());
3969   params.socket_address.set_port(response.remotePort());
3970   WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
3971   if (extra_data)
3972     params.was_fetched_via_proxy = extra_data->was_fetched_via_proxy();
3973   params.was_within_same_page = navigation_state->WasWithinSamePage();
3974   params.security_info = response.securityInfo();
3975
3976   // Set the URL to be displayed in the browser UI to the user.
3977   params.url = GetLoadingUrl();
3978   DCHECK(!is_swapped_out_ || params.url == GURL(kSwappedOutURL));
3979
3980   // Set the origin of the frame.  This will be replicated to the corresponding
3981   // RenderFrameProxies in other processes.
3982   // TODO(alexmos): Origins for URLs with non-standard schemes are excluded due
3983   // to https://crbug.com/439608 and will be replicated as unique origins.
3984   if (!is_swapped_out_) {
3985     std::string scheme = frame->document().securityOrigin().protocol().utf8();
3986     if (url::IsStandard(scheme.c_str(),
3987                         url::Component(0, static_cast<int>(scheme.length())))) {
3988       params.origin = frame->document().securityOrigin();
3989     }
3990   }
3991
3992   if (frame->document().baseURL() != params.url)
3993     params.base_url = frame->document().baseURL();
3994
3995   GetRedirectChain(ds, &params.redirects);
3996   params.should_update_history = !ds->hasUnreachableURL() &&
3997       !response.isMultipartPayload() && (response.httpStatusCode() != 404);
3998
3999   params.searchable_form_url = internal_data->searchable_form_url();
4000   params.searchable_form_encoding = internal_data->searchable_form_encoding();
4001
4002   params.gesture = render_view_->navigation_gesture_;
4003   render_view_->navigation_gesture_ = NavigationGestureUnknown;
4004
4005   // Make navigation state a part of the DidCommitProvisionalLoad message so
4006   // that committed entry has it at all times.
4007   HistoryEntry* entry = render_view_->history_controller()->GetCurrentEntry();
4008   if (!SiteIsolationPolicy::UseSubframeNavigationEntries()) {
4009     if (entry)
4010       params.page_state = HistoryEntryToPageState(entry);
4011     else
4012       params.page_state = PageState::CreateFromURL(request.url());
4013   } else {
4014     // In --site-per-process, just send a single HistoryItem for this frame,
4015     // rather than the whole tree.  It will be stored in the corresponding
4016     // FrameNavigationEntry.
4017     params.page_state = SingleHistoryItemToPageState(item);
4018   }
4019   params.item_sequence_number = item.itemSequenceNumber();
4020   params.document_sequence_number = item.documentSequenceNumber();
4021
4022   if (!frame->parent()) {
4023     // Top-level navigation.
4024
4025     // Reset the zoom limits in case a plugin had changed them previously. This
4026     // will also call us back which will cause us to send a message to
4027     // update WebContentsImpl.
4028     render_view_->webview()->zoomLimitsChanged(
4029         ZoomFactorToZoomLevel(kMinimumZoomFactor),
4030         ZoomFactorToZoomLevel(kMaximumZoomFactor));
4031
4032     // Set zoom level, but don't do it for full-page plugin since they don't use
4033     // the same zoom settings.
4034     HostZoomLevels::iterator host_zoom =
4035         render_view_->host_zoom_levels_.find(GURL(request.url()));
4036     if (render_view_->webview()->mainFrame()->isWebLocalFrame() &&
4037         render_view_->webview()->mainFrame()->document().isPluginDocument()) {
4038       // Reset the zoom levels for plugins.
4039       render_view_->webview()->setZoomLevel(0);
4040     } else {
4041       // If the zoom level is not found, then do nothing. In-page navigation
4042       // relies on not changing the zoom level in this case.
4043       if (host_zoom != render_view_->host_zoom_levels_.end())
4044         render_view_->webview()->setZoomLevel(host_zoom->second);
4045     }
4046
4047     if (host_zoom != render_view_->host_zoom_levels_.end()) {
4048       // This zoom level was merely recorded transiently for this load.  We can
4049       // erase it now.  If at some point we reload this page, the browser will
4050       // send us a new, up-to-date zoom level.
4051       render_view_->host_zoom_levels_.erase(host_zoom);
4052     }
4053
4054     // Update contents MIME type for main frame.
4055     params.contents_mime_type = ds->response().mimeType().utf8();
4056
4057     params.transition = navigation_state->GetTransitionType();
4058     if (!ui::PageTransitionIsMainFrame(params.transition)) {
4059       // If the main frame does a load, it should not be reported as a subframe
4060       // navigation.  This can occur in the following case:
4061       // 1. You're on a site with frames.
4062       // 2. You do a subframe navigation.  This is stored with transition type
4063       //    MANUAL_SUBFRAME.
4064       // 3. You navigate to some non-frame site, say, google.com.
4065       // 4. You navigate back to the page from step 2.  Since it was initially
4066       //    MANUAL_SUBFRAME, it will be that same transition type here.
4067       // We don't want that, because any navigation that changes the toplevel
4068       // frame should be tracked as a toplevel navigation (this allows us to
4069       // update the URL bar, etc).
4070       params.transition = ui::PAGE_TRANSITION_LINK;
4071     }
4072
4073     // If the page contained a client redirect (meta refresh, document.loc...),
4074     // set the referrer and transition appropriately.
4075     if (ds->isClientRedirect()) {
4076       params.referrer =
4077           Referrer(params.redirects[0], ds->request().referrerPolicy());
4078       params.transition = ui::PageTransitionFromInt(
4079           params.transition | ui::PAGE_TRANSITION_CLIENT_REDIRECT);
4080     } else {
4081       params.referrer = RenderViewImpl::GetReferrerFromRequest(
4082           frame, ds->request());
4083     }
4084
4085     base::string16 method = request.httpMethod();
4086     if (base::EqualsASCII(method, "POST")) {
4087       params.is_post = true;
4088       params.post_id = ExtractPostId(entry);
4089     }
4090
4091     // Send the user agent override back.
4092     params.is_overriding_user_agent = internal_data->is_overriding_user_agent();
4093
4094     // Track the URL of the original request.  We use the first entry of the
4095     // redirect chain if it exists because the chain may have started in another
4096     // process.
4097     params.original_request_url = GetOriginalRequestURL(ds);
4098
4099     params.history_list_was_cleared =
4100         navigation_state->request_params().should_clear_history_list;
4101
4102     params.report_type = static_cast<FrameMsg_UILoadMetricsReportType::Value>(
4103         frame->dataSource()->request().inputPerfMetricReportPolicy());
4104     params.ui_timestamp = base::TimeTicks() + base::TimeDelta::FromSecondsD(
4105         frame->dataSource()->request().uiStartTime());
4106
4107     // Save some histogram data so we can compute the average memory used per
4108     // page load of the glyphs.
4109     UMA_HISTOGRAM_COUNTS_10000("Memory.GlyphPagesPerLoad",
4110                                blink::WebGlyphCache::pageCount());
4111
4112     // This message needs to be sent before any of allowScripts(),
4113     // allowImages(), allowPlugins() is called for the new page, so that when
4114     // these functions send a ViewHostMsg_ContentBlocked message, it arrives
4115     // after the FrameHostMsg_DidCommitProvisionalLoad message.
4116     Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
4117   } else {
4118     // Subframe navigation: the type depends on whether this navigation
4119     // generated a new session history entry. When they do generate a session
4120     // history entry, it means the user initiated the navigation and we should
4121     // mark it as such.
4122     if (commit_type == blink::WebStandardCommit)
4123       params.transition = ui::PAGE_TRANSITION_MANUAL_SUBFRAME;
4124     else
4125       params.transition = ui::PAGE_TRANSITION_AUTO_SUBFRAME;
4126
4127     DCHECK(!navigation_state->request_params().should_clear_history_list);
4128     params.history_list_was_cleared = false;
4129     params.report_type = FrameMsg_UILoadMetricsReportType::NO_REPORT;
4130
4131     // Don't send this message while the subframe is swapped out.
4132     if (!is_swapped_out())
4133       Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
4134   }
4135
4136   // If we end up reusing this WebRequest (for example, due to a #ref click),
4137   // we don't want the transition type to persist.  Just clear it.
4138   navigation_state->set_transition_type(ui::PAGE_TRANSITION_LINK);
4139 }
4140
4141 void RenderFrameImpl::didStartLoading(bool to_different_document) {
4142   TRACE_EVENT1("navigation", "RenderFrameImpl::didStartLoading",
4143                "id", routing_id_);
4144   render_view_->FrameDidStartLoading(frame_);
4145   Send(new FrameHostMsg_DidStartLoading(routing_id_, to_different_document));
4146 }
4147
4148 void RenderFrameImpl::didStopLoading() {
4149   TRACE_EVENT1("navigation", "RenderFrameImpl::didStopLoading",
4150                "id", routing_id_);
4151   render_view_->FrameDidStopLoading(frame_);
4152   Send(new FrameHostMsg_DidStopLoading(routing_id_));
4153 }
4154
4155 void RenderFrameImpl::didChangeLoadProgress(double load_progress) {
4156   Send(new FrameHostMsg_DidChangeLoadProgress(routing_id_, load_progress));
4157 }
4158
4159 void RenderFrameImpl::HandleWebAccessibilityEvent(
4160     const blink::WebAXObject& obj, blink::WebAXEvent event) {
4161   if (renderer_accessibility_)
4162     renderer_accessibility_->HandleWebAccessibilityEvent(obj, event);
4163 }
4164
4165 void RenderFrameImpl::FocusedNodeChanged(const WebNode& node) {
4166   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, FocusedNodeChanged(node));
4167 }
4168
4169 void RenderFrameImpl::FocusedNodeChangedForAccessibility(const WebNode& node) {
4170   if (renderer_accessibility())
4171     renderer_accessibility()->AccessibilityFocusedNodeChanged(node);
4172 }
4173
4174 // PlzNavigate
4175 void RenderFrameImpl::OnCommitNavigation(
4176     const ResourceResponseHead& response,
4177     const GURL& stream_url,
4178     const CommonNavigationParams& common_params,
4179     const RequestNavigationParams& request_params) {
4180   CHECK(base::CommandLine::ForCurrentProcess()->HasSwitch(
4181       switches::kEnableBrowserSideNavigation));
4182   // This will override the url requested by the WebURLLoader, as well as
4183   // provide it with the response to the request.
4184   scoped_ptr<StreamOverrideParameters> stream_override(
4185       new StreamOverrideParameters());
4186   stream_override->stream_url = stream_url;
4187   stream_override->response = response;
4188
4189   NavigateInternal(common_params, StartNavigationParams(), request_params,
4190                    stream_override.Pass());
4191 }
4192
4193 void RenderFrameImpl::OnFailedNavigation(
4194     const CommonNavigationParams& common_params,
4195     const RequestNavigationParams& request_params,
4196     bool has_stale_copy_in_cache,
4197     int error_code) {
4198   bool is_reload = IsReload(common_params.navigation_type);
4199   bool is_history_navigation = request_params.page_state.IsValid();
4200   WebURLRequest::CachePolicy cache_policy =
4201       WebURLRequest::UseProtocolCachePolicy;
4202   RenderFrameImpl::PrepareRenderViewForNavigation(
4203       common_params.url, request_params, &is_reload, &cache_policy);
4204
4205   GetContentClient()->SetActiveURL(common_params.url);
4206
4207   pending_navigation_params_.reset(new NavigationParams(
4208       common_params, StartNavigationParams(), request_params));
4209
4210   // Inform the browser of the start of the provisional load. This is needed so
4211   // that the load is properly tracked by the WebNavigation API.
4212   Send(new FrameHostMsg_DidStartProvisionalLoadForFrame(
4213       routing_id_, common_params.url));
4214
4215   // Send the provisional load failure.
4216   blink::WebURLError error =
4217       CreateWebURLError(common_params.url, has_stale_copy_in_cache, error_code);
4218   WebURLRequest failed_request = CreateURLRequestForNavigation(
4219       common_params, scoped_ptr<StreamOverrideParameters>(),
4220       frame_->isViewSourceModeEnabled());
4221   SendFailedProvisionalLoad(failed_request, error, frame_);
4222
4223   if (!ShouldDisplayErrorPageForFailedLoad(error_code, common_params.url)) {
4224     // TODO(avi): Remove this; we shouldn't ever be dropping navigations.
4225     // http://crbug.com/501960
4226     Send(new FrameHostMsg_DidDropNavigation(routing_id_));
4227     return;
4228   }
4229
4230   // Make sure errors are not shown in view source mode.
4231   frame_->enableViewSourceMode(false);
4232
4233   // Replace the current history entry in reloads, history navigations and loads
4234   // of the same url. This corresponds to Blink's notion of a standard
4235   // commit.
4236   // TODO(clamy): see if initial commits in subframes should be handled
4237   // separately.
4238   bool replace = is_reload || is_history_navigation ||
4239                  common_params.url == GetLoadingUrl();
4240   LoadNavigationErrorPage(failed_request, error, replace);
4241 }
4242
4243 WebNavigationPolicy RenderFrameImpl::DecidePolicyForNavigation(
4244     RenderFrame* render_frame,
4245     const NavigationPolicyInfo& info) {
4246   Referrer referrer(RenderViewImpl::GetReferrerFromRequest(info.frame,
4247                                                            info.urlRequest));
4248
4249   // TODO(nick): Is consulting |is_subframe_| here correct?
4250   if (SiteIsolationPolicy::IsSwappedOutStateForbidden() && is_subframe_) {
4251     // There's no reason to ignore navigations on subframes, since the swap out
4252     // logic no longer applies.
4253   } else {
4254     if (is_swapped_out_) {
4255       if (info.urlRequest.url() != GURL(kSwappedOutURL)) {
4256         // Targeted links may try to navigate a swapped out frame.  Allow the
4257         // browser process to navigate the tab instead.  Note that it is also
4258         // possible for non-targeted navigations (from this view) to arrive
4259         // here just after we are swapped out.  It's ok to send them to the
4260         // browser, as long as they're for the top level frame.
4261         // TODO(creis): Ensure this supports targeted form submissions when
4262         // fixing http://crbug.com/101395.
4263         if (info.frame->parent() == NULL) {
4264           OpenURL(info.frame, info.urlRequest.url(), referrer,
4265                   info.defaultPolicy);
4266           return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
4267         }
4268
4269         // We should otherwise ignore in-process iframe navigations, if they
4270         // arrive just after we are swapped out.
4271         return blink::WebNavigationPolicyIgnore;
4272       }
4273
4274       // Allow kSwappedOutURL to complete.
4275       return info.defaultPolicy;
4276     }
4277   }
4278
4279   // Webkit is asking whether to navigate to a new URL.
4280   // This is fine normally, except if we're showing UI from one security
4281   // context and they're trying to navigate to a different context.
4282   const GURL& url = info.urlRequest.url();
4283
4284   // A content initiated navigation may have originated from a link-click,
4285   // script, drag-n-drop operation, etc.
4286   DocumentState* document_state = static_cast<DocumentState*>(info.extraData);
4287   bool is_content_initiated =
4288       document_state->navigation_state()->IsContentInitiated();
4289
4290   // If the browser is interested, then give it a chance to look at the request.
4291   if (is_content_initiated) {
4292     bool is_form_post =
4293         ((info.navigationType == blink::WebNavigationTypeFormSubmitted) ||
4294             (info.navigationType == blink::WebNavigationTypeFormResubmitted)) &&
4295         base::EqualsASCII(base::StringPiece16(info.urlRequest.httpMethod()),
4296                           "POST");
4297     bool browser_handles_request =
4298         render_view_->renderer_preferences_
4299             .browser_handles_non_local_top_level_requests
4300         && IsNonLocalTopLevelNavigation(url, info.frame, info.navigationType,
4301                                         is_form_post);
4302     if (!browser_handles_request) {
4303       browser_handles_request = IsTopLevelNavigation(info.frame) &&
4304           render_view_->renderer_preferences_
4305               .browser_handles_all_top_level_requests;
4306     }
4307
4308     if (browser_handles_request) {
4309       OpenURL(info.frame, url, referrer, info.defaultPolicy);
4310       return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
4311     }
4312   }
4313
4314   // Use the frame's original request's URL rather than the document's URL for
4315   // subsequent checks.  For a popup, the document's URL may become the opener
4316   // window's URL if the opener has called document.write().
4317   // See http://crbug.com/93517.
4318   GURL old_url(info.frame->dataSource()->request().url());
4319
4320   // Detect when we're crossing a permission-based boundary (e.g. into or out of
4321   // an extension or app origin, leaving a WebUI page, etc). We only care about
4322   // top-level navigations (not iframes). But we sometimes navigate to
4323   // about:blank to clear a tab, and we want to still allow that.
4324   //
4325   // Note: this is known to break POST submissions when crossing process
4326   // boundaries until http://crbug.com/101395 is fixed.  This is better for
4327   // security than loading a WebUI, extension or app page in the wrong process.
4328   // POST requests don't work because this mechanism does not preserve form
4329   // POST data. We will need to send the request's httpBody data up to the
4330   // browser process, and issue a special POST navigation in WebKit (via
4331   // FrameLoader::loadFrameRequest). See ResourceDispatcher and WebURLLoaderImpl
4332   // for examples of how to send the httpBody data.
4333   if (!info.frame->parent() && is_content_initiated &&
4334       !url.SchemeIs(url::kAboutScheme)) {
4335     bool send_referrer = false;
4336
4337     // All navigations to or from WebUI URLs or within WebUI-enabled
4338     // RenderProcesses must be handled by the browser process so that the
4339     // correct bindings and data sources can be registered.
4340     // Similarly, navigations to view-source URLs or within ViewSource mode
4341     // must be handled by the browser process (except for reloads - those are
4342     // safe to leave within the renderer).
4343     // Lastly, access to file:// URLs from non-file:// URL pages must be
4344     // handled by the browser so that ordinary renderer processes don't get
4345     // blessed with file permissions.
4346     int cumulative_bindings = RenderProcess::current()->GetEnabledBindings();
4347     bool is_initial_navigation = render_view_->history_list_length_ == 0;
4348     bool should_fork = HasWebUIScheme(url) || HasWebUIScheme(old_url) ||
4349         (cumulative_bindings & BINDINGS_POLICY_WEB_UI) ||
4350         url.SchemeIs(kViewSourceScheme) ||
4351         (info.frame->isViewSourceModeEnabled() &&
4352             info.navigationType != blink::WebNavigationTypeReload);
4353
4354     if (!should_fork && url.SchemeIs(url::kFileScheme)) {
4355       // Fork non-file to file opens.  Check the opener URL if this is the
4356       // initial navigation in a newly opened window.
4357       GURL source_url(old_url);
4358       if (is_initial_navigation && source_url.is_empty() &&
4359           info.frame->opener())
4360         source_url = info.frame->opener()->top()->document().url();
4361       DCHECK(!source_url.is_empty());
4362       should_fork = !source_url.SchemeIs(url::kFileScheme);
4363     }
4364
4365     if (!should_fork) {
4366       // Give the embedder a chance.
4367       should_fork = GetContentClient()->renderer()->ShouldFork(
4368           info.frame, url, info.urlRequest.httpMethod().utf8(),
4369           is_initial_navigation, info.isRedirect, &send_referrer);
4370     }
4371
4372     if (should_fork) {
4373       OpenURL(info.frame, url, send_referrer ? referrer : Referrer(),
4374               info.defaultPolicy);
4375       return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
4376     }
4377   }
4378
4379   // Detect when a page is "forking" a new tab that can be safely rendered in
4380   // its own process.  This is done by sites like Gmail that try to open links
4381   // in new windows without script connections back to the original page.  We
4382   // treat such cases as browser navigations (in which we will create a new
4383   // renderer for a cross-site navigation), rather than WebKit navigations.
4384   //
4385   // We use the following heuristic to decide whether to fork a new page in its
4386   // own process:
4387   // The parent page must open a new tab to about:blank, set the new tab's
4388   // window.opener to null, and then redirect the tab to a cross-site URL using
4389   // JavaScript.
4390   //
4391   // TODO(creis): Deprecate this logic once we can rely on rel=noreferrer
4392   // (see below).
4393   bool is_fork =
4394       // Must start from a tab showing about:blank, which is later redirected.
4395       old_url == GURL(url::kAboutBlankURL) &&
4396       // Must be the first real navigation of the tab.
4397       render_view_->historyBackListCount() < 1 &&
4398       render_view_->historyForwardListCount() < 1 &&
4399       // The parent page must have set the child's window.opener to null before
4400       // redirecting to the desired URL.
4401       info.frame->opener() == NULL &&
4402       // Must be a top-level frame.
4403       info.frame->parent() == NULL &&
4404       // Must not have issued the request from this page.
4405       is_content_initiated &&
4406       // Must be targeted at the current tab.
4407       info.defaultPolicy == blink::WebNavigationPolicyCurrentTab &&
4408       // Must be a JavaScript navigation, which appears as "other".
4409       info.navigationType == blink::WebNavigationTypeOther;
4410
4411   if (is_fork) {
4412     // Open the URL via the browser, not via WebKit.
4413     OpenURL(info.frame, url, Referrer(), info.defaultPolicy);
4414     return blink::WebNavigationPolicyIgnore;
4415   }
4416
4417   // PlzNavigate: if the navigation is not synchronous, send it to the browser.
4418   // This includes navigations with no request being sent to the network stack.
4419   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
4420           switches::kEnableBrowserSideNavigation) &&
4421       info.urlRequest.checkForBrowserSideNavigation() &&
4422       ShouldMakeNetworkRequestForURL(url)) {
4423     BeginNavigation(&info.urlRequest);
4424     return blink::WebNavigationPolicyIgnore;
4425   }
4426
4427   return info.defaultPolicy;
4428 }
4429
4430 void RenderFrameImpl::OpenURL(WebFrame* frame,
4431                               const GURL& url,
4432                               const Referrer& referrer,
4433                               WebNavigationPolicy policy) {
4434   DCHECK_EQ(frame_, frame);
4435
4436   FrameHostMsg_OpenURL_Params params;
4437   params.url = url;
4438   params.referrer = referrer;
4439   params.disposition = RenderViewImpl::NavigationPolicyToDisposition(policy);
4440   WebDataSource* ds = frame->provisionalDataSource();
4441   if (ds) {
4442     DocumentState* document_state = DocumentState::FromDataSource(ds);
4443     NavigationStateImpl* navigation_state =
4444         static_cast<NavigationStateImpl*>(document_state->navigation_state());
4445     if (navigation_state->IsContentInitiated()) {
4446       params.should_replace_current_entry =
4447           ds->replacesCurrentHistoryItem() &&
4448           render_view_->history_list_length_;
4449     } else {
4450       // This is necessary to preserve the should_replace_current_entry value on
4451       // cross-process redirects, in the event it was set by a previous process.
4452       //
4453       // TODO(davidben): Avoid this awkward duplication of state. See comment on
4454       // NavigationState::should_replace_current_entry().
4455       params.should_replace_current_entry =
4456           navigation_state->common_params().should_replace_current_entry;
4457     }
4458   } else {
4459     params.should_replace_current_entry = false;
4460   }
4461   params.user_gesture = WebUserGestureIndicator::isProcessingUserGesture();
4462   if (GetContentClient()->renderer()->AllowPopup())
4463     params.user_gesture = true;
4464
4465   if (policy == blink::WebNavigationPolicyNewBackgroundTab ||
4466       policy == blink::WebNavigationPolicyNewForegroundTab ||
4467       policy == blink::WebNavigationPolicyNewWindow ||
4468       policy == blink::WebNavigationPolicyNewPopup) {
4469     WebUserGestureIndicator::consumeUserGesture();
4470   }
4471
4472   Send(new FrameHostMsg_OpenURL(routing_id_, params));
4473 }
4474
4475 void RenderFrameImpl::NavigateInternal(
4476     const CommonNavigationParams& common_params,
4477     const StartNavigationParams& start_params,
4478     const RequestNavigationParams& request_params,
4479     scoped_ptr<StreamOverrideParameters> stream_params) {
4480   bool browser_side_navigation =
4481       base::CommandLine::ForCurrentProcess()->HasSwitch(
4482           switches::kEnableBrowserSideNavigation);
4483   bool is_reload = IsReload(common_params.navigation_type);
4484   bool is_history_navigation = request_params.page_state.IsValid();
4485   WebURLRequest::CachePolicy cache_policy =
4486       WebURLRequest::UseProtocolCachePolicy;
4487   RenderFrameImpl::PrepareRenderViewForNavigation(
4488       common_params.url, request_params, &is_reload, &cache_policy);
4489
4490   GetContentClient()->SetActiveURL(common_params.url);
4491
4492   // If this frame isn't in the same process as the main frame, it may naively
4493   // assume that this is the first navigation in the iframe, but this may not
4494   // actually be the case. Inform the frame's state machine if this frame has
4495   // already committed other loads.
4496   if (request_params.has_committed_real_load && frame_->parent())
4497     frame_->setCommittedFirstRealLoad();
4498
4499   if (is_reload && !render_view_->history_controller()->GetCurrentEntry()) {
4500     // We cannot reload if we do not have any history state.  This happens, for
4501     // example, when recovering from a crash.
4502     is_reload = false;
4503     cache_policy = WebURLRequest::ReloadIgnoringCacheData;
4504   }
4505
4506   pending_navigation_params_.reset(
4507       new NavigationParams(common_params, start_params, request_params));
4508
4509   // Create parameters for a standard navigation.
4510   blink::WebFrameLoadType load_type = blink::WebFrameLoadType::Standard;
4511   bool should_load_request = false;
4512   WebHistoryItem item_for_history_navigation;
4513   WebURLRequest request = CreateURLRequestForNavigation(
4514       common_params, stream_params.Pass(), frame_->isViewSourceModeEnabled());
4515 #if defined(OS_ANDROID)
4516   request.setHasUserGesture(start_params.has_user_gesture);
4517 #endif
4518
4519   // PlzNavigate: Make sure that Blink's loader will not try to use browser side
4520   // navigation for this request (since it already went to the browser).
4521   if (browser_side_navigation)
4522     request.setCheckForBrowserSideNavigation(false);
4523
4524   // If we are reloading, then use the history state of the current frame.
4525   // Otherwise, if we have history state, then we need to navigate to it, which
4526   // corresponds to a back/forward navigation event. Update the parameters
4527   // depending on the navigation type.
4528   if (is_reload) {
4529     bool ignore_cache = (common_params.navigation_type ==
4530                          FrameMsg_Navigate_Type::RELOAD_IGNORING_CACHE);
4531     load_type = ignore_cache ? blink::WebFrameLoadType::ReloadFromOrigin
4532                              : blink::WebFrameLoadType::Reload;
4533
4534     if (!browser_side_navigation) {
4535       const GURL override_url =
4536           (common_params.navigation_type ==
4537            FrameMsg_Navigate_Type::RELOAD_ORIGINAL_REQUEST_URL)
4538               ? common_params.url
4539               : GURL();
4540       request = frame_->requestForReload(load_type, override_url);
4541     }
4542     should_load_request = true;
4543   } else if (is_history_navigation) {
4544     // We must know the page ID of the page we are navigating back to.
4545     DCHECK_NE(request_params.page_id, -1);
4546     // We must know the nav entry ID of the page we are navigating back to,
4547     // which should be the case because history navigations are routed via the
4548     // browser.
4549     DCHECK_NE(0, request_params.nav_entry_id);
4550     scoped_ptr<HistoryEntry> entry =
4551         PageStateToHistoryEntry(request_params.page_state);
4552     if (entry) {
4553       // Ensure we didn't save the swapped out URL in UpdateState, since the
4554       // browser should never be telling us to navigate to swappedout://.
4555       CHECK(entry->root().urlString() != WebString::fromUTF8(kSwappedOutURL));
4556
4557       if (!browser_side_navigation) {
4558         scoped_ptr<NavigationParams> navigation_params(
4559             new NavigationParams(*pending_navigation_params_.get()));
4560         if (!SiteIsolationPolicy::UseSubframeNavigationEntries()) {
4561           // By default, tell the HistoryController to go the deserialized
4562           // HistoryEntry.  This only works if all frames are in the same
4563           // process.
4564           DCHECK(!frame_->parent());
4565           render_view_->history_controller()->GoToEntry(
4566               frame_, entry.Pass(), navigation_params.Pass(), cache_policy);
4567         } else {
4568           // In --site-per-process, the browser process sends a single
4569           // WebHistoryItem destined for this frame.
4570           // TODO(creis): Change PageState to FrameState.  In the meantime, we
4571           // store the relevant frame's WebHistoryItem in the root of the
4572           // PageState.
4573           SetPendingNavigationParams(navigation_params.Pass());
4574           blink::WebHistoryItem history_item = entry->root();
4575           blink::WebHistoryLoadType load_type =
4576               request_params.is_same_document_history_load
4577                   ? blink::WebHistorySameDocumentLoad
4578                   : blink::WebHistoryDifferentDocumentLoad;
4579
4580           // Let the history controller know the provisional entry, since it is
4581           // used at commit time.  Otherwise skip GoToEntry and navigate the
4582           // frame directly.
4583           // TODO(creis): Consider cloning the current entry to handle subframe
4584           // cases.  Changes to SendUpdateState might affect this.
4585           render_view_->history_controller()->set_provisional_entry(
4586               entry.Pass());
4587           WebURLRequest request =
4588               frame_->requestFromHistoryItem(history_item, cache_policy);
4589           frame_->load(request, blink::WebFrameLoadType::BackForward,
4590                        history_item, load_type);
4591         }
4592       } else {
4593         // TODO(clamy): this should be set to the HistoryItem sent by the
4594         // browser once the HistoryController has moved to the browser.
4595         // TODO(clamy): distinguish between different document and same document
4596         // loads.
4597         // TODO(clamy): update this for subframes history loads.
4598         item_for_history_navigation =
4599             entry->GetHistoryNodeForFrame(this)->item();
4600         load_type = blink::WebFrameLoadType::BackForward;
4601         should_load_request = true;
4602       }
4603     }
4604   } else {
4605     // Navigate to the given URL.
4606     if (!start_params.extra_headers.empty() && !browser_side_navigation) {
4607       for (net::HttpUtil::HeadersIterator i(start_params.extra_headers.begin(),
4608                                             start_params.extra_headers.end(),
4609                                             "\n");
4610            i.GetNext();) {
4611         request.addHTTPHeaderField(WebString::fromUTF8(i.name()),
4612                                    WebString::fromUTF8(i.values()));
4613       }
4614     }
4615
4616     if (start_params.is_post && !browser_side_navigation) {
4617       request.setHTTPMethod(WebString::fromUTF8("POST"));
4618
4619       // Set post data.
4620       WebHTTPBody http_body;
4621       http_body.initialize();
4622       const char* data = nullptr;
4623       if (start_params.browser_initiated_post_data.size()) {
4624         data = reinterpret_cast<const char*>(
4625             &start_params.browser_initiated_post_data.front());
4626       }
4627       http_body.appendData(
4628           WebData(data, start_params.browser_initiated_post_data.size()));
4629       request.setHTTPBody(http_body);
4630     }
4631
4632     // A session history navigation should have been accompanied by state.
4633     CHECK_EQ(request_params.page_id, -1);
4634
4635     should_load_request = true;
4636   }
4637
4638   if (should_load_request) {
4639     // Record this before starting the load. We need a lower bound of this
4640     // time to sanitize the navigationStart override set below.
4641     base::TimeTicks renderer_navigation_start = base::TimeTicks::Now();
4642
4643     // Perform a navigation to a data url if needed.
4644     if (!common_params.base_url_for_data_url.is_empty() ||
4645         (browser_side_navigation &&
4646          common_params.url.SchemeIs(url::kDataScheme))) {
4647       LoadDataURL(common_params, frame_);
4648     } else {
4649       // Load the request.
4650       frame_->toWebLocalFrame()->load(request, load_type,
4651                                       item_for_history_navigation);
4652     }
4653
4654     if (load_type == blink::WebFrameLoadType::Standard) {
4655       UpdateFrameNavigationTiming(frame_,
4656                                   request_params.browser_navigation_start,
4657                                   renderer_navigation_start);
4658     }
4659   }
4660
4661   // In case LoadRequest failed before didCreateDataSource was called.
4662   pending_navigation_params_.reset();
4663 }
4664
4665 void RenderFrameImpl::UpdateEncoding(WebFrame* frame,
4666                                      const std::string& encoding_name) {
4667   // Only update main frame's encoding_name.
4668   if (!frame->parent())
4669     Send(new FrameHostMsg_UpdateEncoding(routing_id_, encoding_name));
4670 }
4671
4672 void RenderFrameImpl::SyncSelectionIfRequired() {
4673   base::string16 text;
4674   size_t offset;
4675   gfx::Range range;
4676 #if defined(ENABLE_PLUGINS)
4677   if (render_view_->focused_pepper_plugin_) {
4678     render_view_->focused_pepper_plugin_->GetSurroundingText(&text, &range);
4679     offset = 0;  // Pepper API does not support offset reporting.
4680     // TODO(kinaba): cut as needed.
4681   } else
4682 #endif
4683   {
4684     size_t location, length;
4685     if (!GetRenderWidget()->webwidget()->caretOrSelectionRange(
4686             &location, &length)) {
4687       return;
4688     }
4689
4690     range = gfx::Range(location, location + length);
4691
4692     if (GetRenderWidget()->webwidget()->textInputInfo().type !=
4693             blink::WebTextInputTypeNone) {
4694       // If current focused element is editable, we will send 100 more chars
4695       // before and after selection. It is for input method surrounding text
4696       // feature.
4697       if (location > kExtraCharsBeforeAndAfterSelection)
4698         offset = location - kExtraCharsBeforeAndAfterSelection;
4699       else
4700         offset = 0;
4701       length = location + length - offset + kExtraCharsBeforeAndAfterSelection;
4702       WebRange webrange = WebRange::fromDocumentRange(frame_, offset, length);
4703       if (!webrange.isNull())
4704         text = webrange.toPlainText();
4705     } else {
4706       offset = location;
4707       text = frame_->selectionAsText();
4708       // http://crbug.com/101435
4709       // In some case, frame->selectionAsText() returned text's length is not
4710       // equal to the length returned from webwidget()->caretOrSelectionRange().
4711       // So we have to set the range according to text.length().
4712       range.set_end(range.start() + text.length());
4713     }
4714   }
4715
4716   // Sometimes we get repeated didChangeSelection calls from webkit when
4717   // the selection hasn't actually changed. We don't want to report these
4718   // because it will cause us to continually claim the X clipboard.
4719   if (selection_text_offset_ != offset ||
4720       selection_range_ != range ||
4721       selection_text_ != text) {
4722     selection_text_ = text;
4723     selection_text_offset_ = offset;
4724     selection_range_ = range;
4725     SetSelectedText(text, offset, range);
4726   }
4727   GetRenderWidget()->UpdateSelectionBounds();
4728 }
4729
4730 void RenderFrameImpl::InitializeUserMediaClient() {
4731   if (!RenderThreadImpl::current())  // Will be NULL during unit tests.
4732     return;
4733
4734 #if defined(ENABLE_WEBRTC)
4735   DCHECK(!web_user_media_client_);
4736   web_user_media_client_ = new UserMediaClientImpl(
4737       this,
4738       RenderThreadImpl::current()->GetPeerConnectionDependencyFactory(),
4739       make_scoped_ptr(new MediaStreamDispatcher(this)).Pass());
4740 #endif
4741 }
4742
4743 WebMediaPlayer* RenderFrameImpl::CreateWebMediaPlayerForMediaStream(
4744     WebMediaPlayerClient* client) {
4745 #if defined(ENABLE_WEBRTC)
4746 #if defined(OS_ANDROID) && defined(ARCH_CPU_ARMEL)
4747   bool found_neon =
4748       (android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_NEON) != 0;
4749   UMA_HISTOGRAM_BOOLEAN("Platform.WebRtcNEONFound", found_neon);
4750 #endif  // defined(OS_ANDROID) && defined(ARCH_CPU_ARMEL)
4751   scoped_refptr<base::SingleThreadTaskRunner>  compositor_task_runner =
4752       RenderThreadImpl::current()->compositor_task_runner();
4753   if (!compositor_task_runner.get())
4754     compositor_task_runner = base::MessageLoop::current()->task_runner();
4755   return new WebMediaPlayerMS(
4756       frame_, client, weak_factory_.GetWeakPtr(), new RenderMediaLog(),
4757       CreateRendererFactory(),
4758       compositor_task_runner);
4759 #else
4760   return NULL;
4761 #endif  // defined(ENABLE_WEBRTC)
4762 }
4763
4764 scoped_ptr<MediaStreamRendererFactory>
4765 RenderFrameImpl::CreateRendererFactory() {
4766   scoped_ptr<MediaStreamRendererFactory> factory =
4767       GetContentClient()->renderer()->CreateMediaStreamRendererFactory();
4768   if (factory.get())
4769     return factory.Pass();
4770 #if defined(ENABLE_WEBRTC)
4771   return scoped_ptr<MediaStreamRendererFactory>(
4772       new MediaStreamRendererFactoryImpl());
4773 #else
4774   return scoped_ptr<MediaStreamRendererFactory>(
4775       static_cast<MediaStreamRendererFactory*>(NULL));
4776 #endif
4777 }
4778
4779 void RenderFrameImpl::PrepareRenderViewForNavigation(
4780     const GURL& url,
4781     const RequestNavigationParams& request_params,
4782     bool* is_reload,
4783     WebURLRequest::CachePolicy* cache_policy) {
4784   DCHECK(render_view_->webview());
4785
4786   MaybeHandleDebugURL(url);
4787
4788   FOR_EACH_OBSERVER(
4789       RenderViewObserver, render_view_->observers_, Navigate(url));
4790
4791   render_view_->history_list_offset_ =
4792       request_params.current_history_list_offset;
4793   render_view_->history_list_length_ =
4794       request_params.current_history_list_length;
4795   if (request_params.should_clear_history_list) {
4796     CHECK_EQ(-1, render_view_->history_list_offset_);
4797     CHECK_EQ(0, render_view_->history_list_length_);
4798   }
4799
4800   if (!is_swapped_out_ || frame_->parent())
4801     return;
4802
4803   // This is a swapped out main frame, so swap the renderer back in.
4804   // We marked the view as hidden when swapping the view out, so be sure to
4805   // reset the visibility state before navigating to the new URL.
4806   render_view_->webview()->setVisibilityState(
4807       render_view_->visibilityState(), false);
4808
4809   // If this is an attempt to reload while we are swapped out, we should not
4810   // reload swappedout://, but the previous page, which is stored in
4811   // params.state.  Setting is_reload to false will treat this like a back
4812   // navigation to accomplish that.
4813   *is_reload = false;
4814   *cache_policy = WebURLRequest::ReloadIgnoringCacheData;
4815
4816   // We refresh timezone when a view is swapped in since timezone
4817   // can get out of sync when the system timezone is updated while
4818   // the view is swapped out.
4819   RenderThreadImpl::NotifyTimezoneChange();
4820
4821   render_view_->SetSwappedOut(false);
4822   is_swapped_out_ = false;
4823   return;
4824 }
4825
4826 void RenderFrameImpl::BeginNavigation(blink::WebURLRequest* request) {
4827   CHECK(base::CommandLine::ForCurrentProcess()->HasSwitch(
4828       switches::kEnableBrowserSideNavigation));
4829   DCHECK(request);
4830   // TODO(clamy): Execute the beforeunload event.
4831
4832   // Note: At this stage, the goal is to apply all the modifications the
4833   // renderer wants to make to the request, and then send it to the browser, so
4834   // that the actual network request can be started. Ideally, all such
4835   // modifications should take place in willSendRequest, and in the
4836   // implementation of willSendRequest for the various InspectorAgents
4837   // (devtools).
4838   //
4839   // TODO(clamy): Apply devtools override.
4840   // TODO(clamy): Make sure that navigation requests are not modified somewhere
4841   // else in blink.
4842   willSendRequest(frame_, 0, *request, blink::WebURLResponse());
4843
4844   // TODO(clamy): Same-document navigations should not be sent back to the
4845   // browser.
4846   // TODO(clamy): Data urls should not be sent back to the browser either.
4847   bool should_replace_current_entry = false;
4848   WebDataSource* provisional_data_source = frame_->provisionalDataSource();
4849   WebDataSource* current_data_source = frame_->dataSource();
4850   WebDataSource* data_source =
4851       provisional_data_source ? provisional_data_source : current_data_source;
4852
4853   // The current entry can only be replaced if there already is an entry in the
4854   // history list.
4855   if (data_source && render_view_->history_list_length_ > 0) {
4856     should_replace_current_entry = data_source->replacesCurrentHistoryItem();
4857   }
4858   Send(new FrameHostMsg_BeginNavigation(
4859       routing_id_,
4860       MakeCommonNavigationParams(request, should_replace_current_entry),
4861       BeginNavigationParams(
4862           request->httpMethod().latin1(), GetWebURLRequestHeaders(*request),
4863           GetLoadFlagsForWebURLRequest(*request), request->hasUserGesture()),
4864       GetRequestBodyForWebURLRequest(*request)));
4865 }
4866
4867 void RenderFrameImpl::LoadDataURL(const CommonNavigationParams& params,
4868                                   WebFrame* frame) {
4869   // A loadData request with a specified base URL.
4870   std::string mime_type, charset, data;
4871   if (net::DataURL::Parse(params.url, &mime_type, &charset, &data)) {
4872     const GURL base_url = params.base_url_for_data_url.is_empty() ?
4873         params.url : params.base_url_for_data_url;
4874     frame->loadData(
4875         WebData(data.c_str(), data.length()),
4876         WebString::fromUTF8(mime_type),
4877         WebString::fromUTF8(charset),
4878         base_url,
4879         params.history_url_for_data_url,
4880         false);
4881   } else {
4882     CHECK(false) << "Invalid URL passed: "
4883                  << params.url.possibly_invalid_spec();
4884   }
4885 }
4886
4887 void RenderFrameImpl::SendFailedProvisionalLoad(
4888     const blink::WebURLRequest& request,
4889     const blink::WebURLError& error,
4890     blink::WebLocalFrame* frame) {
4891   bool show_repost_interstitial =
4892       (error.reason == net::ERR_CACHE_MISS &&
4893        base::EqualsASCII(base::StringPiece16(request.httpMethod()), "POST"));
4894
4895   FrameHostMsg_DidFailProvisionalLoadWithError_Params params;
4896   params.error_code = error.reason;
4897   GetContentClient()->renderer()->GetNavigationErrorStrings(
4898       render_view_.get(), frame, request, error, NULL,
4899       &params.error_description);
4900   params.url = error.unreachableURL;
4901   params.showing_repost_interstitial = show_repost_interstitial;
4902   params.was_ignored_by_handler = error.wasIgnoredByHandler;
4903   Send(new FrameHostMsg_DidFailProvisionalLoadWithError(routing_id_, params));
4904 }
4905
4906 bool RenderFrameImpl::ShouldDisplayErrorPageForFailedLoad(
4907     int error_code,
4908     const GURL& unreachable_url) {
4909   // Don't display an error page if this is simply a cancelled load.  Aside
4910   // from being dumb, Blink doesn't expect it and it will cause a crash.
4911   if (error_code == net::ERR_ABORTED)
4912     return false;
4913
4914   // Don't display "client blocked" error page if browser has asked us not to.
4915   if (error_code == net::ERR_BLOCKED_BY_CLIENT &&
4916       render_view_->renderer_preferences_.disable_client_blocked_error_page) {
4917     return false;
4918   }
4919
4920   // Allow the embedder to suppress an error page.
4921   if (GetContentClient()->renderer()->ShouldSuppressErrorPage(
4922           this, unreachable_url)) {
4923     return false;
4924   }
4925
4926   if (RenderThreadImpl::current() &&
4927       RenderThreadImpl::current()->layout_test_mode()) {
4928     return false;
4929   }
4930
4931   return true;
4932 }
4933
4934 GURL RenderFrameImpl::GetLoadingUrl() const {
4935   WebDataSource* ds = frame_->dataSource();
4936   if (ds->hasUnreachableURL())
4937     return ds->unreachableURL();
4938
4939   const WebURLRequest& request = ds->request();
4940   return request.url();
4941 }
4942
4943 void RenderFrameImpl::PopulateDocumentStateFromPending(
4944     DocumentState* document_state) {
4945   document_state->set_request_time(
4946       pending_navigation_params_->request_params.request_time);
4947
4948   InternalDocumentStateData* internal_data =
4949       InternalDocumentStateData::FromDocumentState(document_state);
4950
4951   if (!pending_navigation_params_->common_params.url.SchemeIs(
4952           url::kJavaScriptScheme) &&
4953       pending_navigation_params_->common_params.navigation_type ==
4954           FrameMsg_Navigate_Type::RESTORE) {
4955     // We're doing a load of a page that was restored from the last session. By
4956     // default this prefers the cache over loading (LOAD_PREFERRING_CACHE) which
4957     // can result in stale data for pages that are set to expire. We explicitly
4958     // override that by setting the policy here so that as necessary we load
4959     // from the network.
4960     //
4961     // TODO(davidben): Remove this in favor of passing a cache policy to the
4962     // loadHistoryItem call in OnNavigate. That requires not overloading
4963     // UseProtocolCachePolicy to mean both "normal load" and "determine cache
4964     // policy based on load type, etc".
4965     internal_data->set_cache_policy_override(
4966         WebURLRequest::UseProtocolCachePolicy);
4967   }
4968
4969   if (IsReload(pending_navigation_params_->common_params.navigation_type))
4970     document_state->set_load_type(DocumentState::RELOAD);
4971   else if (pending_navigation_params_->request_params.page_state.IsValid())
4972     document_state->set_load_type(DocumentState::HISTORY_LOAD);
4973   else
4974     document_state->set_load_type(DocumentState::NORMAL_LOAD);
4975
4976   internal_data->set_is_overriding_user_agent(
4977       pending_navigation_params_->request_params.is_overriding_user_agent);
4978   internal_data->set_must_reset_scroll_and_scale_state(
4979       pending_navigation_params_->common_params.navigation_type ==
4980       FrameMsg_Navigate_Type::RELOAD_ORIGINAL_REQUEST_URL);
4981   document_state->set_can_load_local_resources(
4982       pending_navigation_params_->request_params.can_load_local_resources);
4983 }
4984
4985 NavigationState* RenderFrameImpl::CreateNavigationStateFromPending() {
4986   // A navigation resulting from loading a javascript URL should not be treated
4987   // as a browser initiated event.  Instead, we want it to look as if the page
4988   // initiated any load resulting from JS execution.
4989   if (!pending_navigation_params_->common_params.url.SchemeIs(
4990           url::kJavaScriptScheme)) {
4991     return NavigationStateImpl::CreateBrowserInitiated(
4992         pending_navigation_params_->common_params,
4993         pending_navigation_params_->start_params,
4994         pending_navigation_params_->request_params);
4995   }
4996   return NavigationStateImpl::CreateContentInitiated();
4997 }
4998
4999 #if defined(OS_ANDROID)
5000 WebMediaPlayer* RenderFrameImpl::CreateAndroidWebMediaPlayer(
5001     WebMediaPlayerClient* client,
5002     WebMediaPlayerEncryptedMediaClient* encrypted_client,
5003     const media::WebMediaPlayerParams& params) {
5004   scoped_refptr<StreamTextureFactory> stream_texture_factory;
5005   if (SynchronousCompositorFactory* factory =
5006           SynchronousCompositorFactory::GetInstance()) {
5007     stream_texture_factory = factory->CreateStreamTextureFactory(routing_id_);
5008   } else {
5009     GpuChannelHost* gpu_channel_host =
5010         RenderThreadImpl::current()->EstablishGpuChannelSync(
5011             CAUSE_FOR_GPU_LAUNCH_VIDEODECODEACCELERATOR_INITIALIZE);
5012
5013     if (!gpu_channel_host) {
5014       LOG(ERROR) << "Failed to establish GPU channel for media player";
5015       return NULL;
5016     }
5017
5018     scoped_refptr<cc_blink::ContextProviderWebContext> context_provider =
5019         RenderThreadImpl::current()->SharedMainThreadContextProvider();
5020
5021     if (!context_provider.get()) {
5022       LOG(ERROR) << "Failed to get context3d for media player";
5023       return NULL;
5024     }
5025
5026     stream_texture_factory = StreamTextureFactoryImpl::Create(
5027         context_provider, gpu_channel_host, routing_id_);
5028   }
5029
5030   return new WebMediaPlayerAndroid(
5031       frame_, client, encrypted_client, weak_factory_.GetWeakPtr(),
5032       GetMediaPlayerManager(), GetCdmFactory(), stream_texture_factory, params);
5033 }
5034
5035 RendererMediaPlayerManager* RenderFrameImpl::GetMediaPlayerManager() {
5036   if (!media_player_manager_)
5037     media_player_manager_ = new RendererMediaPlayerManager(this);
5038   return media_player_manager_;
5039 }
5040 #endif  // defined(OS_ANDROID)
5041
5042 media::MediaPermission* RenderFrameImpl::GetMediaPermission() {
5043   if (!media_permission_dispatcher_)
5044     media_permission_dispatcher_ = new MediaPermissionDispatcher(this);
5045   return media_permission_dispatcher_;
5046 }
5047
5048 #if defined(ENABLE_MOJO_MEDIA)
5049 media::interfaces::ServiceFactory* RenderFrameImpl::GetMediaServiceFactory() {
5050   if (!media_service_factory_) {
5051     mojo::ServiceProviderPtr service_provider =
5052         ConnectToApplication(GURL("mojo:media"));
5053     mojo::ConnectToService(service_provider.get(), &media_service_factory_);
5054     media_service_factory_.set_connection_error_handler(
5055         base::Bind(&RenderFrameImpl::OnMediaServiceFactoryConnectionError,
5056                    base::Unretained(this)));
5057   }
5058
5059   return media_service_factory_.get();
5060 }
5061
5062 void RenderFrameImpl::OnMediaServiceFactoryConnectionError() {
5063   // TODO(xhwang): Resetting |media_service_factory_| could cause access
5064   // violation on the old |media_service_factory_| by outstanding
5065   // media::CdmFactory or media::RendererFactory. Find a better way to handle
5066   // this.
5067   // media_service_factory_.reset();
5068 }
5069 #endif
5070
5071 bool RenderFrameImpl::AreSecureCodecsSupported() {
5072 #if defined(OS_ANDROID)
5073   // Hardware-secure codecs are only supported if secure surfaces are enabled.
5074   return render_view_->renderer_preferences_
5075       .use_video_overlay_for_embedded_encrypted_video;
5076 #else
5077   return false;
5078 #endif  // defined(OS_ANDROID)
5079 }
5080
5081 media::CdmFactory* RenderFrameImpl::GetCdmFactory() {
5082 #if defined(ENABLE_BROWSER_CDMS)
5083   if (!cdm_manager_)
5084     cdm_manager_ = new RendererCdmManager(this);
5085 #endif  // defined(ENABLE_BROWSER_CDMS)
5086
5087   if (!cdm_factory_) {
5088     DCHECK(frame_);
5089
5090 #if defined(ENABLE_MOJO_MEDIA)
5091     cdm_factory_.reset(new media::MojoCdmFactory(GetMediaServiceFactory()));
5092 #else
5093     cdm_factory_.reset(new RenderCdmFactory(
5094 #if defined(ENABLE_PEPPER_CDMS)
5095         base::Bind(&PepperCdmWrapperImpl::Create, frame_)
5096 #elif defined(ENABLE_BROWSER_CDMS)
5097         cdm_manager_
5098 #endif
5099         ));
5100 #endif  //  defined(ENABLE_MOJO_MEDIA)
5101   }
5102
5103   return cdm_factory_.get();
5104 }
5105
5106 void RenderFrameImpl::RegisterMojoServices() {
5107   // Only main frame have ImageDownloader service.
5108   if (!frame_->parent()) {
5109     GetServiceRegistry()->AddService<image_downloader::ImageDownloader>(
5110         base::Bind(&ImageDownloaderImpl::CreateMojoService,
5111                    base::Unretained(this)));
5112   }
5113 }
5114
5115 mojo::ServiceProviderPtr RenderFrameImpl::ConnectToApplication(
5116     const GURL& url) {
5117   DCHECK(mojo_shell_);
5118   mojo::ServiceProviderPtr service_provider;
5119   mojo::URLRequestPtr request(mojo::URLRequest::New());
5120   request->url = mojo::String::From(url);
5121   mojo_shell_->ConnectToApplication(request.Pass(), GetProxy(&service_provider),
5122                                     nullptr, nullptr,
5123                                     base::Bind(&OnGotContentHandlerID));
5124   return service_provider.Pass();
5125 }
5126
5127 }  // namespace content