Browser Plugin: New Implementation (Browser Side)

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/stats_counters.h"
 #include "base/string16.h"
 #include "base/string_number_conversions.h"
 #include "base/string_util.h"
 #include "base/sys_info.h"
 #include "base/time.h"
 #include "base/utf_string_conversions.h"
+#include "content/browser/browser_plugin/browser_plugin_embedder.h"
+#include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/browser_plugin/old/old_browser_plugin_host.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/debugger/devtools_manager_impl.h"
 #include "content/browser/dom_storage/dom_storage_context_impl.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
 #include "content/browser/download/download_stats.h"
 #include "content/browser/download/mhtml_generation_manager.h"
 #include "content/browser/download/save_package.h"
 #include "content/browser/gpu/gpu_data_manager_impl.h"
 #include "content/browser/gpu/gpu_process_host.h"
 #include "content/browser/host_zoom_map_impl.h"
 #include "content/browser/intents/web_intents_dispatcher_impl.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/resource_dispatcher_host_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_contents/interstitial_page_impl.h"
 #include "content/browser/web_contents/navigation_entry_impl.h"
 #include "content/browser/webui/web_ui_impl.h"
+#include "content/common/browser_plugin_messages.h"
 #include "content/common/intents_messages.h"
 #include "content/common/ssl_status_serialization.h"
 #include "content/common/view_messages.h"
 #include "content/port/browser/render_view_host_delegate_view.h"
 #include "content/port/browser/render_widget_host_view_port.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/color_chooser.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/devtools_agent_host_registry.h"
 #include "content/public/browser/download_manager.h"
@@ skipping 632 matching lines @@
     IPC_MESSAGE_HANDLER(ViewHostMsg_CrashedPlugin, OnCrashedPlugin)
     IPC_MESSAGE_HANDLER(ViewHostMsg_AppCacheAccessed, OnAppCacheAccessed)
     IPC_MESSAGE_HANDLER(ViewHostMsg_OpenColorChooser, OnOpenColorChooser)
     IPC_MESSAGE_HANDLER(ViewHostMsg_EndColorChooser, OnEndColorChooser)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SetSelectedColorInColorChooser,
                         OnSetSelectedColorInColorChooser)
     IPC_MESSAGE_HANDLER(ViewHostMsg_PepperPluginHung, OnPepperPluginHung)
     IPC_MESSAGE_HANDLER(ViewHostMsg_WebUISend, OnWebUISend)
     IPC_MESSAGE_HANDLER(ViewHostMsg_RequestPpapiBrokerPermission,
                         OnRequestPpapiBrokerPermission)
+    IPC_MESSAGE_HANDLER(BrowserPluginHostMsg_NavigateGuest,
+                        OnBrowserPluginNavigateGuest)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP_EX()
   message_source_ = NULL;
 
   if (!message_is_ok) {
     content::RecordAction(UserMetricsAction("BadMessageTerminate_RVD"));
     GetRenderProcessHost()->ReceivedBadMessage();
   }
 
   return handled;
@@ skipping 1567 matching lines @@
 }
 
 void WebContentsImpl::OnPpapiBrokerPermissionResult(int request_id,
                                                     bool result) {
   RenderViewHostImpl* rvh = GetRenderViewHostImpl();
   rvh->Send(new ViewMsg_PpapiBrokerPermissionResult(rvh->GetRoutingID(),
                                                     request_id,
                                                     result));
 }
 
+void WebContentsImpl::OnBrowserPluginNavigateGuest(int instance_id,
+                                                   int64 frame_id,
+                                                   const std::string& src,
+                                                   const gfx::Size& size) {
+  // This is the first 'navigate' to a browser plugin, before WebContents has/is
+  // an 'Embedder'; subsequent navigate messages for this WebContents will
+  // be handled by the BrowserPluginEmbedderHelper of the embedder itself (this
+  // also means any message from browser plugin renderer prior to NavigateGuest
+  // which is not NavigateGuest will be ignored). Therefore
+  // |browser_plugin_embedder_| should not be set.
+  CHECK(!browser_plugin_embedder_.get());
+
+  browser_plugin_embedder_.reset(
+      content::BrowserPluginEmbedder::Create(this, GetRenderViewHost()));
+  browser_plugin_embedder_->NavigateGuest(GetRenderViewHost(),
+                                          instance_id,
+                                          frame_id,
+                                          src,
+                                          size);
+}
+
 // Notifies the RenderWidgetHost instance about the fact that the page is
 // loading, or done loading and calls the base implementation.
 void WebContentsImpl::SetIsLoading(bool is_loading,
                                    LoadNotificationDetails* details) {
   if (is_loading == is_loading_)
     return;
 
   if (!is_loading) {
     load_state_ = net::LoadStateWithParam(net::LOAD_STATE_IDLE, string16());
     load_state_host_.clear();
@@ skipping 136 matching lines @@
 
 void WebContentsImpl::NotifySwapped() {
   // After sending out a swap notification, we need to send a disconnect
   // notification so that clients that pick up a pointer to |this| can NULL the
   // pointer.  See Bug 1230284.
   notify_disconnection_ = true;
   content::NotificationService::current()->Notify(
       content::NOTIFICATION_WEB_CONTENTS_SWAPPED,
       content::Source<WebContents>(this),
       content::NotificationService::NoDetails());
+
+  // Ensure that the associated embedder gets cleared after a RenderViewHost
+  // gets swapped, so we don't reuse the same embedder next time a
+  // RenderViewHost is attached to this WebContents (for security concerns).
+  RemoveSwappedOutBrowserPluginEmbedder();

[awong, 2012/09/06 19:55:26]

Can we add a test asserting this behavior, both that a non-swapping load doesn't
change the browser_plugin_embedder_ and that a swapping load does change it.

[lazyboy, 2012/09/07 19:33:19]

Will this be a similar browsertest that we currently have?
(running by you to verify):
1. Load a page with guest, so we have browser_plugin_embedder_ in WC
2. click on some link on the page (no swap),  ensure same
browser_plugin_embedder_ is present in WC
3. type something in url bar (so we have swapped out RVH) , ensure
browser_plugin_embedder_ is reset to NULL.

[awong, 2012/09/07 20:51:03]

Yes, something like that.  Is there already a test that covers this?

[lazyboy, 2012/09/08 02:12:22]

No there isn't. I'll be adding one soon.

On 2012/09/07 20:51:03, awong wrote:

 }
 
 void WebContentsImpl::NotifyConnected() {
   notify_disconnection_ = true;
   content::NotificationService::current()->Notify(
       content::NOTIFICATION_WEB_CONTENTS_CONNECTED,
       content::Source<WebContents>(this),
       content::NotificationService::NoDetails());
 }
 
@@ skipping 25 matching lines @@
 WebContents* WebContentsImpl::GetAsWebContents() {
   return this;
 }
 
 gfx::Rect WebContentsImpl::GetRootWindowResizerRect() const {
   if (delegate_)
     return delegate_->GetRootWindowResizerRect();
   return gfx::Rect();
 }
 
+void WebContentsImpl::RemoveSwappedOutBrowserPluginEmbedder() {
+  if (browser_plugin_embedder_.get() &&
+      !browser_plugin_embedder_->IsForRenderViewHost(GetRenderViewHost())) {

[awong, 2012/09/06 19:55:26]

Is there a case where you get a swapped signal, have a previous
browser_plugin_embedder_, and have it be the same RVH?  What's the sequence?
browser_plugin_embedder_ somehow gets created before the provisional load of the
top-level frame commits?

[lazyboy, 2012/09/07 19:33:19]

This is unnecessary it seems (I had way less idea about swapping at the time of
writing this). I always seem to get different RVH when I get a swap call,
Removed.

+    browser_plugin_embedder_.reset();
+  }
+}
+
 void WebContentsImpl::RenderViewCreated(RenderViewHost* render_view_host) {
   // Don't send notifications if we are just creating a swapped-out RVH for
   // the opener chain.  These won't be used for view-source or WebUI, so it's
   // ok to return early.
   if (static_cast<RenderViewHostImpl*>(render_view_host)->is_swapped_out())
     return;
 
   content::NotificationService::current()->Notify(
       content::NOTIFICATION_WEB_CONTENTS_RENDER_VIEW_HOST_CREATED,
       content::Source<WebContents>(this),
@@ skipping 768 matching lines @@
       old_browser_plugin_host()->embedder_render_process_host();
   *embedder_container_id = old_browser_plugin_host()->instance_id();
   int embedder_process_id =
       embedder_render_process_host ? embedder_render_process_host->GetID() : -1;
   if (embedder_process_id != -1) {
     *embedder_channel_name =
         StringPrintf("%d.r%d", render_view_host->GetProcess()->GetID(),
                      embedder_process_id);
   }
 }
+
+content::BrowserPluginGuest* WebContentsImpl::AssignBrowserPluginGuest(
+    int instance_id) {
+  browser_plugin_guest_.reset(content::BrowserPluginGuest::Create(
+      instance_id, this, GetRenderViewHost()));
+  return browser_plugin_guest_.get();
+}
+
+content::BrowserPluginGuest* WebContentsImpl::GetBrowserPluginGuest() {
+  return browser_plugin_guest_.get();
+}
+
+content::BrowserPluginEmbedder* WebContentsImpl::GetBrowserPluginEmbedder() {
+  return browser_plugin_embedder_.get();
+}