Make <webview> use out-of-process iframe architecture.

extensions/browser/guest_view/guest_view_message_filter.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/guest_view/guest_view_message_filter.h"
 
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "extensions/browser/guest_view/guest_view_base.h"
 #include "extensions/browser/guest_view/guest_view_manager.h"
 #include "extensions/browser/guest_view/mime_handler_view/mime_handler_view_constants.h"
 #include "extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.h"
+#include "extensions/browser/guest_view/web_view/web_view_guest.h"
 #include "extensions/common/guest_view/guest_view_messages.h"
 #include "ipc/ipc_message_macros.h"
 
 using content::BrowserContext;
 using content::BrowserThread;
 using content::RenderFrameHost;
 using content::WebContents;
 
 namespace extensions {
 
 GuestViewMessageFilter::GuestViewMessageFilter(int render_process_id,
                                                BrowserContext* context)
     : BrowserMessageFilter(GuestViewMsgStart),
       render_process_id_(render_process_id),
       browser_context_(context),
       weak_ptr_factory_(this) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 }
 
 GuestViewMessageFilter::~GuestViewMessageFilter() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 }
 
 void GuestViewMessageFilter::OverrideThreadForMessage(
     const IPC::Message& message,
     BrowserThread::ID* thread) {
   switch (message.type()) {
     case GuestViewHostMsg_AttachGuest::ID:
     case GuestViewHostMsg_CreateMimeHandlerViewGuest::ID:
+    case GuestViewHostMsg_AttachLocalFrameToGuest::ID:
       *thread = BrowserThread::UI;
       break;
     default:
       break;
   }
 }
 
 void GuestViewMessageFilter::OnDestruct() const {
   // Destroy the filter on the IO thread since that's where its weak pointers
   // are being used.
   BrowserThread::DeleteOnIOThread::Destruct(this);
 }
 
 bool GuestViewMessageFilter::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(GuestViewMessageFilter, message)
     IPC_MESSAGE_HANDLER(GuestViewHostMsg_AttachGuest, OnAttachGuest)
     IPC_MESSAGE_HANDLER(GuestViewHostMsg_CreateMimeHandlerViewGuest,
                         OnCreateMimeHandlerViewGuest)
+    IPC_MESSAGE_HANDLER(GuestViewHostMsg_AttachLocalFrameToGuest,
+                        OnAttachLocalFrameToGuest)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 void GuestViewMessageFilter::OnAttachGuest(
     int element_instance_id,
     int guest_instance_id,
     const base::DictionaryValue& params) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
@@ skipping 33 matching lines @@
   base::DictionaryValue create_params;
   create_params.SetString(mime_handler_view::kViewId, view_id);
   create_params.SetInteger(guestview::kElementWidth, element_size.width());
   create_params.SetInteger(guestview::kElementHeight, element_size.height());
   manager->CreateGuest(MimeHandlerViewGuest::Type,
                        embedder_web_contents,
                        create_params,
                        callback);
 }
 
+void GuestViewMessageFilter::OnAttachLocalFrameToGuest(
+    int embedder_local_render_frame_id,
+    int element_instance_id,
+    int guest_instance_id) {
+  auto guest_manager = GuestViewManager::FromBrowserContext(browser_context_);
+  DCHECK(guest_manager);
+  content::WebContents* guest_web_contents =
+      guest_manager->GetGuestByInstanceIDHack(guest_instance_id);

[Fady Samuel, 2015/03/04 20:44:47]

Why are you exposing this? This is a security issue. This means that an embedder
can lie about what guest it owns and get access to that guest.

[lazyboy, 2015/04/01 21:47:58]

This is temporary and will be fixed.

+  DCHECK(guest_web_contents);
+  auto guest = WebViewGuest::FromWebContents(guest_web_contents);
+  DCHECK(guest);
+  content::WebContents* owner_web_contents = guest->owner_web_contents();
+  DCHECK(owner_web_contents);
+  int render_view_proxy_routing_id =
+      guest_web_contents->AttachLocalFrameToGuest(
+          owner_web_contents,
+          embedder_local_render_frame_id,
+          guest_instance_id);
+
+  owner_web_contents->GetMainFrame()->Send(
+      new GuestViewMsg_ContentWindowReady(
+         element_instance_id,
+         render_view_proxy_routing_id));
+}
+
 void GuestViewMessageFilter::MimeHandlerViewGuestCreatedCallback(
     int element_instance_id,
     int embedder_render_process_id,
     int embedder_render_frame_id,
     const gfx::Size& element_size,
     WebContents* web_contents) {
   auto manager = GuestViewManager::FromBrowserContext(browser_context_);
   if (!manager)
     return;
 
@@ skipping 13 matching lines @@
   manager->AttachGuest(embedder_render_process_id,
                        element_instance_id,
                        guest_instance_id,
                        attach_params);
 
   rfh->Send(
       new GuestViewMsg_CreateMimeHandlerViewGuestACK(element_instance_id));
 }
 
 }  // namespace extensions