Make <webview> use out-of-process iframe architecture.

content/browser/frame_host/render_frame_proxy_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 
 #include "base/lazy_instance.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_tree.h"
@@ skipping 42 matching lines @@
       render_frame_proxy_created_(false),
       render_view_host_(render_view_host) {
   GetProcess()->AddRoute(routing_id_, this);
   CHECK(g_routing_id_frame_proxy_map.Get().insert(
       std::make_pair(
           RenderFrameProxyHostID(GetProcess()->GetID(), routing_id_),
           this)).second);
   CHECK(render_view_host_);
   frame_tree_node_->frame_tree()->AddRenderViewHostRef(render_view_host_);
 
-  if (!frame_tree_node_->IsMainFrame() &&
-      frame_tree_node_->parent()
-              ->render_manager()
-              ->current_frame_host()
-              ->GetSiteInstance() == site_instance) {
+  bool is_proxy_to_parent = !frame_tree_node_->IsMainFrame() &&
+                            frame_tree_node_->parent()
+                                    ->render_manager()
+                                    ->current_frame_host()
+                                    ->GetSiteInstance() == site_instance;
+
+  // If this is a proxy to parent frame or this proxy is for the inner
+  // WebContents's FrameTreeNode in outer WebContents's process, then we need a
+  // CrossProcessFrameConnector.
+  if (is_proxy_to_parent ||
+      frame_tree_node_->render_manager()->ForInnerDelegate()) {
     // The RenderFrameHost navigating cross-process is destroyed and a proxy for
     // it is created in the parent's process. CrossProcessFrameConnector
     // initialization only needs to happen on an initial cross-process
     // navigation, when the RenderFrameHost leaves the same process as its
     // parent. The same CrossProcessFrameConnector is used for subsequent cross-
     // process navigations, but it will be destroyed if the frame is
     // navigated back to the same SiteInstance as its parent.
     cross_process_frame_connector_.reset(new CrossProcessFrameConnector(this));
   }
 }
@@ skipping 95 matching lines @@
 
   render_frame_proxy_created_ = true;
   return true;
 }
 
 void RenderFrameProxyHost::DisownOpener() {
   Send(new FrameMsg_DisownOpener(GetRoutingID()));
 }
 
 void RenderFrameProxyHost::OnDetach() {
+  if (frame_tree_node_->render_manager()->ForInnerDelegate()) {

[lazyboy, 2015/06/03 22:32:27]

I've fixed the proxy detached issue.

The scenario is:

Let, the outer WebContents's FT:
  A
 /
B
And the inner one's FT:
C

C.proxy_hosts_[A] is the proxy we create in outer process.
This lives in guest FTN, i.e. C.

When we do removeChild(B) from JavaScript, this sends
C.proxy_hosts_[A].OnDetach()

Now since this proxy host lives in main frame, the following
check will fail. The FrameTreeNode we want to delete in this
case is B. I've done this by asking C's RFHM to delete the outer
FTN. This is RFHM::RemoveOuterDelegateFrame().

Note that before this patchset, C's OuterDelegateFrameTreeNodeID()
was pointing to A.frame_tree_node_id(), now this points to
B.frame_tree_node_id() instead so that we can find out B.

+    frame_tree_node_->render_manager()->RemoveOuterDelegateFrame();
+    return;
+  }
+
   // This message should only be received for subframes.  Note that we can't
   // restrict it to just the current SiteInstances of the ancestors of this
   // frame, because another frame in the tree may be able to detach this frame
   // by navigating its parent.
   if (frame_tree_node_->IsMainFrame()) {
     bad_message::ReceivedBadMessage(GetProcess(), bad_message::RFPH_DETACH);
     return;
   }
   frame_tree_node_->frame_tree()->RemoveFrame(frame_tree_node_);
 }
@@ skipping 80 matching lines @@
         base::Bind(&MessagePortMessageFilter::RouteMessageEventWithMessagePorts,
                    message_port_message_filter, target_rfh->GetRoutingID(),
                    new_params));
   } else {
     target_rfh->Send(
         new FrameMsg_PostMessageEvent(target_rfh->GetRoutingID(), new_params));
   }
 }
 
 }  // namespace content