Make <webview> use out-of-process iframe architecture.

content/browser/frame_host/render_frame_proxy_host.cc

Index: content/browser/frame_host/render_frame_proxy_host.cc
diff --git a/content/browser/frame_host/render_frame_proxy_host.cc b/content/browser/frame_host/render_frame_proxy_host.cc
index fe62776995198a81592cc5447b7a85eb01f11c0c..87bddd817db361884b07aeacf17bdbe79a5df6cc 100644
--- a/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/content/browser/frame_host/render_frame_proxy_host.cc
@@ -56,11 +56,18 @@ RenderFrameProxyHost::RenderFrameProxyHost(SiteInstance* site_instance,
           RenderFrameProxyHostID(GetProcess()->GetID(), routing_id_),
           this)).second);
 
-  if (!frame_tree_node_->IsMainFrame() &&
+  // If this is a proxy to embedder created in the guest's FTN, then we

[Charlie Reis, 2015/04/30 23:06:46]

If this is a proxy for the guest's FTN in its embedder's process,

[lazyboy, 2015/05/05 07:28:14]

Done.

+  // need a CrossProcessFrameConnector.
+  bool is_proxy_to_embedder_for_guest =

[Charlie Reis, 2015/04/30 23:06:46]

is_proxy_for_guest_in_embedder

[lazyboy, 2015/05/05 07:28:14]

Obsolete.

+      frame_tree_node_->IsMainFrame() &&
+      frame_tree_node_->render_manager()->current_frame_host()
+          ->GetSiteInstance()->GetSiteURL().SchemeIs("chrome-guest");

[Charlie Reis, 2015/04/30 23:06:46]

Seems like there would be better ways to tell whether it's a guest, like a
RFHM::IsGuest() (which might use something like GetEmbedderFrameTreeNodeID()
under the hood).  The SiteInstance site URL feels a bit fragile as the uses of
<webview> evolve.

[lazyboy, 2015/05/05 07:28:14]

I've changed this to use RFHM::IsGuest() that I've added.

+  if ((!frame_tree_node_->IsMainFrame() &&
       frame_tree_node_->parent()
               ->render_manager()
               ->current_frame_host()
-              ->GetSiteInstance() == site_instance) {
+              ->GetSiteInstance() == site_instance) ||
+      is_proxy_to_embedder_for_guest) {
     // The RenderFrameHost navigating cross-process is destroyed and a proxy for
     // it is created in the parent's process. CrossProcessFrameConnector
     // initialization only needs to happen on an initial cross-process
@@ -92,9 +99,17 @@ void RenderFrameProxyHost::SetChildRWHView(RenderWidgetHostView* view) {
       static_cast<RenderWidgetHostViewChildFrame*>(view));
 }
 
+// TODO(lazyboy): We can probably cache a pointer to RVH in this class
+// as we do in RenderFrameHostImpl.
 RenderViewHostImpl* RenderFrameProxyHost::GetRenderViewHost() {
-  return frame_tree_node_->frame_tree()->GetRenderViewHost(
-      site_instance_.get());
+  // RVH of embedder site instance does not live in the guest RFHM, we need
+  // to look it up in the embedder's FrameTree.
+  RenderFrameProxyHost* proxy_to_embedder =
+      frame_tree_node_->render_manager()->GetProxyToEmbedder();
+  FrameTree* frame_tree = proxy_to_embedder ?

[Charlie Reis, 2015/04/30 23:06:46]

This looks buggy.  It uses the embedder's frame tree for any RFPH in the guest,
not just the RFPH in the embedder's SiteInstance.

[lazyboy, 2015/05/05 07:28:14]

Added to check whether this proxy's site instance matches with the one of
|proxy_to_embedder|.

+      proxy_to_embedder->frame_tree_node_->frame_tree() :
+      frame_tree_node_->frame_tree();
+  return frame_tree->GetRenderViewHost(site_instance_.get());
 }
 
 void RenderFrameProxyHost::TakeFrameHostOwnership(