Browser Plugin: Add HTML5-like postMessage support

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
@@ skipping 2987 matching lines @@
   // It is possible to receive it from one that has just been swapped in,
   // in which case we might as well deliver the message anyway.
   if (rvh->GetSiteInstance()->IsRelatedSiteInstance(GetSiteInstance()))
     GetRenderViewHost()->ClosePage();
 }
 
 void WebContentsImpl::RouteMessageEvent(
     RenderViewHost* rvh,
     const ViewMsg_PostMessage_Params& params) {
   // Only deliver the message to the active RenderViewHost if the request
-  // came from a RenderViewHost in the same BrowsingInstance.
-  if (!rvh->GetSiteInstance()->IsRelatedSiteInstance(GetSiteInstance()))
+  // came from a RenderViewHost in the same BrowsingInstance or if this
+  // WebContents is dedicated to a browser plugin guest.
+  // Note: This check means that an embedder could theoretically receive a
+  // postMessage from anyone (not just its own guests). However, this is
+  // probably not a risk for apps since other pages won't have references
+  // to App windows.
+  if (!rvh->GetSiteInstance()->IsRelatedSiteInstance(GetSiteInstance()) &&
+      !GetBrowserPluginGuest() && !GetBrowserPluginEmbedder())
     return;
 
   ViewMsg_PostMessage_Params new_params(params);
 
   // If the renderer has changed while the post message is being routed,
   // drop the message, as it will not be delivered to the right target.
   // TODO(nasko): Check for process ID and target frame id mismatch, once
   // http://crbug.com/153701 is fixed.
 
   // If there is a source_routing_id, translate it to the routing ID for
   // the equivalent swapped out RVH in the target process.  If we need
   // to create a swapped out RVH for the source tab, we create its opener
   // chain as well, since those will also be accessible to the target page.
   if (new_params.source_routing_id != MSG_ROUTING_NONE) {
     // Try to look up the WebContents for the source page.
     WebContentsImpl* source_contents = NULL;
     RenderViewHostImpl* source_rvh = RenderViewHostImpl::FromID(
         rvh->GetProcess()->GetID(), params.source_routing_id);
     if (source_rvh) {
       source_contents = static_cast<WebContentsImpl*>(
           source_rvh->GetDelegate()->GetAsWebContents());
     }
 
     if (source_contents) {
-      new_params.source_routing_id =
-          source_contents->CreateOpenerRenderViews(GetSiteInstance());
+      if (GetBrowserPluginGuest()) {
+        // We create a swapped out RenderView for the embedder in the guest's
+        // render process but we intentionally do not expose the embedder's
+        // opener chain to it.
+        new_params.source_routing_id =
+            source_contents->CreateSwappedOutRenderView(GetSiteInstance());
+      } else {
+        new_params.source_routing_id =
+            source_contents->CreateOpenerRenderViews(GetSiteInstance());
+      }
     } else {
       // We couldn't find it, so don't pass a source frame.
       new_params.source_routing_id = MSG_ROUTING_NONE;
     }
   }
 
   // In most cases, we receive this from a swapped out RenderViewHost.
   // It is possible to receive it from one that has just been swapped in,
   // in which case we might as well deliver the message anyway.
   Send(new ViewMsg_PostMessageEvent(GetRoutingID(), new_params));
@@ skipping 82 matching lines @@
 }
 
 WebPreferences WebContentsImpl::GetWebkitPrefs() {
   // We want to base the page config off of the real URL, rather than the
   // display URL.
   GURL url = controller_.GetActiveEntry()
       ? controller_.GetActiveEntry()->GetURL() : GURL::EmptyGURL();
   return GetWebkitPrefs(GetRenderViewHost(), url);
 }
 
+int WebContentsImpl::CreateSwappedOutRenderView(
+    content::SiteInstance* instance) {
+  return render_manager_.CreateRenderView(instance, MSG_ROUTING_NONE, true);
+}
+
 void WebContentsImpl::OnUserGesture() {
   // Notify observers.
   FOR_EACH_OBSERVER(WebContentsObserver, observers_, DidGetUserGesture());
 
   ResourceDispatcherHostImpl* rdh = ResourceDispatcherHostImpl::Get();
   if (rdh)  // NULL in unittests.
     rdh->OnUserGesture(this);
 }
 
 void WebContentsImpl::OnIgnoredUIEvent() {
@@ skipping 259 matching lines @@
   }
 }
 
 content::BrowserPluginGuest* WebContentsImpl::GetBrowserPluginGuest() {
   return browser_plugin_guest_.get();
 }
 
 content::BrowserPluginEmbedder* WebContentsImpl::GetBrowserPluginEmbedder() {
   return browser_plugin_embedder_.get();
 }