Make it so that allow_js_access: false can be used with background pages created by window.open.

content/renderer/render_view_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
@@ skipping 1463 matching lines @@
   params.opener_security_origin =
       creator->document().securityOrigin().toString().utf8();
   params.opener_suppressed = creator->willSuppressOpenerInNewFrame();
   params.disposition = NavigationPolicyToDisposition(policy);
   if (!request.isNull())
     params.target_url = request.url();
 
   int32 routing_id = MSG_ROUTING_NONE;
   int32 surface_id = 0;
   int64 cloned_session_storage_namespace_id;
+  bool no_js_access;
 
   RenderThread::Get()->Send(
       new ViewHostMsg_CreateWindow(params,
                                    &routing_id,
                                    &surface_id,
-                                   &cloned_session_storage_namespace_id));
+                                   &cloned_session_storage_namespace_id,
+                                   &no_js_access));
   if (routing_id == MSG_ROUTING_NONE)
     return NULL;
 
   // TODO(fsamuel): The host renderer needs to be able to control whether

[Andrew T Wilson (Slow), 2012/03/26 15:28:10]

Naive question - what happens if we don't do all of this (what if the above
check read):

if (routing_id == MSG_ROUTING_NONE || no_js_access) return NULL;

So no RenderViewImpl is created? Since it's a background page, do we need to
create the RenderView?

[Charlie Reis, 2012/03/26 17:56:51]

Wouldn't that mean that no WebKit Frame is created for it?  I don't know much
about BackgroundContents, but they do have a RenderViewHost, right?

I agree that it feels weird to wire up a connected RenderView when we don't want
the page to be able to script it, and I'm not yet convinced that this current
approach will be enough.  (There might still be some ways for a reference to
leak through, since the routing_id is valid.)

The alternative is doing something similar to http://crbug.com/69267, where we
open the background page in a new BrowsingInstance (and thus a separate
process).  Then we're guaranteed to have no references leak.  Not sure if that's
the process model behavior we want in this case or not.

See this CL for context:
https://chromiumcodereview.appspot.com/9325082

[Mihai Parparita -not on Chrome, 2012/03/27 01:16:07]

Thanks for the pointer to this. I've changed this CL to use that approach
instead.

   // the guest renderer is allowed to do this or not. This current
   // behavior is not well defined.
   RenderViewImpl* view = RenderViewImpl::Create(
       0,
       routing_id_,
       renderer_preferences_,
       webkit_preferences_,
       shared_popup_counter_,
       routing_id,
       surface_id,
@@ skipping 10 matching lines @@
   // Record the security origin of the creator.
   GURL creator_url(creator->document().securityOrigin().toString().utf8());
   if (!creator_url.is_valid() || !creator_url.IsStandard())
     creator_url = GURL();
   view->creator_url_ = creator_url;
 
   // Copy over the alternate error page URL so we can have alt error pages in
   // the new render view (we don't need the browser to send the URL back down).
   view->alternate_error_page_url_ = alternate_error_page_url_;
 
-  return view->webview();
+  return no_js_access ? NULL : view->webview();
 }
 
 WebWidget* RenderViewImpl::createPopupMenu(WebKit::WebPopupType popup_type) {
   RenderWidget* widget =
       RenderWidget::Create(routing_id_, popup_type, screen_info_);
   return widget->webwidget();
 }
 
 WebWidget* RenderViewImpl::createPopupMenu(const WebPopupMenuInfo& info) {
   // TODO(jcivelli): Remove this deprecated method when its been removed from
@@ skipping 3671 matching lines @@
 bool RenderViewImpl::WebWidgetHandlesCompositorScheduling() const {
   return !!RenderThreadImpl::current()->compositor_thread();
 }
 
 void RenderViewImpl::OnJavaBridgeInit() {
   DCHECK(!java_bridge_dispatcher_.get());
 #if defined(ENABLE_JAVA_BRIDGE)
   java_bridge_dispatcher_.reset(new JavaBridgeDispatcher(this));
 #endif
 }