[3/5 chromium] Shows the clients which are controlled by ServiceWorker in DevTools.

content/browser/service_worker/service_worker_provider_host.cc

Index: content/browser/service_worker/service_worker_provider_host.cc
diff --git a/content/browser/service_worker/service_worker_provider_host.cc b/content/browser/service_worker/service_worker_provider_host.cc
index 599047519bc3e313936a6e6c7b1b44f56bd9c907..9b57d8b31697367e699cbf085ca5988997049b02 100644
--- a/content/browser/service_worker/service_worker_provider_host.cc
+++ b/content/browser/service_worker/service_worker_provider_host.cc
@@ -31,11 +31,9 @@ namespace content {
 
 namespace {
 
-ServiceWorkerClientInfo FocusOnUIThread(
-    int render_process_id,
-    int render_frame_id) {
+ServiceWorkerClientInfo FocusOnUIThread(int render_process_id, int route_id) {

[dcheng, 2015/06/17 02:57:30]

Some questions:
1) What should focus do if it's called on a service worker for a shared worker?
2) What happens if we fail to find a RenderFrameHost? Won't we just crash the
browser today?
3) Can a compromised renderer focus any RenderFrameHost it wants?

[horo, 2015/06/17 07:37:05]

We only support focusing windows.
WindowClient interface has focus() method, but Client interface doesn't have.
https://slightlyoff.github.io/ServiceWorker/spec/service_worker/#client
So if the controlled client is a shared worker, we can't call .focus().
I added a code to check |provider_type_| in ServiceWorkerProviderHost::Focus().
It doesn't crash.
It just returns an empty ServiceWorkerClientInfo.
Only when the compromised renderer knows the UUID of the pages which are
controlled by ServiceWorkers, it can focus them.

   RenderFrameHostImpl* render_frame_host =
-      RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
+      RenderFrameHostImpl::FromID(render_process_id, route_id);
   WebContentsImpl* web_contents = static_cast<WebContentsImpl*>(
       WebContents::FromRenderFrameHost(render_frame_host));
 
@@ -54,7 +52,7 @@ ServiceWorkerClientInfo FocusOnUIThread(
   web_contents->Activate();
 
   return ServiceWorkerProviderHost::GetWindowClientInfoOnUI(render_process_id,
-                                                            render_frame_id);
+                                                            route_id);
 }
 
 }  // anonymous namespace
@@ -70,14 +68,14 @@ ServiceWorkerProviderHost::OneShotGetReadyCallback::~OneShotGetReadyCallback() {
 
 ServiceWorkerProviderHost::ServiceWorkerProviderHost(
     int render_process_id,
-    int render_frame_id,
+    int route_id,
     int provider_id,
     ServiceWorkerProviderType provider_type,
     base::WeakPtr<ServiceWorkerContextCore> context,
     ServiceWorkerDispatcherHost* dispatcher_host)
     : client_uuid_(base::GenerateGUID()),
       render_process_id_(render_process_id),
-      render_frame_id_(render_frame_id),
+      route_id_(route_id),
       render_thread_id_(kDocumentMainThreadId),
       provider_id_(provider_id),
       provider_type_(provider_type),
@@ -112,6 +110,12 @@ ServiceWorkerProviderHost::~ServiceWorkerProviderHost() {
     DecreaseProcessReference(pattern);
 }
 
+int ServiceWorkerProviderHost::frame_id() const {
+  if (provider_type_ == SERVICE_WORKER_PROVIDER_FOR_WINDOW)
+    return route_id_;
+  return MSG_ROUTING_NONE;
+}
+
 void ServiceWorkerProviderHost::OnVersionAttributesChanged(
     ServiceWorkerRegistration* registration,
     ChangedVersionAttributesMask changed_mask,
@@ -388,10 +392,7 @@ void ServiceWorkerProviderHost::PostMessage(
 void ServiceWorkerProviderHost::Focus(const GetClientInfoCallback& callback) {
   BrowserThread::PostTaskAndReplyWithResult(
       BrowserThread::UI, FROM_HERE,
-      base::Bind(&FocusOnUIThread,
-                 render_process_id_,
-                 render_frame_id_),
-      callback);
+      base::Bind(&FocusOnUIThread, render_process_id_, route_id_), callback);
 }
 
 void ServiceWorkerProviderHost::GetWindowClientInfo(
@@ -399,16 +400,16 @@ void ServiceWorkerProviderHost::GetWindowClientInfo(
   BrowserThread::PostTaskAndReplyWithResult(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&ServiceWorkerProviderHost::GetWindowClientInfoOnUI,
-                 render_process_id_, render_frame_id_),
+                 render_process_id_, route_id_),
       callback);
 }
 
 // static
 ServiceWorkerClientInfo ServiceWorkerProviderHost::GetWindowClientInfoOnUI(
     int render_process_id,
-    int render_frame_id) {
+    int route_id) {
   RenderFrameHostImpl* render_frame_host =
-      RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
+      RenderFrameHostImpl::FromID(render_process_id, route_id);
   if (!render_frame_host)
     return ServiceWorkerClientInfo();
 
@@ -453,7 +454,7 @@ bool ServiceWorkerProviderHost::GetRegistrationForReady(
 
 void ServiceWorkerProviderHost::PrepareForCrossSiteTransfer() {
   DCHECK_NE(ChildProcessHost::kInvalidUniqueID, render_process_id_);
-  DCHECK_NE(MSG_ROUTING_NONE, render_frame_id_);
+  DCHECK_NE(MSG_ROUTING_NONE, route_id_);
   DCHECK_EQ(kDocumentMainThreadId, render_thread_id_);
   DCHECK_NE(SERVICE_WORKER_PROVIDER_UNKNOWN, provider_type_);
 
@@ -471,7 +472,7 @@ void ServiceWorkerProviderHost::PrepareForCrossSiteTransfer() {
   }
 
   render_process_id_ = ChildProcessHost::kInvalidUniqueID;
-  render_frame_id_ = MSG_ROUTING_NONE;
+  route_id_ = MSG_ROUTING_NONE;
   render_thread_id_ = kInvalidEmbeddedWorkerThreadId;
   provider_id_ = kInvalidServiceWorkerProviderId;
   provider_type_ = SERVICE_WORKER_PROVIDER_UNKNOWN;
@@ -489,7 +490,7 @@ void ServiceWorkerProviderHost::CompleteCrossSiteTransfer(
   DCHECK_NE(MSG_ROUTING_NONE, new_frame_id);
 
   render_process_id_ = new_process_id;
-  render_frame_id_ = new_frame_id;
+  route_id_ = new_frame_id;
   render_thread_id_ = kDocumentMainThreadId;
   provider_id_ = new_provider_id;
   provider_type_ = new_provider_type;