Propagate scrolling/marginwidth/marginheight property values to child frame.

content/browser/frame_host/render_frame_host_impl.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_FRAME_HOST_RENDER_FRAME_HOST_IMPL_H_
 #define CONTENT_BROWSER_FRAME_HOST_RENDER_FRAME_HOST_IMPL_H_
 
 #include <map>
 #include <vector>
 
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/gtest_prod_util.h"
 #include "base/memory/weak_ptr.h"
 #include "base/strings/string16.h"
 #include "base/time/time.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
+#include "content/browser/bad_message.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/common/accessibility_mode_enums.h"
 #include "content/common/ax_content_node_data.h"
 #include "content/common/content_export.h"
 #include "content/common/frame_message_enums.h"
 #include "content/common/frame_replication_state.h"
 #include "content/common/image_downloader/image_downloader.mojom.h"
 #include "content/common/mojo/service_registry_impl.h"
 #include "content/common/navigation_params.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/common/javascript_message_type.h"
 #include "net/http/http_response_headers.h"
+#include "third_party/WebKit/public/web/WebFrameOwnerProperties.h"
 #include "third_party/WebKit/public/web/WebTextDirection.h"
 #include "third_party/WebKit/public/web/WebTreeScopeType.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/base/page_transition_types.h"
 
 #if defined(OS_ANDROID)
 #include "content/browser/mojo/service_registry_android.h"
 #endif
 
 class GURL;
@@ skipping 157 matching lines @@
   // Tracks whether the RenderFrame for this RenderFrameHost has been created in
   // the renderer process.  This is currently only used for subframes.
   // TODO(creis): Use this for main frames as well when RVH goes away.
   void SetRenderFrameCreated(bool created);
 
   // Called for renderer-created windows to resume requests from this frame,
   // after they are blocked in RenderWidgetHelper::CreateNewWindow.
   void Init();
 
   int routing_id() const { return routing_id_; }
-  void OnCreateChildFrame(int new_routing_id,
-                          blink::WebTreeScopeType scope,
-                          const std::string& frame_name,
-                          blink::WebSandboxFlags sandbox_flags);
+  void OnCreateChildFrame(
+      int new_routing_id,
+      blink::WebTreeScopeType scope,
+      const std::string& frame_name,
+      blink::WebSandboxFlags sandbox_flags,
+      const blink::WebFrameOwnerProperties& frame_owner_properties);
 
   RenderViewHostImpl* render_view_host() { return render_view_host_; }
   RenderFrameHostDelegate* delegate() { return delegate_; }
   FrameTreeNode* frame_tree_node() { return frame_tree_node_; }
 
   // Returns this RenderFrameHost's loading state. This method is only used by
   // FrameTreeNode. The proper way to check whether a frame is loading is to
   // call FrameTreeNode::IsLoading.
   bool is_loading() const { return is_loading_; }
 
@@ skipping 314 matching lines @@
                                 IPC::Message* reply_msg);
   void OnTextSurroundingSelectionResponse(const base::string16& content,
                                           size_t start_offset,
                                           size_t end_offset);
   void OnDidAccessInitialDocument();
   void OnDidChangeOpener(int32 opener_routing_id);
   void OnDidChangeName(const std::string& name);
   void OnDidAssignPageId(int32 page_id);
   void OnDidChangeSandboxFlags(int32 frame_routing_id,
                                blink::WebSandboxFlags flags);
+  void OnDidChangeFrameOwnerProperties(
+      int32 frame_routing_id,
+      const blink::WebFrameOwnerProperties& frame_owner_properties);
   void OnUpdateTitle(const base::string16& title,
                      blink::WebTextDirection title_direction);
   void OnUpdateEncoding(const std::string& encoding);
   void OnBeginNavigation(const CommonNavigationParams& common_params,
                          const BeginNavigationParams& begin_params,
                          scoped_refptr<ResourceRequestBody> body);
   void OnDispatchLoad();
   void OnAccessibilityEvents(
       const std::vector<AccessibilityHostMsg_EventParams>& params,
       int reset_token);
@@ skipping 60 matching lines @@
   RenderWidgetHostViewBase* GetViewForAccessibility();
 
   // Sends a navigate message to the RenderFrame and notifies DevTools about
   // navigation happening. Should be used instead of sending the message
   // directly.
   void SendNavigateMessage(
       const content::CommonNavigationParams& common_params,
       const content::StartNavigationParams& start_params,
       const content::RequestNavigationParams& request_params);
 
+  // Returns the child FrameTreeNode if |child_frame_routing_id| is an
+  // immediate child of this FrameTreeNode.  Kills this renderer otherwise

[Charlie Reis, 2015/10/14 23:34:17]

nit: Change second sentence to:
|child_frame_routing_id| is considered untrusted, so the renderer process is
killed if it refers to a FrameTreeNode that is not a child of this node.

(I want to be clear that it doesn't kill the process if the node isn't found,
since that can happen via races.)

[lazyboy, 2015/10/15 02:31:39]

Done.

+  // with bad message |reason|.
+  FrameTreeNode* CheckAndGetIfChild(

[Charlie Reis, 2015/10/14 23:34:17]

FindAndVerifyChild

[lazyboy, 2015/10/15 02:31:39]

Done.

+      int32 child_frame_routing_id, bad_message::BadMessageReason reason);
+
   // For now, RenderFrameHosts indirectly keep RenderViewHosts alive via a
   // refcount that calls Shutdown when it reaches zero.  This allows each
   // RenderFrameHostManager to just care about RenderFrameHosts, while ensuring
   // we have a RenderViewHost for each RenderFrameHost.
   // TODO(creis): RenderViewHost will eventually go away and be replaced with
   // some form of page context.
   RenderViewHostImpl* render_view_host_;
 
   RenderFrameHostDelegate* delegate_;
 
@@ skipping 157 matching lines @@
 
   // NOTE: This must be the last member.
   base::WeakPtrFactory<RenderFrameHostImpl> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameHostImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_FRAME_HOST_RENDER_FRAME_HOST_IMPL_H_