Adds better security checking to OnCreatedFrame()

components/web_view/frame_tree.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/web_view/frame_tree.h"
 
 #include "base/command_line.h"
 #include "components/web_view/frame_tree_delegate.h"
 #include "components/web_view/frame_user_data.h"
 #include "components/web_view/web_view_switches.h"
 
 namespace web_view {
 
 FrameTree::FrameTree(uint32_t root_app_id,
                      mojo::View* view,
+                     mojo::ViewTreeClientPtr view_tree_client,
                      FrameTreeDelegate* delegate,
                      FrameTreeClient* root_client,
                      scoped_ptr<FrameUserData> user_data,
                      const Frame::ClientPropertyMap& client_properties)
     : view_(view),
       delegate_(delegate),
       root_(this,
             view,
             view->id(),
             root_app_id,
             ViewOwnership::DOESNT_OWN_VIEW,
             root_client,
             user_data.Pass(),
             client_properties),
       progress_(0.f),
       change_id_(1u) {
-  root_.Init(nullptr);
+  root_.Init(nullptr, view_tree_client.Pass());
 }
 
 FrameTree::~FrameTree() {
 }
 
 // static
 bool FrameTree::AlwaysCreateNewFrameTree() {
   return base::CommandLine::ForCurrentProcess()->HasSwitch(
       web_view::switches::kOOPIFAlwaysCreateNewFrameTree);
 }
 
 Frame* FrameTree::CreateAndAddFrame(mojo::View* view,
                                     Frame* parent,
                                     uint32_t app_id,
                                     FrameTreeClient* client,
                                     scoped_ptr<FrameUserData> user_data) {
   return CreateAndAddFrameImpl(view, view->id(), app_id, parent, client,
                                user_data.Pass(), Frame::ClientPropertyMap());
 }
 
-void FrameTree::CreateSharedFrame(
+Frame* FrameTree::CreateSharedFrame(
     Frame* parent,
     uint32_t frame_id,
     uint32_t app_id,
     const Frame::ClientPropertyMap& client_properties) {
   mojo::View* frame_view = root_.view()->GetChildById(frame_id);
   // |frame_view| may be null if the View hasn't been created yet. If this is
   // the case the View will be connected to the Frame in Frame::OnTreeChanged.
-  CreateAndAddFrameImpl(frame_view, frame_id, app_id, parent, nullptr, nullptr,
-                        client_properties);
+  return CreateAndAddFrameImpl(frame_view, frame_id, app_id, parent, nullptr,
+                               nullptr, client_properties);
 }
 
 uint32_t FrameTree::AdvanceChangeID() {
   return ++change_id_;
 }
 
 Frame* FrameTree::CreateAndAddFrameImpl(
     mojo::View* view,
     uint32_t frame_id,
     uint32_t app_id,
     Frame* parent,
     FrameTreeClient* client,
     scoped_ptr<FrameUserData> user_data,
     const Frame::ClientPropertyMap& client_properties) {
   Frame* frame =
       new Frame(this, view, frame_id, app_id, ViewOwnership::OWNS_VIEW, client,
                 user_data.Pass(), client_properties);
-  frame->Init(parent);
+  frame->Init(parent, nullptr);
   return frame;
 }
 
 void FrameTree::LoadingStateChanged() {
   bool loading = root_.IsLoading();
   if (delegate_)
     delegate_->LoadingStateChanged(loading);
 }
 
 void FrameTree::ProgressChanged() {
@@ skipping 11 matching lines @@
     delegate_->TitleChanged(title);
 }
 
 void FrameTree::ClientPropertyChanged(const Frame* source,
                                       const mojo::String& name,
                                       const mojo::Array<uint8_t>& value) {
   root_.NotifyClientPropertyChanged(source, name, value);
 }
 
 }  // namespace web_view