Adds better security checking to OnCreatedFrame()

components/web_view/frame.h

Index: components/web_view/frame.h
diff --git a/components/web_view/frame.h b/components/web_view/frame.h
index 660e94f6d9b97c3f07f6a4bf0238702e618d0c83..213216bebcb7056dc75d9ed9922e34dbc4cd20d6 100644
--- a/components/web_view/frame.h
+++ b/components/web_view/frame.h
@@ -10,6 +10,7 @@
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
+#include "components/view_manager/public/cpp/types.h"
 #include "components/view_manager/public/cpp/view_observer.h"
 #include "components/web_view/public/interfaces/frame_tree.mojom.h"
 #include "third_party/mojo/src/mojo/public/cpp/bindings/binding.h"
@@ -61,7 +62,7 @@ class Frame : public mojo::ViewObserver, public FrameTreeServer {
         const ClientPropertyMap& client_properties);
   ~Frame() override;
 
-  void Init(Frame* parent);
+  void Init(Frame* parent, mojo::ViewTreeClientPtr view_tree_client);
 
   // Walks the View tree starting at |view| going up returning the first
   // Frame that is associated with |view|. For example, if |view|
@@ -124,7 +125,8 @@ class Frame : public mojo::ViewObserver, public FrameTreeServer {
   // connection lost (and assume the frame is being torn down) before the
   // OnConnect().
   void InitClient(ClientType client_type,
-                  scoped_ptr<FrameTreeServerBinding> frame_tree_server_binding);
+                  scoped_ptr<FrameTreeServerBinding> frame_tree_server_binding,
+                  mojo::ViewTreeClientPtr view_tree_client);
 
   // Callback from OnConnect(). This does nothing (other than destroying
   // |frame_tree_server_binding|). See InitClient() for details as to why
@@ -132,6 +134,9 @@ class Frame : public mojo::ViewObserver, public FrameTreeServer {
   static void OnConnectAck(
       scoped_ptr<FrameTreeServerBinding> frame_tree_server_binding);
 
+  // Callback from OnEmbed().
+  void OnEmbedAck(bool success, mojo::ConnectionSpecificId connection_id);
+
   // Completes a navigation request; swapping the existing FrameTreeClient to
   // the supplied arguments.
   void ChangeClient(FrameTreeClient* frame_tree_client,
@@ -212,6 +217,9 @@ class Frame : public mojo::ViewObserver, public FrameTreeServer {
   FrameTree* const tree_;
   // WARNING: this may be null. See class description for details.
   mojo::View* view_;
+  // The connection id returned from ViewManager::Embed(). Frames created by
+  // way of OnCreatedFrame() inherit the id from the parent.
+  mojo::ConnectionSpecificId embedded_connection_id_;
   // ID for the frame, which is the same as that of the view.
   const uint32_t id_;
   // ID of the app providing the FrameTreeClient and ViewTreeClient.
@@ -235,7 +243,7 @@ class Frame : public mojo::ViewObserver, public FrameTreeServer {
 
   scoped_ptr<mojo::Binding<FrameTreeServer>> frame_tree_server_binding_;
 
-  base::WeakPtrFactory<Frame> weak_factory_;
+  base::WeakPtrFactory<Frame> embed_weak_ptr_factory_;
 
   base::WeakPtrFactory<Frame> navigate_weak_ptr_factory_;