Fixing iframe jank in the local omnibox popup.

chrome/browser/search/suggestion_source.h

+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SEARCH_SUGGESTION_SOURCE_H_
+#define CHROME_BROWSER_SEARCH_SUGGESTION_SOURCE_H_
+
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "base/gtest_prod_util.h"
+#include "content/public/browser/url_data_source.h"
+
+// Serves HTML for displaying suggestions using iframes, e.g.
+// chrome-search://suggestion/loader.html
+class SuggestionSource : public content::URLDataSource {
+ public:
+  SuggestionSource();
+
+  virtual ~SuggestionSource();
+
+ private:
+  friend class SuggestionSourceTest;
+  FRIEND_TEST_ALL_PREFIXES(SuggestionSourceTest, ShouldServiceRequest);
+  FRIEND_TEST_ALL_PREFIXES(SuggestionSourceTest, GetMimeType);
+  FRIEND_TEST_ALL_PREFIXES(SuggestionSourceTest, StartDataRequest);
+
+  // Overridden from content::URLDataSource:
+  virtual std::string GetSource() OVERRIDE;
+  virtual void StartDataRequest(
+      const std::string& path_and_query,
+      bool is_incognito,
+      const content::URLDataSource::GotDataCallback& callback) OVERRIDE;
+  virtual std::string GetMimeType(
+      const std::string& path_and_query) const OVERRIDE;
+  virtual bool ShouldDenyXFrameOptions() const OVERRIDE;
+  virtual bool ShouldServiceRequest(
+      const net::URLRequest* request) const OVERRIDE;
+
+  // Sends unmodified resource bytes.
+  void SendResource(
+      int resource_id,
+      const content::URLDataSource::GotDataCallback& callback);
+
+  // Sends Javascript with an &origin parameter interpolated.

[palmer, 2013/04/09 00:26:15]

I'm sorry, I still don't understand why this is safe and won't break anything.

[Jered, 2013/04/09 01:18:58]

Can you be more specific here? Why is it potentially unsafe and what might it
break?

For example, I'm pretty sure the code to interpolate the value of origin into
the Javascript is correct, and that the code in
chrome/renderer/content_render_client.cc which inserts it is correct.

I'm _not_ sure it's ok to assume that the webframe's top url is actually legit,
but that's the origin that a postMessage from the top frame in that renderer is
going to have.

+  void SendJSWithOrigin(
+      int resource_id,
+      const std::string& path_and_query,
+      const content::URLDataSource::GotDataCallback& callback);
+
+  DISALLOW_COPY_AND_ASSIGN(SuggestionSource);
+};
+
+#endif  // CHROME_BROWSER_SEARCH_SUGGESTION_SOURCE_H_