InstantExtended: disallow setValue() without omnibox focus.

chrome/browser/ui/search/instant_controller.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/search/instant_controller.h"
 
 #include <iterator>
 
 #include "base/metrics/histogram.h"
 #include "base/string_util.h"
@@ skipping 1279 matching lines @@
   // TODO(samarth): allow InstantTabs to call SetSuggestions() from the NTP once
   // that is better supported.
   bool can_use_instant_tab = UseTabForSuggestions() &&
       search_mode_.is_search();
   bool can_use_overlay = search_mode_.is_search_suggestions() &&
       !last_omnibox_text_.empty();
   if (!can_use_instant_tab && !can_use_overlay)
     return;
 
   if (suggestion.behavior == INSTANT_COMPLETE_REPLACE) {
+    if (omnibox_focus_state_ == OMNIBOX_FOCUS_NONE &&
+        !(last_suggestion_.behavior == INSTANT_COMPLETE_NEVER &&
+          !last_omnibox_text_has_inline_autocompletion_ &&
+          suggestion.text == last_omnibox_text_ + last_suggestion_.text)) {

[sreeram, 2013/05/28 22:45:02]

Does this work in the following case?
1. In Tab A, type something that gives you gray text.
2. Switch to another tab, do a bunch of queries or whatever.
3. Switch back to Tab A, click on the suggestion that matches the gray text.

[samarth, 2013/05/29 19:03:46]

I took out this check since we don't need to deal with gray text in M28 / M29. 
Now we just throw out setValue if the omnibox doesn't have focus.

+      // TODO(samarth,skanuj): setValue() needs to be handled differently when
+      // the omnibox doesn't have focus. Instead of setting temporary text, we
+      // should be setting search terms on the appopriate NavigationEntry.
+      // (Among other things, this ensures that URL-shaped values will get the
+      // additional security token.)
+      //
+      // However, today, we need to allow setValue() to happen in one particular
+      // case which is when a user clicks on the suggestion correponding to a
+      // gray-text completion. Otherwise, we can't distinguish between the user
+      // clicking on white space (where we don't accept the gray text) and the
+      // user clicking on the suggestion (when we do accept the gray text).
+      return;
+    }
+
     // We don't get an Update() when changing the omnibox due to a REPLACE
     // suggestion (so that we don't inadvertently cause the overlay to change
     // what it's showing, as the user arrows up/down through the page-provided
     // suggestions). So, update these state variables here.
     last_omnibox_text_ = suggestion.text;
     last_user_text_.clear();
     last_suggestion_ = InstantSuggestion();
     last_match_was_search_ = suggestion.type == INSTANT_SUGGESTION_SEARCH;
     LOG_INSTANT_DEBUG_EVENT(this, base::StringPrintf(
         "ReplaceSuggestion text='%s' type=%d",
@@ skipping 65 matching lines @@
 
   // Do not add a default case in the switch block for the following reasons:
   // (1) Explicitly handle the new states. If new states are added in the
   // OmniboxFocusState, the compiler will warn the developer to handle the new
   // states.
   // (2) An attacker may control the renderer and sends the browser process a
   // malformed IPC. This function responds to the invalid |state| values by
   // doing nothing instead of crashing the browser process (intentional no-op).
   switch (state) {
     case OMNIBOX_FOCUS_VISIBLE:
-      browser_->FocusOmnibox(true);
+      // TODO(samarth): re-enable this once setValue() correctly handles
+      // URL-shaped queries.
+      // browser_->FocusOmnibox(true);
       break;
     case OMNIBOX_FOCUS_INVISIBLE:
       browser_->FocusOmnibox(false);
       break;
     case OMNIBOX_FOCUS_NONE:
       if (omnibox_focus_state_ != OMNIBOX_FOCUS_INVISIBLE)
         contents->GetView()->Focus();
       break;
   }
 }
@@ skipping 435 matching lines @@
 
   result->transition = match.transition;
   result->relevance = match.relevance;
   result->autocomplete_match_index = autocomplete_match_index;
 
   DVLOG(1) << "    " << result->relevance << " " << result->type << " "
       << result->provider << " " << result->destination_url << " '"
       << result->description << "' '" << result->search_query << "' "
       << result->transition <<  " " << result->autocomplete_match_index;
 }