Browser Side Text Input State Tracking for OOPIF.

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <stddef.h>
 
 #include <cmath>
 #include <utility>
@@ skipping 343 matching lines @@
       is_subframe_(false),
       force_disable_overscroll_content_(false),
       last_dialog_suppressed_(false),
       geolocation_service_context_(new GeolocationServiceContext()),
       accessibility_mode_(
           BrowserAccessibilityStateImpl::GetInstance()->accessibility_mode()),
       audio_stream_monitor_(this),
       bluetooth_device_connected_(false),
       virtual_keyboard_requested_(false),
       page_scale_factor_is_one_(true),
+      view_with_active_text_input_(nullptr),
       loading_weak_factory_(this),
       weak_factory_(this) {
   frame_tree_.SetFrameRemoveListener(
       base::Bind(&WebContentsImpl::OnFrameRemoved,
                  base::Unretained(this)));
 #if defined(OS_ANDROID)
   media_web_contents_observer_.reset(new MediaWebContentsObserverAndroid(this));
 #else
   media_web_contents_observer_.reset(new MediaWebContentsObserver(this));
 #endif
@@ skipping 1859 matching lines @@
       static_cast<RenderWidgetHostViewBase*>(GetRenderWidgetHostView());
   if (rwhv) {
     SendPageMessage(new PageMsg_UpdateWindowScreenRect(
         MSG_ROUTING_NONE, rwhv->GetBoundsInRootWindow()));
   }
 
   if (browser_plugin_embedder_)
     browser_plugin_embedder_->DidSendScreenRects();
 }
 
+TextInputState WebContentsImpl::GetTextInputState() {
+  if (GetOuterWebContents())
+    return GetOuterWebContents()->GetTextInputState();
+  return text_input_state_;
+}
+
+void WebContentsImpl::UpdateTextInputState(RenderWidgetHostViewBase* rwhv,
+                                           bool text_input_state_changed) {
+  // If there is an outer WebContents, let it process this update.
+  if (GetOuterWebContents()) {
+    return GetOuterWebContents()->UpdateTextInputState(
+        rwhv, text_input_state_changed);
+  }
+
+  // If this RWHV has a text input type of NONE, then there is nothing to
+  // report to the tab RWHV.
+  if (view_with_active_text_input_ != rwhv &&

[Charlie Reis, 2016/03/30 21:52:47]

Is this comparison the only reason we need view_with_active_text_input_?  I'm
wondering if there's another way to track this without risking a use-after-free.

For example, suppose we kept the RenderWidgetHost's routing ID and process ID
around instead?  That would let us compare rwhv->GetRenderWidgetHost() against
the pair, without keeping an extra pointer to the RenderWidgetHostView.

Sorry that I'm being really conservative on this, but there's just way too much
code that has to be right to avoid a UaF here.  And even if there aren't many
uses of view_with_active_text_input_ now, I don't want future code in
WebContentsImpl to assume that possibly stale pointer is safe to use.

[EhsanK, 2016/03/30 23:36:33]

This makes a lot of sense...thanks! Following our discussion over hangouts, I
will use a WeakPtr given that RenderWidgetHostViewBase already supports that.

+      rwhv->text_input_state()->type == ui::TEXT_INPUT_TYPE_NONE)
+    return;
+
+  view_with_active_text_input_ =
+      (rwhv->text_input_state()->type != ui::TEXT_INPUT_TYPE_NONE) ? rwhv
+                                                                   : nullptr;
+  text_input_state_ = *rwhv->text_input_state();
+
+  // The top level RWHV should know about the change.
+  RenderWidgetHostViewBase* tab_rwhv =
+      static_cast<RenderWidgetHostViewBase*>(GetRenderWidgetHostView());
+  if (tab_rwhv)
+    tab_rwhv->UpdateInputMethodIfNecessary(text_input_state_changed);
+}
+
 BrowserAccessibilityManager*
     WebContentsImpl::GetRootBrowserAccessibilityManager() {
   RenderFrameHostImpl* rfh = GetMainFrame();
   return rfh ? rfh->browser_accessibility_manager() : nullptr;
 }
 
 BrowserAccessibilityManager*
     WebContentsImpl::GetOrCreateRootBrowserAccessibilityManager() {
   RenderFrameHostImpl* rfh = GetMainFrame();
   return rfh ? rfh->GetOrCreateBrowserAccessibilityManager() : nullptr;
@@ skipping 2583 matching lines @@
   else
     WasHidden();
 }
 
 void WebContentsImpl::SetJavaScriptDialogManagerForTesting(
     JavaScriptDialogManager* dialog_manager) {
   dialog_manager_ = dialog_manager;
 }
 
 }  // namespace content