Reset Text Input State for RenderWidgetHostView before RenderWidgetHost Detaches from Delegate

content/browser/browser_plugin/browser_plugin_guest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 
@@ skipping 18 matching lines @@
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/web_contents/web_contents_view_guest.h"
 #include "content/common/browser_plugin/browser_plugin_constants.h"
 #include "content/common/browser_plugin/browser_plugin_messages.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/drag_messages.h"
 #include "content/common/host_shared_bitmap_manager.h"
 #include "content/common/input_messages.h"
 #include "content/common/site_isolation_policy.h"
+#include "content/common/text_input_state.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_plugin_guest_manager.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/guest_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/browser_plugin_guest_mode.h"
 #include "content/public/common/drop_data.h"
@@ skipping 720 matching lines @@
   rwhv->RegisterSurfaceNamespaceId();
   has_render_view_ = true;
 
   RecordAction(base::UserMetricsAction("BrowserPlugin.Guest.Attached"));
 }
 
 void BrowserPluginGuest::OnDetach(int browser_plugin_instance_id) {
   if (!attached())
     return;
 
+  // The BrowserPluginGuest loses the link to |owner_web_contents_|. Therefore,
+  // the RenderWidgetHostViewGuest will not get a chance to update its text
+  // input state which is tracked by |owner_web_contents_| (crbug.com/602144).

[EhsanK, 2016/04/11 21:59:18]

Beyond this point, |attached_ = false| and hence,
|BrowserPluginGuest::owner_web_contents()| return null which breaks the link to
the outer WebContents from the inner WebContents. Therefore, this seems to be
the only place we can call this cleanup.

[Charlie Reis, 2016/04/11 22:18:16]

Ok, I'll defer to lazyboy@ here.

+  OnTextInputStateChanged(TextInputState());

[Charlie Reis, 2016/04/11 20:24:52]

This wasn't in patch set 1.  Is it also needed to fix the bug?

[EhsanK, 2016/04/11 21:59:17]

Yes. I have added some comments to crbug.com/602144 regarding this. This is
another case where the destruction of WebContentsImpl does not allow the
RenderWidgetHostView(Guest) to reset the state.

[Charlie Reis, 2016/04/11 22:18:16]

Acknowledged.

+
   // This tells BrowserPluginGuest to queue up all IPCs to BrowserPlugin until
   // it's attached again.
   attached_ = false;
 
   RenderWidgetHostViewChildFrame* rwhv =
       static_cast<RenderWidgetHostViewChildFrame*>(
           web_contents()->GetRenderWidgetHostView());
   // If the guest is terminated, our host may already be gone.
   if (rwhv)
     rwhv->UnregisterSurfaceNamespaceId();
@@ skipping 213 matching lines @@
           range, character_bounds);
 }
 #endif
 
 void BrowserPluginGuest::SetContextMenuPosition(const gfx::Point& position) {
   if (delegate_)
     delegate_->SetContextMenuPosition(position);
 }
 
 }  // namespace content