[reland] Browser Side Text Input State Tracking for OOPIF (Aura Only)

content/browser/renderer_host/render_widget_host_view_base.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_VIEW_BASE_H_
 #define CONTENT_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_VIEW_BASE_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 48 matching lines @@
 namespace ui {
 class LatencyInfo;
 }
 
 namespace content {
 class BrowserAccessibilityDelegate;
 class BrowserAccessibilityManager;
 class RenderWidgetHostViewBaseObserver;
 class SyntheticGesture;
 class SyntheticGestureTarget;
+class TextInputManager;
 class WebCursor;
 struct DidOverscrollParams;
 struct NativeWebKeyboardEvent;
 struct TextInputState;
 
 // Basic implementation shared by concrete RenderWidgetHostView subclasses.
 class CONTENT_EXPORT RenderWidgetHostViewBase : public RenderWidgetHostView,
                                                 public IPC::Listener {
  public:
   ~RenderWidgetHostViewBase() override;
@@ skipping 40 matching lines @@
   // the renderer.
   void DidReceiveRendererFrame();
 
   // Notification that a resize or move session ended on the native widget.
   void UpdateScreenInfo(gfx::NativeView view);
 
   // Tells if the display property (work area/scale factor) has
   // changed since the last time.
   bool HasDisplayPropertyChanged(gfx::NativeView view);
 
+  // Called by the TextInputManager to notify the view about being removed from
+  // the list of registered views, i.e., TextInputManager is no longer tracking
+  // TextInputState from this view. The RWHV should reset |text_input_manager_|
+  // to nullptr.
+  void DidUnregisterFromTextInputManager(TextInputManager* text_input_manager);
+
   base::WeakPtr<RenderWidgetHostViewBase> GetWeakPtr();
 
   //----------------------------------------------------------------------------
   // The following methods can be overridden by derived classes.
 
   // Notifies the View that the renderer text selection has changed.
   virtual void SelectionChanged(const base::string16& text,
                                 size_t offset,
                                 const gfx::Range& range);
 
@@ skipping 94 matching lines @@
   // embedded within the RenderWidgetHostViewBase's Surface to the
   // coordinate space of the embedding Surface. Typically this means that a
   // point was received from an out-of-process iframe's RenderWidget and needs
   // to be translated to viewport coordinates for the root RWHV, in which case
   // this method is called on the root RWHV with the out-of-process iframe's
   // SurfaceId.
   virtual void TransformPointToLocalCoordSpace(const gfx::Point& point,
                                                cc::SurfaceId original_surface,
                                                gfx::Point* transformed_point);
 
+  // Updates the state of the input method attached to the view.
+  virtual void TextInputStateChanged(const TextInputState& text_input_state);
+
   //----------------------------------------------------------------------------
   // The following static methods are implemented by each platform.
 
   static void GetDefaultScreenInfo(blink::WebScreenInfo* results);
 
   //----------------------------------------------------------------------------
   // The following pure virtual methods are implemented by derived classes.
 
   // Perform all the initialization steps necessary for this object to represent
   // a popup (such as a <select> dropdown), then shows the popup at |pos|.
   virtual void InitAsPopup(RenderWidgetHostView* parent_host_view,
                            const gfx::Rect& bounds) = 0;
 
   // Perform all the initialization steps necessary for this object to represent
   // a full screen window.
   // |reference_host_view| is the view associated with the creating page that
   // helps to position the full screen widget on the correct monitor.
   virtual void InitAsFullscreen(RenderWidgetHostView* reference_host_view) = 0;
 
   // Sets the cursor to the one associated with the specified cursor_type
   virtual void UpdateCursor(const WebCursor& cursor) = 0;
 
   // Indicates whether the page has finished loading.
   virtual void SetIsLoading(bool is_loading) = 0;
 
-  // Updates the state of the input method attached to the view.
-  virtual void TextInputStateChanged(const TextInputState& params) = 0;
-
   // Cancel the ongoing composition of the input method attached to the view.
   virtual void ImeCancelComposition() = 0;
 
   // Notifies the View that the renderer has ceased to exist.
   virtual void RenderProcessGone(base::TerminationStatus status,
                                  int error_code) = 0;
 
   // Tells the View to destroy itself.
   virtual void Destroy() = 0;
 
@@ skipping 97 matching lines @@
   // Exposed for testing.
   virtual bool IsChildFrameForTesting() const;
   virtual cc::SurfaceId SurfaceIdForTesting() const;
 
  protected:
   // Interface class only, do not construct.
   RenderWidgetHostViewBase();
 
   void NotifyObserversAboutShutdown();
 
+  // Returns a reference to the current instance of TextInputManager. The
+  // reference is obtained from RenderWidgetHostDelegate. The first time a
+  // reference is obtained (, which is not nullptr), its value is cached in

[Charlie Reis, 2016/05/26 06:22:04]

nit: Commas go before the open paren.  Also, you can just say "a non-null
reference" to flow more smoothly.

[EhsanK, 2016/05/30 15:06:08]

Acknowledged.

+  // |text_input_manager_|. Then this view is registered with TextInputManager
+  // (,i.e., the instance |text_input_manager_| referes to). The RWHV will

[Charlie Reis, 2016/05/26 06:22:05]

nit: No comma before i.e.

[EhsanK, 2016/05/30 15:06:08]

Done.

+  // unregister from the TextInputManager if it is destroyed or if the
+  // TextInputManager itself is destroyed. The unregistration of the RWHV from
+  // TextInputManager is necessary and must be done by explicitly calling
+  // TextInputManager::Unregister.
+  // It is safer to use this method when required rather than dereferencing

[Charlie Reis, 2016/05/26 06:22:04]

nit: Drop "when required"

[EhsanK, 2016/05/30 15:06:08]

Done.

+  // |text_input_manager_|.
+  TextInputManager* GetTextInputManager();
+
   // Whether this view is a popup and what kind of popup it is (select,
   // autofill...).
   blink::WebPopupType popup_type_;
 
   // The background color of the web content.
   SkColor background_color_;
 
   // While the mouse is locked, the cursor is hidden from the user. Mouse events
   // are still generated. However, the position they report is the last known
   // mouse position just as mouse lock was entered; the movement they report
   // indicates what the change in position of the mouse would be had it not been
   // locked.
   bool mouse_locked_;
 
   // Whether we are showing a context menu.
   bool showing_context_menu_;
 
   // A buffer containing the text inside and around the current selection range.
   base::string16 selection_text_;
 
   // The offset of the text stored in |selection_text_| relative to the start of
   // the web page.
   size_t selection_text_offset_;
 
   // The current selection range relative to the start of the web page.
   gfx::Range selection_range_;
 
- protected:
   // The scale factor of the display the renderer is currently on.
   float current_device_scale_factor_;
 
   // The orientation of the display the renderer is currently on.
   display::Display::Rotation current_display_rotation_;
 
   // Whether pinch-to-zoom should be enabled and pinch events forwarded to the
   // renderer.
   bool pinch_zoom_enabled_;
 
+  // A reference to current TextInputManager instance this RWHV is registered
+  // with. This is initially nullptr until the first time the view calls
+  // GetTextInputManager(). It can also become nullptr if the top-level
+  // RenderWidgetHostDelegate owning the TextInputManager is destroyed.

[Charlie Reis, 2016/05/26 06:22:04]

Isn't that the WebContents?  When does a RenderWidgetHostView outlive the
WebContents?

[EhsanK, 2016/05/30 15:06:08]

As far as I can tell, yes it is.
Not really. It is just we cannot guarantee the order of destruction. When
WebContentsImpl is deleted, we delete the frame tree and frame tree node for the
root. That is when we delete RenderWidgetHostViewAura. In fact, if I do not
reset text_input_manager_ to null when TextInputManager is destroyed, we get a
UaF when closing the window.

Also, for RenderWidgetHostViewChildFrame we use a DeleteSoon which I think could
actually make it go away after WebContents.

All this being said, I modified the comment to mention only TextInputManager not
the delegate.

[Charlie Reis, 2016/06/02 22:03:28]

Acknowledged.

+  TextInputManager* text_input_manager_;
+
  private:
   void FlushInput();
 
   gfx::Rect current_display_area_;
 
   uint32_t renderer_frame_number_;
 
   base::OneShotTimer flush_input_timer_;
 
   base::ObserverList<RenderWidgetHostViewBaseObserver> observers_;
 
   base::WeakPtrFactory<RenderWidgetHostViewBase> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewBase);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_VIEW_BASE_H_