SendPageMessage() should not send to a WebView guest's embedder.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 2485 matching lines @@
     delete msg;
     return;
   }
 
   auto send_msg = [](IPC::Sender* sender, int routing_id, IPC::Message* msg) {
     IPC::Message* copy = new IPC::Message(*msg);
     copy->set_routing_id(routing_id);
     sender->Send(copy);
   };
 
-  for (const auto& pair : proxy_hosts_)
-    send_msg(pair.second.get(), pair.second->GetRoutingID(), msg);
+  // When sending a PageMessage for an inner WebContents, we don't want to also
+  // send it to the outer WebContent's frames as well.
+  SiteInstance* outer_delegate_site_instance =
+      ForInnerDelegate()
+          ? GetOuterDelegateNode()->current_frame_host()->GetSiteInstance()

[lfg, 2016/05/05 17:27:11]

I think we probably want to look at the SiteInstance of the parent of the outer
delegate node, since the RFH in the outer delegate node isn't used.

[wjmaclean, 2016/05/05 17:39:07]

Done.

We're sure that parent() is always non-null, right?

[wjmaclean, 2016/05/05 18:53:49]

Just curious: as a casual reader of this code, did I miss some indication about
the OuterDelegate's RFH not being used? Is it worth commenting?

I do now notice other cases where parent() is used now that you mention it,
though it's not obvious why.

Also, I just discovered GetProxyToOuterDelegate() ... should we be using that
here instead of SiteInstances, in a manner similar to
RFHM::CreateProxiesForChildFrame() ?

[lfg, 2016/05/05 19:00:59]

+lazyboy

The RFH is owned by the RFHM, which comes with every FTN. When we create an
inner WebContents, we swap the RenderFrame in the outer WebContents renderer
with a RenderFrameProxy, and that RFPH lives in the inner WebContents FTN. Since
we still want to keep the FTN in the outer WebContents tree (as a connection
point between the two trees), we end up with a RFH that does not have a live RF.

+          : nullptr;
+  for (const auto& pair : proxy_hosts_) {
+    if (outer_delegate_site_instance != pair.second->GetSiteInstance())
+      send_msg(pair.second.get(), pair.second->GetRoutingID(), msg);
+  }
 
   if (speculative_render_frame_host_) {
     send_msg(speculative_render_frame_host_.get(),
              speculative_render_frame_host_->GetRoutingID(), msg);
   } else if (pending_render_frame_host_) {
     send_msg(pending_render_frame_host_.get(),
              pending_render_frame_host_->GetRoutingID(), msg);
   }
 
   msg->set_routing_id(render_frame_host_->GetRoutingID());
@@ skipping 29 matching lines @@
                                              resolved_url)) {
     DCHECK(!dest_instance ||
            dest_instance == render_frame_host_->GetSiteInstance());
     return false;
   }
 
   return true;
 }
 
 }  // namespace content