SendPageMessage() should not send to a WebView guest's embedder.

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 58c17d54c34798e0e070878e4e572a594f41a3a3..53960255214d64aad57311978a24e018325ff317 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -2503,8 +2503,16 @@ void RenderFrameHostManager::SendPageMessage(IPC::Message* msg) {
     sender->Send(copy);
   };
 
-  for (const auto& pair : proxy_hosts_)
-    send_msg(pair.second.get(), pair.second->GetRoutingID(), msg);
+  // When sending a PageMessage for an inner WebContents, we don't want to also
+  // send it to the outer WebContent's frames as well.
+  SiteInstance* outer_delegate_site_instance =
+      ForInnerDelegate()
+          ? GetOuterDelegateNode()->current_frame_host()->GetSiteInstance()

[lfg, 2016/05/05 17:27:11]

I think we probably want to look at the SiteInstance of the parent of the outer
delegate node, since the RFH in the outer delegate node isn't used.

[wjmaclean, 2016/05/05 17:39:07]

Done.

We're sure that parent() is always non-null, right?

[wjmaclean, 2016/05/05 18:53:49]

Just curious: as a casual reader of this code, did I miss some indication about
the OuterDelegate's RFH not being used? Is it worth commenting?

I do now notice other cases where parent() is used now that you mention it,
though it's not obvious why.

Also, I just discovered GetProxyToOuterDelegate() ... should we be using that
here instead of SiteInstances, in a manner similar to
RFHM::CreateProxiesForChildFrame() ?

[lfg, 2016/05/05 19:00:59]

+lazyboy

The RFH is owned by the RFHM, which comes with every FTN. When we create an
inner WebContents, we swap the RenderFrame in the outer WebContents renderer
with a RenderFrameProxy, and that RFPH lives in the inner WebContents FTN. Since
we still want to keep the FTN in the outer WebContents tree (as a connection
point between the two trees), we end up with a RFH that does not have a live RF.

+          : nullptr;
+  for (const auto& pair : proxy_hosts_) {
+    if (outer_delegate_site_instance != pair.second->GetSiteInstance())
+      send_msg(pair.second.get(), pair.second->GetRoutingID(), msg);
+  }
 
   if (speculative_render_frame_host_) {
     send_msg(speculative_render_frame_host_.get(),