Fix rendering of flash content inside an out-of-process iframe.

content/renderer/pepper/pepper_plugin_instance_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bit_cast.h"
@@ skipping 518 matching lines @@
       is_deleted_(false),
       initialized_(false),
       view_change_weak_ptr_factory_(this),
       weak_factory_(this) {
   pp_instance_ = HostGlobals::Get()->AddInstance(this);
 
   memset(&current_print_settings_, 0, sizeof(current_print_settings_));
   module_->InstanceCreated(this);
 
   if (render_frame) {  // NULL in tests
-    render_frame->render_view()->PepperInstanceCreated(this);
-    // Bind a callback now so that we can inform the RenderViewImpl when we are
-    // destroyed. This works around a temporary problem stemming from work to
-    // move parts of RenderViewImpl in to RenderFrameImpl (see
-    // crbug.com/245126). If destruction happens in this order:
-    //  1) RenderFrameImpl
-    //  2) PepperPluginInstanceImpl
-    //  3) RenderViewImpl
-    // Then after 1), the PepperPluginInstanceImpl doesn't have any way to talk
-    // to the RenderViewImpl. But when the instance is destroyed, it still
-    // needs to inform the RenderViewImpl that it has gone away, otherwise
-    // between (2) and (3), the RenderViewImpl will still have the dead
-    // instance in its active set, and so might make calls on the deleted
-    // instance. See crbug.com/343576 for more information. Once the plugin
-    // calls move entirely from RenderViewImpl in to RenderFrameImpl, this
-    // can be a little bit simplified by instead making a direct call on
-    // RenderFrameImpl in the destructor (but only if render_frame_ is valid).
-    instance_deleted_callback_ =
-        base::Bind(&RenderViewImpl::PepperInstanceDeleted,
-                   render_frame->render_view()->AsWeakPtr(),
-                   base::Unretained(this));
+    render_frame->PepperInstanceCreated(this);
     view_data_.is_page_visible = !render_frame_->GetRenderWidget()->is_hidden();
 
     // Set the initial focus.
-    SetContentAreaFocus(render_frame_->render_view()->has_focus());
+    SetContentAreaFocus(render_frame_->GetRenderWidget()->has_focus());
 
     if (!module_->IsProxied()) {
       PepperBrowserConnection* browser_connection =
           PepperBrowserConnection::Get(render_frame_);
       browser_connection->DidCreateInProcessInstance(
           pp_instance(),
           render_frame_->GetRoutingID(),
           document_url_,
           GetPluginURL());
     }
@@ skipping 23 matching lines @@
     (*i)->InstanceDeleted();
   }
 
   if (message_channel_)
     message_channel_->InstanceDeleted();
   message_channel_object_.Reset();
 
   if (TrackedCallback::IsPending(lock_mouse_callback_))
     lock_mouse_callback_->Abort();
 
-  if (!instance_deleted_callback_.is_null())
-    instance_deleted_callback_.Run();
+  if (render_frame_)
+    render_frame_->PepperInstanceDeleted(this);
 
   if (!module_->IsProxied() && render_frame_) {
     PepperBrowserConnection* browser_connection =
         PepperBrowserConnection::Get(render_frame_);
     browser_connection->DidDeleteInProcessInstance(pp_instance());
   }
 
   UnSetAndDeleteLockTargetAdapter();
   module_->InstanceDeleted(this);
   // If we switched from the NaCl plugin module, notify it too.
@@ skipping 1008 matching lines @@
                   top_left.y() / graphics_2d_size_in_dip.height()),
       gfx::PointF(lower_right.x() / graphics_2d_size_in_dip.width(),
                   lower_right.y() / graphics_2d_size_in_dip.height()));
 }
 
 bool PepperPluginInstanceImpl::PluginHasFocus() const {
   return flash_fullscreen_ || (has_webkit_focus_ && has_content_area_focus_);
 }
 
 void PepperPluginInstanceImpl::SendFocusChangeNotification() {
-  // Keep a reference on the stack. RenderViewImpl::PepperFocusChanged may
+  // Keep a reference on the stack. RenderFrameImpl::PepperFocusChanged may
   // remove the <embed> from the DOM, which will make the PepperWebPluginImpl
   // drop its reference, usually the last one. This is similar to possible
   // plugin behavior described at the NOTE above Delete().
   scoped_refptr<PepperPluginInstanceImpl> ref(this);
 
   if (!render_frame_)
     return;
 
   bool has_focus = PluginHasFocus();
-  render_frame_->render_view()->PepperFocusChanged(this, has_focus);
+  render_frame_->PepperFocusChanged(this, has_focus);
 
   // instance_interface_ may have been cleared in Delete() if the
   // PepperWebPluginImpl is destroyed.
   if (instance_interface_)
     instance_interface_->DidChangeFocus(pp_instance(), PP_FromBool(has_focus));
 }
 
 void PepperPluginInstanceImpl::UpdateTouchEventRequest() {
   bool raw_touch = (filtered_input_event_mask_ & PP_INPUTEVENT_CLASS_TOUCH) ||
                    (input_event_mask_ & PP_INPUTEVENT_CLASS_TOUCH);
@@ skipping 1761 matching lines @@
     const cc::TextureMailbox& mailbox) const {
   auto it =
       std::find_if(texture_ref_counts_.begin(), texture_ref_counts_.end(),
                    [&mailbox](const TextureMailboxRefCount& ref_count) {
                      return ref_count.first.mailbox() == mailbox.mailbox();
                    });
   return it != texture_ref_counts_.end();
 }
 
 }  // namespace content