Fix find-in-page re-scope across frame boundaries.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 5208 matching lines @@
   }
 
   // Send "no results" if this frame has no visible content.
   if (!frame_->hasVisibleContent()) {
     SendFindReply(request_id, 0 /* match_count */, 0 /* ordinal */,
                   gfx::Rect(), true /* final_status_update */ );
     return;
   }
 
   WebRect selection_rect;
-  bool active_now = false;
 
   // If something is selected when we start searching it means we cannot just
   // increment the current match ordinal; we need to re-generate it.
   WebRange current_selection = frame_->selectionRange();
 
   bool result = frame_->find(request_id, search_text, options,
-                             false /* wrapWithinFrame */, &selection_rect,
-                             &active_now);
+                             false /* wrapWithinFrame */, &selection_rect);
   if (result && !options.findNext) {
     // Indicate that at least one match has been found. 1 here means possibly
     // more matches could be coming. -1 here means that the exact active match
     // ordinal is not yet known.
     SendFindReply(request_id, 1 /* match_count */, -1 /* ordinal */,
                   gfx::Rect(), false /* final_status_update */ );
   }
 
-  if (options.findNext && current_selection.isNull() && active_now) {
+  if (options.findNext && current_selection.isNull() &&
+      !frame_->scopingInProgress()) {

[dcheng, 2016/07/28 02:11:45]

Is this an urgent fix? I think we should explore moving these bits back into
Blink rather than exposing more functions in the public API. WDYT?

     // Force report of the actual count.
     frame_->increaseMatchCount(0, request_id);
     return;
   }
 
   // Scoping effort begins.
   frame_->resetMatchCount();
 
   // Cancel all old scoping requests before starting a new one.
   frame_->cancelPendingScopingEffort();
@@ skipping 1109 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content