Generate MouseEnter/MouseLeave events between processes.

content/browser/renderer_host/render_widget_host_input_event_router.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 
+#include <vector>
+
 #include "base/metrics/histogram_macros.h"
+
 #include "cc/quads/surface_draw_quad.h"
 #include "cc/surfaces/surface_id_allocator.h"
 #include "cc/surfaces/surface_manager.h"
+#include "content/browser/frame_host/render_widget_host_view_child_frame.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/common/frame_messages.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 
 namespace {
 
 void TransformEventTouchPositions(blink::WebTouchEvent* event,
                                   const gfx::Vector2d& delta) {
   for (unsigned i = 0; i < event->touchesLength; ++i) {
@@ skipping 36 matching lines @@
     touchscreen_gesture_target_.target = nullptr;
 
   if (view == touchpad_gesture_target_.target)
     touchpad_gesture_target_.target = nullptr;
 
   if (view == bubbling_gesture_scroll_target_.target ||
       view == first_bubbling_scroll_target_.target) {
     bubbling_gesture_scroll_target_.target = nullptr;
     first_bubbling_scroll_target_.target = nullptr;
   }
+
+  if (view == last_mouse_move_target_) {
+    last_mouse_move_target_ = nullptr;
+    last_mouse_move_root_view_ = nullptr;
+  }

[Navid Zolghadr, 2016/09/09 14:27:41]

When do we call this destructor? Is it when the iframe is destructed? If so if I
have my mouse inside an inner iframe and the outer frame destroys the inner
iframe we reset the position of the mouse totally as if it is outside everything
instead of moving it to its parent. Right?

[kenrb, 2016/09/12 17:44:46]

Yes.

This is called when a RenderWidgetHostView is destroyed, which corresponds to
the iframe content going away (possibly because of a process crash). I've added
a change to try to change last_mouse_move_target_ to its parent when it is
destroyed, this isn't guaranteed to work in all cases (e.g. if the current
target is nested within another OOPIF, and the parent OOPIF process crashes).

 }
 
 void RenderWidgetHostInputEventRouter::ClearAllObserverRegistrations() {
   for (auto entry : owner_map_)
     entry.second->RemoveObserver(this);
   owner_map_.clear();
 }
 
 RenderWidgetHostInputEventRouter::HittestDelegate::HittestDelegate(
     const std::unordered_map<cc::SurfaceId, HittestData, cc::SurfaceIdHash>&
@@ skipping 12 matching lines @@
 bool RenderWidgetHostInputEventRouter::HittestDelegate::AcceptHitTarget(
     const cc::SurfaceDrawQuad* surface_quad,
     const gfx::Point& point_in_quad_space) {
   auto it = hittest_data_.find(surface_quad->surface_id);
   if (it != hittest_data_.end() && !it->second.ignored_for_hittest)
     return true;
   return false;
 }
 
 RenderWidgetHostInputEventRouter::RenderWidgetHostInputEventRouter()
-    : active_touches_(0),
+    : last_mouse_move_target_(nullptr),
+      last_mouse_move_root_view_(nullptr),
+      active_touches_(0),
       in_touchscreen_gesture_pinch_(false),
       gesture_pinch_did_send_scroll_begin_(false) {}
 
 RenderWidgetHostInputEventRouter::~RenderWidgetHostInputEventRouter() {
   // We may be destroyed before some of the owners in the map, so we must
   // remove ourself from their observer lists.
   ClearAllObserverRegistrations();
 }
 
 RenderWidgetHostViewBase* RenderWidgetHostInputEventRouter::FindEventTarget(
@@ skipping 30 matching lines @@
 
 void RenderWidgetHostInputEventRouter::RouteMouseEvent(
     RenderWidgetHostViewBase* root_view,
     blink::WebMouseEvent* event) {
   gfx::Point transformed_point;
   RenderWidgetHostViewBase* target = FindEventTarget(
       root_view, gfx::Point(event->x, event->y), &transformed_point);
   if (!target)
     return;
 
+  // SendMouseEnterOrLeaveEvents is called with the original event
+  // coordinates, which are transformed independently for each view that will
+  // receive an event.
+  if ((event->type == blink::WebInputEvent::MouseLeave ||
+       event->type == blink::WebInputEvent::MouseMove) &&
+      target != last_mouse_move_target_)
+    SendMouseEnterOrLeaveEvents(event, target, root_view);
+
   event->x = transformed_point.x();
   event->y = transformed_point.y();
   // TODO(wjmaclean): Initialize latency info correctly for OOPIFs.
   // https://crbug.com/613628
   ui::LatencyInfo latency_info;
   target->ProcessMouseEvent(*event, latency_info);
 }
 
 void RenderWidgetHostInputEventRouter::RouteMouseWheelEvent(
     RenderWidgetHostViewBase* root_view,
@@ skipping 119 matching lines @@
       TransformEventTouchPositions(event, touch_target_.delta);
       touch_target_.target->ProcessTouchEvent(*event, latency);
       if (!active_touches_)
         touch_target_.target = nullptr;
       break;
     default:
       NOTREACHED();
   }
 }
 
+void RenderWidgetHostInputEventRouter::SendMouseEnterOrLeaveEvents(
+    blink::WebMouseEvent* event,
+    RenderWidgetHostViewBase* target,
+    RenderWidgetHostViewBase* root_view) {
+  // This method treats RenderWidgetHostViews as a tree, where the mouse
+  // cursor is potentially leaving one node and entering another somewhere
+  // else in the tree. Since iframes are graphically self-contained (i.e. an
+  // iframe can't have a descendant that renders outside of its rect
+  // boundaries), all affected RenderWidgetHostViews are ancestors of either
+  // the node being exited or the node being entered.
+  // Approach:
+  // 1. Find lowest common ancestor (LCA) of the last view and current target
+  //    view.
+  // 2. The last view, and its ancestors up to but not including the LCA,
+  //    receive a MouseLeave.
+  // 3. The LCA itself, unless it is the new target, receives a MouseOut
+  //    because the cursor has passed between elements within its bounds.
+  // 4. The new target view's ancestors, up to but not including the LCA,
+  //    receive a MouseEnter.
+  // Ordering does not matter since these are handled asynchronously relative
+  // to each other.
+
+  // If the mouse has moved onto a different root view (typically meaning it
+  // has crossed over a popup or context menu boundary), then we invalidate
+  // last_mouse_move_target_ because we have no reference for its coordinate
+  // space.
+  if (root_view != last_mouse_move_root_view_)
+    last_mouse_move_target_ = nullptr;
+
+  // Finding the LCA uses a standard approach. We build vectors of the
+  // ancestors of each node up to the root, and then remove common ancestors.
+  std::vector<RenderWidgetHostViewBase*> entered_views;
+  std::vector<RenderWidgetHostViewBase*> exited_views;
+  RenderWidgetHostViewBase* cur_view = target;
+  entered_views.push_back(cur_view);
+  while (cur_view != root_view) {
+    // Non-root RWHVs are guaranteed to be RenderWidgetHostViewChildFrames.
+    cur_view =
+        static_cast<RenderWidgetHostViewChildFrame*>(cur_view)->GetParentView();
+    // cur_view can possibly be nullptr for guestviews that are not currently
+    // connected to the webcontents tree.
+    if (!cur_view)
+      break;
+    entered_views.push_back(cur_view);
+  }
+
+  cur_view = last_mouse_move_target_;
+  if (cur_view) {
+    exited_views.push_back(cur_view);
+    while (cur_view != root_view) {
+      cur_view = static_cast<RenderWidgetHostViewChildFrame*>(cur_view)
+                     ->GetParentView();
+      if (!cur_view)
+        break;
+      exited_views.push_back(cur_view);
+    }
+  }
+
+  // This removes common ancestors from the root downward.
+  RenderWidgetHostViewBase* common_ancestor = nullptr;
+  while (entered_views.size() > 0 &&
+         exited_views.size() > 0 &&
+         entered_views.back() == exited_views.back()) {
+    common_ancestor = entered_views.back();
+    entered_views.pop_back();
+    exited_views.pop_back();
+  }
+
+  gfx::Point transformed_point;
+  // Send MouseLeaves.
+  for (auto view : exited_views) {
+    blink::WebMouseEvent mouse_leave(*event);
+    mouse_leave.type = blink::WebInputEvent::MouseLeave;
+    transformed_point = root_view->TransformPointToCoordSpaceForView(
+        gfx::Point(event->x, event->y), view);
+    mouse_leave.x = transformed_point.x();
+    mouse_leave.y = transformed_point.y();
+    view->ProcessMouseEvent(mouse_leave, ui::LatencyInfo());
+  }
+
+  // TODO(kenrb): The ancestor might need to trigger MouseOut handlers.
+  // Unfortunately there isn't a way to get Blink to do this, so we send a
+  // MouseLeave for now. See bug https://crbug.com/638364.
+  if (common_ancestor && common_ancestor != target) {
+    blink::WebMouseEvent mouse_out(*event);
+    mouse_out.type = blink::WebInputEvent::MouseLeave;
+    transformed_point = root_view->TransformPointToCoordSpaceForView(

[Navid Zolghadr, 2016/09/09 14:27:41]

From the perspective of the common ancestor mouse has moved from one part of it
to another. Would sending a mousemove work the same as the case below?

[kenrb, 2016/09/12 17:44:46]

Changed.

+        gfx::Point(event->x, event->y), common_ancestor);
+    mouse_out.x = transformed_point.x();
+    mouse_out.y = transformed_point.y();
+    common_ancestor->ProcessMouseEvent(mouse_out, ui::LatencyInfo());
+  }
+
+  // Send MouseEnters.
+  for (auto view : entered_views) {
+    if (view == target)
+      continue;
+    blink::WebMouseEvent mouse_enter(*event);
+    // TODO(kenrb): Blink doesn't expect a MouseEnter to come from the browser
+    // process, so we send a MouseMove, which can cause event handlers to fire
+    // incorrectly. See bug https://crbug.com/638364.

[Navid Zolghadr, 2016/09/09 14:27:41]

I did a few tests myself. I believe sending a mousemove seems correct. Because
Blink later does another hit-test and realized the mousemove is inside an iframe
and sends that event to that iframe. If that reference to that iframe somehow
knows it is not an in process iframe and blink cannot talk to that directly it
can just ignores that forwarding as the higher layer here already did that
forwarding for it.

[kenrb, 2016/09/12 17:44:46]

Okay, this seems reasonable and I have changed the comment accordingly.

+    mouse_enter.type = blink::WebInputEvent::MouseMove;
+    transformed_point = root_view->TransformPointToCoordSpaceForView(
+        gfx::Point(event->x, event->y), view);
+    mouse_enter.x = transformed_point.x();
+    mouse_enter.y = transformed_point.y();
+    view->ProcessMouseEvent(mouse_enter, ui::LatencyInfo());
+  }
+
+  last_mouse_move_target_ = target;
+  last_mouse_move_root_view_ = root_view;
+}
+
 void RenderWidgetHostInputEventRouter::BubbleScrollEvent(
     RenderWidgetHostViewBase* target_view,
     const blink::WebGestureEvent& event) {
   // TODO(kenrb, tdresser): This needs to be refactored when scroll latching
   // is implemented (see https://crbug.com/526463). This design has some
   // race problems that can result in lost scroll delta, which are very
   // difficult to resolve until this is changed to do all scroll targeting,
   // including bubbling, based on GestureScrollBegin.
   DCHECK(target_view);
   DCHECK(event.type == blink::WebInputEvent::GestureScrollUpdate ||
@@ skipping 244 matching lines @@
   if (!touchpad_gesture_target_.target)
     return;
 
   // TODO(mohsen): Add tests to check event location.
   event->x += touchpad_gesture_target_.delta.x();
   event->y += touchpad_gesture_target_.delta.y();
   touchpad_gesture_target_.target->ProcessGestureEvent(*event, latency);
 }
 
 }  // namespace content