Fix TextInputClientMac related crashes of Fullscreen RenderWidget

content/browser/renderer_host/text_input_client_mac.mm

Index: content/browser/renderer_host/text_input_client_mac.mm
diff --git a/content/browser/renderer_host/text_input_client_mac.mm b/content/browser/renderer_host/text_input_client_mac.mm
index 74f3dc2d74209d5d65a92b80757ea6086d73d724..a1e73654fd4cf6575e9e96df1b66eea0e24d637d 100644
--- a/content/browser/renderer_host/text_input_client_mac.mm
+++ b/content/browser/renderer_host/text_input_client_mac.mm
@@ -8,11 +8,34 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
+#include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/common/text_input_client_messages.h"
 
 namespace content {
 
+namespace {
+
+// TODO(ekaramad): TextInputClientObserver, the renderer side of
+// TextInputClientMac for each RenderWidgetHost, expects to have a
+// WebFrameWidget to use for handling these IPCs. However, for fullscreen flash,
+// we end up with a PepperWidget. For those scenarios, do not send the IPCs. We
+// need to figure out what features are properly supported and perhaps send the
+// IPC to the parent widget of the plugin.

[alexmos, 2016/11/04 20:34:03]

Let's add a bug reference here.

[EhsanK, 2016/11/08 16:59:44]

Done.

+bool SendMessageToRenderWidge(RenderWidgetHostImpl* widget,

[alexmos, 2016/11/04 20:34:03]

s/SendMessageToRenderWidge/SendMessageToRenderWidget/

or perhaps MaybeSendMessageToRenderWidget?

[EhsanK, 2016/11/08 16:59:44]

Done.

+                              IPC::Message* message) {
+  if (!widget->delegate())
+    return false;

[alexmos, 2016/11/04 20:34:03]

Do you need to delete the message here as well?

[EhsanK, 2016/11/08 16:59:44]

Yes. Thanks!

+
+  if (widget == widget->delegate()->GetFullscreenRenderWidgetHost()) {
+    delete message;
+    return false;
+  }
+

[alexmos, 2016/11/04 20:34:03]

maybe DCHECK that message->routing_id() == widget->GetRoutingID()?

[EhsanK, 2016/11/08 16:59:44]

Acknowledged. I guess this makes sure we cannot send arbitrary messages to
random destinations using this method.

+  return widget->Send(message);
+}
+}
+
 // The amount of time in milliseconds that the browser process will wait for a
 // response from the renderer.
 // TODO(rsesek): Using the histogram data, find the best upper-bound for this
@@ -44,7 +67,8 @@ void TextInputClientMac::GetStringAtPoint(
   DCHECK(replyForPointHandler_.get() == nil);
   replyForPointHandler_.reset(reply_handler, base::scoped_policy::RETAIN);
   RenderWidgetHostImpl* rwhi = RenderWidgetHostImpl::From(rwh);
-  rwhi->Send(new TextInputClientMsg_StringAtPoint(rwhi->GetRoutingID(), point));
+  SendMessageToRenderWidge(
+      rwhi, new TextInputClientMsg_StringAtPoint(rwhi->GetRoutingID(), point));
 }
 
 void TextInputClientMac::GetStringAtPointReply(NSAttributedString* string,
@@ -62,8 +86,8 @@ void TextInputClientMac::GetStringFromRange(
   DCHECK(replyForRangeHandler_.get() == nil);
   replyForRangeHandler_.reset(reply_handler, base::scoped_policy::RETAIN);
   RenderWidgetHostImpl* rwhi = RenderWidgetHostImpl::From(rwh);
-  rwhi->Send(new TextInputClientMsg_StringForRange(rwhi->GetRoutingID(),
-                                                   gfx::Range(range)));
+  SendMessageToRenderWidge(rwhi, new TextInputClientMsg_StringForRange(
+                                     rwhi->GetRoutingID(), gfx::Range(range)));
 }
 
 void TextInputClientMac::GetStringFromRangeReply(NSAttributedString* string,
@@ -80,8 +104,11 @@ NSUInteger TextInputClientMac::GetCharacterIndexAtPoint(RenderWidgetHost* rwh,
 
   BeforeRequest();
   RenderWidgetHostImpl* rwhi = RenderWidgetHostImpl::From(rwh);
-  rwhi->Send(new TextInputClientMsg_CharacterIndexForPoint(rwhi->GetRoutingID(),
-                                                          point));
+  if (!SendMessageToRenderWidge(rwhi,
+                                new TextInputClientMsg_CharacterIndexForPoint(
+                                    rwhi->GetRoutingID(), point)))
+    return NSNotFound;
+
   // http://crbug.com/121917
   base::ThreadRestrictions::ScopedAllowWait allow_wait;
   condition_.TimedWait(base::TimeDelta::FromMilliseconds(kWaitTimeout));
@@ -100,9 +127,11 @@ NSRect TextInputClientMac::GetFirstRectForRange(RenderWidgetHost* rwh,
 
   BeforeRequest();
   RenderWidgetHostImpl* rwhi = RenderWidgetHostImpl::From(rwh);
-  rwhi->Send(
-      new TextInputClientMsg_FirstRectForCharacterRange(rwhi->GetRoutingID(),
-                                                        gfx::Range(range)));
+  if (!SendMessageToRenderWidge(
+          rwhi, new TextInputClientMsg_FirstRectForCharacterRange(
+                    rwhi->GetRoutingID(), gfx::Range(range))))
+    return NSRect();
+
   // http://crbug.com/121917
   base::ThreadRestrictions::ScopedAllowWait allow_wait;
   condition_.TimedWait(base::TimeDelta::FromMilliseconds(kWaitTimeout));