Plumb site engagement to the renderer process.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 00f17b47be2c3ea857ea9936a7d166eba36af23f..a35d221634d029542948a69adcde64ec3daf7d08 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -1105,6 +1105,7 @@ RenderFrameImpl::RenderFrameImpl(const CreateParams& params)
       focused_pepper_plugin_(nullptr),
       pepper_last_mouse_event_target_(nullptr),
 #endif
+      engagement_binding_(this),
       frame_binding_(this),
       host_zoom_binding_(this),
       has_accessed_initial_document_(false),
@@ -1629,8 +1630,13 @@ void RenderFrameImpl::OnNavigate(
                    std::unique_ptr<StreamOverrideParameters>());
 }
 
-void RenderFrameImpl::Bind(mojom::FrameRequest request,
-                           mojom::FrameHostPtr host) {
+void RenderFrameImpl::BindEngagement(
+    blink::mojom::EngagementClientAssociatedRequest request) {
+  engagement_binding_.Bind(std::move(request));
+}
+
+void RenderFrameImpl::BindFrame(mojom::FrameRequest request,
+                                mojom::FrameHostPtr host) {
   frame_binding_.Bind(std::move(request));
   frame_host_ = std::move(host);
   frame_host_->GetInterfaceProvider(
@@ -2646,6 +2652,20 @@ bool RenderFrameImpl::IsPasting() const {
   return is_pasting_;
 }
 
+// blink::mojom::EngagementClient implementation -------------------------------
+
+void RenderFrameImpl::SetEngagementLevel(const url::Origin& origin,

[esprehn, 2016/12/06 00:31:34]

Why do you need to pass an origin? If you connect to the per-frame
ServiceRegistry then its tightly bound to the origin (ex. permissions are
connected to it) , so you don't need to check again here. You'll only get
deliveries about that frame.

[dominickn, 2016/12/06 00:49:57]

nasko suggested passing the origin here like the HostZoom feature does. His
reasoning seemed sound: navigation is inherently racey, so we should only set
engagement when the current security origin matches the origin that we received.

[nasko, 2016/12/06 00:50:30]

Because a single frame can render multiple origins and navigations are racy by
definition. By the time an IPC arrives, the frame might have navigated away to a
different origin or even relaxed it with document.domain.

[esprehn, 2016/12/06 00:58:44]

Right, but that's true of all things using the ServiceRegistry on Frame right?
ex. USB uses the registry to get permissions, you're saying that the permission
could be accidentally granted to the wrong domain? That should never happen, at
the DOMWindow level we should register as a client, just like USB would.

[dominickn, 2016/12/08 02:37:10]

USB doesn't need to request a permission prior to navigation commit though,
whereas in this case, we're usually sending the engagement before commit and
then setting it when the commit happens.

[nasko, 2016/12/08 22:26:48]

If your Mojo interface is bound to the lifetime of a document, then you don't
need to pass the origin. However, this interface is bound to a RenderFrame
lifetime, which can render multiple origins, so we need to pass the origin to
help disambiguate.

+                                         blink::mojom::EngagementLevel level) {
+  // Set the engagement level on |frame_| if its origin matches the one we have
+  // been provided with.
+  if (frame_ && url::Origin(frame_->getSecurityOrigin()) == origin) {
+    frame_->setEngagementLevel(level);
+    return;
+  }
+
+  engagement_levels_[origin] = level;
+}
+
 // mojom::Frame implementation -------------------------------------------------
 
 void RenderFrameImpl::GetInterfaceProvider(
@@ -4732,6 +4752,14 @@ void RenderFrameImpl::SendDidCommitProvisionalLoad(
   InternalDocumentStateData* internal_data =
       InternalDocumentStateData::FromDocumentState(document_state);
 
+  // Set the correct engagement level on the frame.
+  EngagementLevels::iterator engagement_level =
+      engagement_levels_.find(url::Origin(frame_->getSecurityOrigin()));
+
+  if (engagement_level != engagement_levels_.end())
+    frame_->setEngagementLevel(engagement_level->second);

[esprehn, 2016/12/06 00:31:34]

This seems like something we should be able to manage inside blink?

[dominickn, 2016/12/06 00:49:57]

See comment below regarding this being sent pre-commit.

+  engagement_levels_.clear();

[dcheng, 2016/12/08 08:14:07]

Out of curiosity... why do we need to maintain a map? I think this needs some
sort of comment (I would have expected a max of one pending entry)

[dominickn, 2016/12/08 09:02:47]

I implemented it analogously to the HostZoom feature, which is also sent down in
ReadyToCommitNavigation and stored in a map. I don't know enough to elaborate in
a comment, but nasko suggested doing it this way.

+
   FrameHostMsg_DidCommitProvisionalLoad_Params params;
   params.http_status_code = response.httpStatusCode();
   params.url_is_unreachable = ds->hasUnreachableURL();
@@ -6484,6 +6512,9 @@ void RenderFrameImpl::HandlePepperImeCommit(const base::string16& text) {
 #endif  // ENABLE_PLUGINS
 
 void RenderFrameImpl::RegisterMojoInterfaces() {
+  GetAssociatedInterfaceRegistry()->AddInterface(
+      base::Bind(&RenderFrameImpl::BindEngagement, weak_factory_.GetWeakPtr()));

[esprehn, 2016/12/06 00:31:34]

You should be able to connect to this interface directly from inside blink and
then not expose new API surface on the WebFrame.

[dominickn, 2016/12/06 00:49:57]

I'm not sure what you mean. The IPC from the browser process is sent
pre-navigation commit, so that when we commit we've already initialized the
frame state to have the correct engagement. Can we guarantee the correct
behaviour if it skips the RenderFrame and goes directly to Blink?

[nasko, 2016/12/08 22:26:48]

It doesn't strictly need to be a map, but it needs to be a tuple. Maybe we can
just use a tuple to store it, if we don't expect more than one.

In general, we do need to keep the URL and score together, since there can be
races between navigations and we want to ensure that we are stamping the correct
score on the correct document.

+
   if (!frame_->parent()) {
     // Only main frame have ImageDownloader service.
     GetInterfaceRegistry()->AddInterface(base::Bind(