Perform direct routing of mouse events when the pointer is locked.

content/browser/renderer_host/render_widget_host_input_event_router.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 
 #include <vector>
 
 #include "base/metrics/histogram_macros.h"
 
@@ skipping 155 matching lines @@
   if (iter == owner_map_.end())
     return root_view;
 
   return iter->second;
 }
 
 void RenderWidgetHostInputEventRouter::RouteMouseEvent(
     RenderWidgetHostViewBase* root_view,
     blink::WebMouseEvent* event,
     const ui::LatencyInfo& latency) {
+  if (root_view->IsMouseLocked()) {

[kenrb, 2016/12/22 15:14:16]

You need to transform the event's coordinates into the widget's coordinate
space. Also, do you need to null check the return of GetView(), to guard against
a race with a process crash? I gave it a quick look, and don't see a way that
the lock would get immediately released after RWHVCF::RenderProcessGone.

[lfg, 2017/02/13 20:16:07]

Done. I don't think we need to null check GetView(), since
WebContentsImpl::RenderWidgetDeleted releases the mouse lock when a widget dies.

[kenrb, 2017/02/14 19:58:49]

I don't think child frame RWHImpls necessarily get destroyed when their process
crashes. Only their views do.

[lfg, 2017/02/15 20:12:03]

After further investigation, this isn't necessary. The mouse is unlocked when
the process is destroyed, it happens in the destructors of
RenderWidgetHostViewAura, RenderWidgetHostViewMac and in
RenderWidgetHostViewChildFrame::SetCrossProcessFrameConnector, called from
RenderWidgetHostViewChildFrame::Destroy.

We should never get to this point without an existing view.

+    RenderWidgetHostImpl::From(root_view->GetRenderWidgetHost())
+        ->delegate()
+        ->MouseLockWidget()
+        ->GetView()
+        ->ProcessMouseEvent(*event, latency);
+    return;
+  }
+
   RenderWidgetHostViewBase* target;
   gfx::Point transformed_point;
   const int mouse_button_modifiers = blink::WebInputEvent::LeftButtonDown |
                                      blink::WebInputEvent::MiddleButtonDown |
                                      blink::WebInputEvent::RightButtonDown;
   if (mouse_capture_target_.target &&
       event->type != blink::WebInputEvent::MouseDown &&
       (event->type == blink::WebInputEvent::MouseUp ||
        event->modifiers & mouse_button_modifiers)) {
     target = mouse_capture_target_.target;
@@ skipping 54 matching lines @@
 
   event->x = transformed_point.x();
   event->y = transformed_point.y();
   target->ProcessMouseEvent(*event, latency);
 }
 
 void RenderWidgetHostInputEventRouter::RouteMouseWheelEvent(
     RenderWidgetHostViewBase* root_view,
     blink::WebMouseWheelEvent* event,
     const ui::LatencyInfo& latency) {
+  if (root_view->IsMouseLocked()) {

[kenrb, 2016/12/22 15:14:16]

Likewise for the transform.

[lfg, 2017/02/13 20:16:07]

Done.

+    RenderWidgetHostImpl::From(root_view->GetRenderWidgetHost())
+        ->delegate()
+        ->MouseLockWidget()
+        ->GetView()
+        ->ProcessMouseEvent(*event, latency);
+    return;
+  }
+
   gfx::Point transformed_point;
   RenderWidgetHostViewBase* target = FindEventTarget(
       root_view, gfx::Point(event->x, event->y), &transformed_point);
   if (!target)
     return;
 
   event->x = transformed_point.x();
   event->y = transformed_point.y();
   target->ProcessMouseWheelEvent(*event, latency);
 }
@@ skipping 513 matching lines @@
   if (!touchpad_gesture_target_.target)
     return;
 
   // TODO(mohsen): Add tests to check event location.
   event->x += touchpad_gesture_target_.delta.x();
   event->y += touchpad_gesture_target_.delta.y();
   touchpad_gesture_target_.target->ProcessGestureEvent(*event, latency);
 }
 
 }  // namespace content