Cross-process iframe accessibility.

content/browser/frame_host/frame_tree.cc

Index: content/browser/frame_host/frame_tree.cc
diff --git a/content/browser/frame_host/frame_tree.cc b/content/browser/frame_host/frame_tree.cc
index c8b5d2da802352b4a9f7f7810d26f15b7882ed7c..7292da6f2c7d9983bd6246f93cbbd8d30e0d0ae5 100644
--- a/content/browser/frame_host/frame_tree.cc
+++ b/content/browser/frame_host/frame_tree.cc
@@ -14,6 +14,7 @@
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_factory.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/renderer_host/render_view_host_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/public/browser/browser_thread.h"
@@ -42,20 +43,6 @@ bool FrameTreeNodeForId(int64 frame_tree_node_id,
   return true;
 }
 
-bool FrameTreeNodeForRoutingId(int routing_id,
-                               int process_id,
-                               FrameTreeNode** out_node,
-                               FrameTreeNode* node) {
-  // TODO(creis): Look through the swapped out RFHs as well.
-  if (node->current_frame_host()->GetProcess()->GetID() == process_id &&
-      node->current_frame_host()->GetRoutingID() == routing_id) {
-    *out_node = node;
-    // Terminate iteration once the node has been found.
-    return false;
-  }
-  return true;
-}
-
 // Iterate over the FrameTree to reset any node affected by the loss of the
 // given RenderViewHost's process.
 bool ResetNodesForNewProcess(RenderViewHost* render_view_host,
@@ -120,10 +107,23 @@ FrameTreeNode* FrameTree::FindByID(int64 frame_tree_node_id) {
 }
 
 FrameTreeNode* FrameTree::FindByRoutingID(int routing_id, int process_id) {
-  FrameTreeNode* node = NULL;
-  ForEach(
-      base::Bind(&FrameTreeNodeForRoutingId, routing_id, process_id, &node));
-  return node;
+  RenderFrameHostImpl* render_frame_host =
+      RenderFrameHostImpl::FromID(process_id, routing_id);
+  if (render_frame_host) {
+    FrameTreeNode* result = render_frame_host->frame_tree_node();
+    CHECK_EQ(this, result->frame_tree());

[Charlie Reis, 2014/08/28 18:18:52]

Thinking this over, we may want to return NULL in this case instead of crashing,
since I think an exploited renderer process could send us a routing ID for the
wrong tab to cause the browser to crash.  Same below.

[dmazzoni, 2014/09/05 06:16:21]

Done.

+    return result;
+  }
+
+  RenderFrameProxyHost* render_frame_proxy_host =
+      RenderFrameProxyHost::FromID(process_id, routing_id);
+  if (render_frame_proxy_host) {
+    FrameTreeNode* result = render_frame_proxy_host->frame_tree_node();
+    CHECK_EQ(this, result->frame_tree());
+    return result;
+  }
+
+  return NULL;
 }
 
 void FrameTree::ForEach(