Prevent browser-side hit testing when page popup is selected

content/browser/site_per_process_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_per_process_browsertest.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 6073 matching lines @@
       IPC_MESSAGE_HANDLER(FrameHostMsg_ShowPopup, OnShowPopup)
 #else
       IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnShowWidget)
 #endif
     IPC_END_MESSAGE_MAP()
     return false;
   }
 
   gfx::Rect last_initial_rect() const { return initial_rect_; }
 
+  int last_routing_id() const { return routing_id_; }
+
   void Wait() {
     initial_rect_ = gfx::Rect();
+    routing_id_ = MSG_ROUTING_NONE;
     message_loop_runner_->Run();
   }
 
   void Reset() {
     initial_rect_ = gfx::Rect();
+    routing_id_ = MSG_ROUTING_NONE;
     message_loop_runner_ = new content::MessageLoopRunner;
   }
 
  private:
   ~ShowWidgetMessageFilter() override {}
 
   void OnShowWidget(int route_id, const gfx::Rect& initial_rect) {
     content::BrowserThread::PostTask(
         content::BrowserThread::UI, FROM_HERE,
         base::Bind(&ShowWidgetMessageFilter::OnShowWidgetOnUI, this, route_id,
                    initial_rect));
   }
 
 #if defined(OS_MACOSX) || defined(OS_ANDROID)
   void OnShowPopup(const FrameHostMsg_ShowPopup_Params& params) {
     content::BrowserThread::PostTask(
         content::BrowserThread::UI, FROM_HERE,
         base::Bind(&ShowWidgetMessageFilter::OnShowWidgetOnUI, this,
                    MSG_ROUTING_NONE, params.bounds));
   }
 #endif
 
   void OnShowWidgetOnUI(int route_id, const gfx::Rect& initial_rect) {
     initial_rect_ = initial_rect;
+    routing_id_ = route_id;
     message_loop_runner_->Quit();
   }
 
   scoped_refptr<content::MessageLoopRunner> message_loop_runner_;
   gfx::Rect initial_rect_;
+  int routing_id_;
 
   DISALLOW_COPY_AND_ASSIGN(ShowWidgetMessageFilter);
 };
 
 // Test that clicking a select element in an out-of-process iframe creates
 // a popup menu in the correct position.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, PopupMenuTest) {
   GURL main_url(
       embedded_test_server()->GetURL("/cross_site_iframe_factory.html?a(a)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
@@ skipping 42 matching lines @@
   gfx::Rect popup_rect = filter->last_initial_rect();
 #if defined(OS_MACOSX) || defined(OS_ANDROID)
   // On Mac and Android we receive the coordinates before they are transformed,
   // so they are still relative to the out-of-process iframe origin.
   EXPECT_EQ(popup_rect.x(), 9);
   EXPECT_EQ(popup_rect.y(), 9);
 #else
   EXPECT_EQ(popup_rect.x() - rwhv_root->GetViewBounds().x(), 354);
   EXPECT_EQ(popup_rect.y() - rwhv_root->GetViewBounds().y(), 94);
 #endif
+
+#if defined(OS_LINUX)
+  // Verify click-and-drag selection of popups still works on Linux with
+  // OOPIFs enabled. This is only necessary to test on Aura because Mac and
+  // Android use native widgets. Windows does not support this as UI
+  // convention (it requires separate clicks to open the menu and select an
+  // option). See https://crbug.com/703191.
+  int process_id = child_node->current_frame_host()->GetProcess()->GetID();
+  filter->Reset();
+  RenderWidgetHostInputEventRouter* router =
+      static_cast<WebContentsImpl*>(shell()->web_contents())
+          ->GetInputEventRouter();
+  // Re-open the select element.
+  click_event.x = 360;
+  click_event.y = 90;

[alexmos, 2017/03/23 22:25:18]

The 90 here seems weird to me, since it seems that the <select> sits at y=94
(from popup_rect.y() above), so to click it in root frame's coordinates,
wouldn't this need to be >94?  The test still works, so I'm probably just
confused by how the coordinates work out.

[kenrb, 2017/03/24 14:18:43]

The y >= 94 is for the position of the drop-down menu, which appears below the
element.

+  click_event.clickCount = 1;
+  router->RouteMouseEvent(rwhv_root, &click_event, ui::LatencyInfo());
+
+  filter->Wait();
+
+  RenderWidgetHostView* popup_view =
+      RenderWidgetHost::FromID(process_id, filter->last_routing_id())
+          ->GetView();
+
+  RenderWidgetHostMouseEventMonitor popup_monitor(
+      popup_view->GetRenderWidgetHost());
+
+  // Next send a mouse up directly targeting the first option, simulating a

[alexmos, 2017/03/23 22:25:18]

It'd actually be nice to target one of the other options, and then verify that
the selection was changed correctly, just like in the bug repro.  Might be worth
doing if it's easy.

[kenrb, 2017/03/24 14:18:43]

It turns out not to be easy -- if you look at the first patch set, I was trying
to do exactly that. Unfortunately to select an option in the menu you have to
send a MouseMove, which causes flakiness in content_browsertests, and would
necessitate creating a new test in interactive_ui_tests instead. Since we are
just trying to catch a specific case (i.e. verifying that popups are exempt from
mouse capture), this simpler test condition seemed adequate.

+  // drag. This requires a ui::MouseEvent because it tests behavior that is
+  // above RWH input event routing.
+  ui::MouseEvent mouse_up_event(ui::ET_MOUSE_RELEASED, gfx::Point(10, 5),
+                                gfx::Point(10, 5), ui::EventTimeForNow(),
+                                ui::EF_LEFT_MOUSE_BUTTON,
+                                ui::EF_LEFT_MOUSE_BUTTON);
+  static_cast<RenderWidgetHostViewAura*>(popup_view)
+      ->OnMouseEvent(&mouse_up_event);
+
+  // This verifies that the popup actually received the event, and it wasn't
+  // diverted to a different RenderWidgetHostView due to mouse capture.
+  EXPECT_TRUE(popup_monitor.EventWasReceived());
+#endif
 }
 
 // Test that clicking a select element in a nested out-of-process iframe creates
 // a popup menu in the correct position, even if the top-level page repositions
 // its out-of-process iframe. This verifies that screen positioning information
 // is propagating down the frame tree correctly.
 #if defined(OS_ANDROID)
 // Surface-based hit testing and coordinate translation is not yet avaiable on
 // Android.
 #define MAYBE_NestedPopupMenuTest DISABLED_NestedPopupMenuTest
@@ skipping 3414 matching lines @@
 
   // Try the same navigation, but use the browser-initiated path.
   NavigateFrameToURL(root->child_at(0), frame_url);
   EXPECT_FALSE(root->child_at(0)->render_manager()->pending_frame_host());
   EXPECT_EQ(root->child_at(0)->current_url(), redirected_url);
   EXPECT_EQ(b_site_instance,
             root->child_at(0)->current_frame_host()->GetSiteInstance());
 }
 
 }  // namespace content