Service CreateNewWindow on the UI thread with a new mojo interface

content/browser/frame_host/render_frame_host_impl.h

Index: content/browser/frame_host/render_frame_host_impl.h
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index d4415a7ce0d084e2c8679a5b741ae9c1cb77947c..5fd98ec858a3dabcd8ca0c664c5f49bc0bb8b112 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -83,6 +83,7 @@ class Range;
 
 namespace content {
 class AssociatedInterfaceProviderImpl;
+class AssociatedInterfaceRegistryImpl;
 class FeaturePolicy;
 class FrameTree;
 class FrameTreeNode;
@@ -107,14 +108,11 @@ struct FrameOwnerProperties;
 struct FileChooserParams;
 struct ResourceResponse;
 
-namespace mojom {
-class CreateNewWindowParams;
-}
-
 class CONTENT_EXPORT RenderFrameHostImpl
     : public RenderFrameHost,
       public base::SupportsUserData,
       NON_EXPORTED_BASE(public mojom::FrameHost),
+      NON_EXPORTED_BASE(public mojom::FrameHostIPC),
       public BrowserAccessibilityDelegate,
       public SiteInstanceImpl::Observer,
       public NON_EXPORTED_BASE(
@@ -252,16 +250,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
                           const ParsedFeaturePolicyHeader& container_policy,
                           const FrameOwnerProperties& frame_owner_properties);
 
-  // Called when this frame tries to open a new WebContents, e.g. via a script
-  // call to window.open(). The renderer has already been told to create the
-  // RenderView and RenderFrame with the specified route ids, which were
-  // assigned on the IO thread.
-  void OnCreateNewWindow(int32_t render_view_route_id,
-                         int32_t main_frame_route_id,
-                         int32_t main_frame_widget_route_id,
-                         const mojom::CreateNewWindowParams& params,
-                         SessionStorageNamespace* session_storage_namespace);
-
   // Update this frame's last committed origin.
   void SetLastCommittedOrigin(const url::Origin& origin);
 
@@ -677,6 +665,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
                            LoadEventForwardingWhilePendingDeletion);
   FRIEND_TEST_ALL_PREFIXES(SitePerProcessBrowserTest,
                            ContextMenuAfterCrossProcessNavigation);
+  FRIEND_TEST_ALL_PREFIXES(SecurityExploitBrowserTest,
+                           AttemptDuplicateRenderViewHost);
 
   // IPC Message handlers.
   void OnDidAddMessageToConsole(int32_t level,
@@ -796,6 +786,17 @@ class CONTENT_EXPORT RenderFrameHostImpl
                            const gfx::Rect& initial_rect,
                            bool user_gesture);
 
+  // mojom::FrameHostIPC
+  void CreateNewWindow(mojom::CreateNewWindowParamsPtr params,
+                       const CreateNewWindowCallback& callback) override;
+
+  void RunCreateWindowCompleteCallback(const CreateNewWindowCallback& callback,
+                                       mojom::CreateNewWindowReplyPtr reply,
+                                       int render_view_route_id,
+                                       int main_frame_route_id,
+                                       int main_frame_widget_route_id,
+                                       int cloned_session_storage_namespace_id);
+
   // Registers Mojo interfaces that this frame host makes available.
   void RegisterMojoInterfaces();
 
@@ -1043,6 +1044,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // SiteInstance.  May be null in tests.
   std::unique_ptr<TimeoutMonitor> swapout_event_monitor_timeout_;
 
+  std::unique_ptr<AssociatedInterfaceRegistryImpl> associated_registry_;
+
   std::unique_ptr<service_manager::InterfaceRegistry> interface_registry_;
   std::unique_ptr<service_manager::InterfaceProvider> remote_interfaces_;
 
@@ -1130,6 +1133,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   PreviewsState last_navigation_previews_state_;
 
   mojo::Binding<mojom::FrameHost> frame_host_binding_;
+  mojo::AssociatedBinding<mojom::FrameHostIPC> frame_host_associated_binding_;
   mojom::FramePtr frame_;
   mojom::FrameBindingsControlAssociatedPtr frame_bindings_control_;