Content API changes to improve DOM stitching in ThreatDetails code.

content/public/browser/render_frame_host.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_RENDER_FRAME_HOST_H_
 #define CONTENT_PUBLIC_BROWSER_RENDER_FRAME_HOST_H_
 
 #include <string>
 
 #include "base/callback_forward.h"
@@ skipping 45 matching lines @@
 #if defined(OS_ANDROID)
   // Globally allows for injecting JavaScript into the main world. This feature
   // is present only to support Android WebView and must not be used in other
   // configurations.
   static void AllowInjectingJavaScriptForAndroidWebView();
 #endif
 
   // Returns a RenderFrameHost given its accessibility tree ID.
   static RenderFrameHost* FromAXTreeID(int ax_tree_id);
 
+  // Returns the RenderFrameHost corresponding to the specified |process_id| and
+  // |routing_id|. This host may represent a placeholder for a frame that is
+  // currently rendered in a different process than |process_id|.

[Charlie Reis, 2017/05/10 22:17:49]

Hmm, I really prefer the previous version of the API that returned a
FrameTreeNode ID, which looks like it would be sufficient for your use case in
ThreatDetails::OnReceivedThreatDOMDetails.

The problem with the current API is that it's too easy for callers to assume
that the RenderFrameHost returned here is actually in |process_id|, since that's
the value they passed in to look it up.  That could very easily lead to security
bugs where we assume a frame has access to something that it does not.

Can we switch back to GetFrameTreeNodeIdForRoutingId?

[lpz, 2017/05/12 13:53:16]

Done.

+  static RenderFrameHost* GetRenderFrameHostForRoutingId(int process_id,
+                                                         int routing_id);
+
   ~RenderFrameHost() override {}
 
   // Returns the route id for this frame.
   virtual int GetRoutingID() = 0;
 
   // Returns the accessibility tree ID for this RenderFrameHost.
   virtual int GetAXTreeID() = 0;
 
   // Returns the SiteInstance grouping all RenderFrameHosts that have script
   // access to this RenderFrameHost, and must therefore live in the same
@@ skipping 179 matching lines @@
 
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
   RenderFrameHost() {}
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_RENDER_FRAME_HOST_H_