Require a process ID when looking up RFHs by FrameTreeNode ID.

extensions/browser/extension_api_frame_id_map.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/extension_api_frame_id_map.h"
 
 #include <tuple>
 
 #include "base/metrics/histogram_macros.h"
 #include "content/public/browser/browser_thread.h"
@@ skipping 110 matching lines @@
 
 // static
 int ExtensionApiFrameIdMap::GetParentFrameId(
     content::NavigationHandle* navigation_handle) {
   if (navigation_handle->IsInMainFrame())
     return kInvalidFrameId;
 
   if (navigation_handle->IsParentMainFrame())
     return kTopFrameId;
 
-  return navigation_handle->GetParentFrameTreeNodeId();
+  return navigation_handle->GetParentFrame()->GetFrameTreeNodeId();
 }
 
 // static
 content::RenderFrameHost* ExtensionApiFrameIdMap::GetRenderFrameHostById(
     content::WebContents* web_contents,
     int frame_id) {
   // Although it is technically possible to map |frame_id| to a RenderFrameHost
   // without WebContents, we choose to not do that because in the extension API
   // frameIds are only guaranteed to be meaningful in combination with a tabId.
   if (!web_contents)
     return nullptr;
 
   if (frame_id == kInvalidFrameId)
     return nullptr;
 
   if (frame_id == kTopFrameId)
     return web_contents->GetMainFrame();
 
   DCHECK_GE(frame_id, 1);
-  return web_contents->FindFrameByFrameTreeNodeId(frame_id);
+
+  // Unfortunately, extension APIs do not know which process to expect for a
+  // given frame ID, so we must use an unsafe API here that could return a
+  // different RenderFrameHost than the caller may have expected (e.g., one that
+  // changed after a cross-process navigation).
+  return web_contents->UnsafeFindFrameByFrameTreeNodeId(frame_id);
 }
 
 ExtensionApiFrameIdMap::FrameData ExtensionApiFrameIdMap::KeyToValue(
     const RenderFrameIdKey& key) const {
   content::RenderFrameHost* rfh = content::RenderFrameHost::FromID(
       key.render_process_id, key.frame_routing_id);
   int tab_id = -1;
   int window_id = -1;
   if (helper_)
     helper_->GetTabAndWindowId(rfh, &tab_id, &window_id);
@@ skipping 194 matching lines @@
 }
 
 void ExtensionApiFrameIdMap::RemoveFrameData(const RenderFrameIdKey& key) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
   base::AutoLock lock(frame_data_map_lock_);
   frame_data_map_.erase(key);
 }
 
 }  // namespace extensions