Add a mojo channel for frame messages.

content/renderer/input/frame_input_handler_impl.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/input/frame_input_handler_impl.h"
+
+#include <utility>
+
+#include "base/bind.h"
+#include "base/debug/stack_trace.h"
+#include "base/logging.h"
+#include "content/renderer/ime_event_guard.h"
+#include "content/renderer/render_thread_impl.h"
+#include "content/renderer/render_view_impl.h"
+#include "content/renderer/render_widget.h"
+#include "third_party/WebKit/public/web/WebLocalFrame.h"
+
+namespace content {
+
+FrameInputHandlerImpl::FrameInputHandlerImpl(
+    RenderFrameImpl* render_frame,
+    mojom::FrameInputHandlerRequest request)
+    : binding_(this),
+      render_frame_(render_frame),
+      input_event_queue_(
+          render_frame->GetRenderWidget()->GetInputEventQueue()) {
+  // Once the binding is connected the error handler will be set to
+  // Release.
+  AddRef();
+
+  // If we have created an input event queue move the mojo request over to the
+  // compositor thread.
+  if (input_event_queue_) {
+    // Mojo channel bound on compositor thread.
+    RenderThreadImpl::current()->compositor_task_runner()->PostTask(
+        FROM_HERE, base::BindOnce(&FrameInputHandlerImpl::BindOnCompositor,
+                                  this, std::move(request)));
+  } else {
+    // Mojo channel bound on main thread.
+    BindNow(std::move(request));
+  }
+  main_thread_task_runner_ = base::ThreadTaskRunnerHandle::Get();
+}
+
+FrameInputHandlerImpl::~FrameInputHandlerImpl() {}
+
+// static
+void FrameInputHandlerImpl::CreateMojoService(
+    RenderFrameImpl* render_frame,
+    const service_manager::BindSourceInfo& source_info,
+    mojom::FrameInputHandlerRequest request) {
+  DCHECK(render_frame);
+
+  // Owns itself. Will be deleted when message pipe is destroyed or RenderFrame
+  // is destructed.
+  new FrameInputHandlerImpl(render_frame, std::move(request));
+}
+
+void FrameInputHandlerImpl::RunOnMainThread(const base::Closure& closure) {
+  if (input_event_queue_) {
+    input_event_queue_->QueueClosure(closure);
+  } else {
+    closure.Run();
+  }
+}
+
+void FrameInputHandlerImpl::SetCompositionFromExistingText(
+    int32_t start,
+    int32_t end,
+    const std::vector<ui::CompositionUnderline>& ui_underlines) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(
+        base::Bind(&FrameInputHandlerImpl::SetCompositionFromExistingText, this,

[dcheng, 2017/05/19 14:59:33]

It's not clear to me if we should be binding as a scoped_refptr. If the
RenderFrame is destroyed, this object will be kept alive by any pending
callbacks. When they run, that will be a UaF. It seems like WeakPtr might be a
better fit (but let me know if I misunderstood how this works)

[dtapuska, 2017/05/23 16:01:19]

So this object is destroyed on the connection handle thread (which generally is
the compositor thread). Having a WeakPtr across the threads isn't safe due to
this cross thread behaviour. However I think I have addressed your concern by
using a WeakPtr inside the FrameInputHandler which is only used on the main
thread. Thoughts?

+                   start, end, ui_underlines));
+    return;
+  }
+
+  ImeEventGuard guard(GetRenderFrame()->GetRenderWidget());
+  std::vector<blink::WebCompositionUnderline> underlines;
+  for (const auto& underline : ui_underlines) {
+    blink::WebCompositionUnderline blink_underline(
+        underline.start_offset, underline.end_offset, underline.color,
+        underline.thick, underline.background_color);
+    underlines.push_back(blink_underline);
+  }
+
+  GetRenderFrame()->GetWebFrame()->SetCompositionFromExistingText(start, end,
+                                                                  underlines);
+}
+
+void FrameInputHandlerImpl::ExtendSelectionAndDelete(int32_t before,
+                                                     int32_t after) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExtendSelectionAndDelete,
+                               this, before, after));
+    return;
+  }
+  GetRenderFrame()->GetWebFrame()->ExtendSelectionAndDelete(before, after);
+}
+
+void FrameInputHandlerImpl::DeleteSurroundingText(int32_t before,
+                                                  int32_t after) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(base::Bind(&FrameInputHandlerImpl::DeleteSurroundingText,
+                               this, before, after));
+    return;
+  }
+  GetRenderFrame()->GetWebFrame()->DeleteSurroundingText(before, after);
+}
+
+void FrameInputHandlerImpl::DeleteSurroundingTextInCodePoints(int32_t before,
+                                                              int32_t after) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(
+        base::Bind(&FrameInputHandlerImpl::DeleteSurroundingTextInCodePoints,
+                   this, before, after));
+    return;
+  }
+  GetRenderFrame()->GetWebFrame()->DeleteSurroundingTextInCodePoints(before,
+                                                                     after);
+}
+
+void FrameInputHandlerImpl::SetEditableSelectionOffsets(int32_t start,
+                                                        int32_t end) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(base::Bind(
+        &FrameInputHandlerImpl::SetEditableSelectionOffsets, this, start, end));
+    return;
+  }
+  GetRenderFrame()->GetWebFrame()->SetEditableSelectionOffsets(start, end);
+}
+
+void FrameInputHandlerImpl::ExecuteEditCommand(
+    const std::string& command,
+    const base::Optional<base::string16>& value) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteEditCommand, this,
+                               command, value));
+    return;
+  }
+  if (value) {
+    GetRenderFrame()->GetWebFrame()->ExecuteCommand(
+        blink::WebString::FromUTF8(command),
+        blink::WebString::FromUTF16(value.value()));
+    return;
+  }
+
+  GetRenderFrame()->GetWebFrame()->ExecuteCommand(
+      blink::WebString::FromUTF8(command));
+}
+
+void FrameInputHandlerImpl::Undo() {
+  RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteCommandOnMainThread,
+                             this, "Undo", UpdateState::kNone));
+}
+
+void FrameInputHandlerImpl::Redo() {
+  RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteCommandOnMainThread,
+                             this, "Redo", UpdateState::kNone));
+}
+
+void FrameInputHandlerImpl::Cut() {
+  RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteCommandOnMainThread,
+                             this, "Cut", UpdateState::kIsSelectingRange));
+}
+
+void FrameInputHandlerImpl::Copy() {
+  RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteCommandOnMainThread,
+                             this, "Copy", UpdateState::kIsSelectingRange));
+}
+
+void FrameInputHandlerImpl::CopyToFindPboard() {
+#if defined(OS_MACOSX)
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(base::Bind(&FrameInputHandlerImpl::CopyToFindPboard, this));
+    return;
+  }
+  GetRenderFrame()->OnCopyToFindPboard();
+#endif
+}
+
+void FrameInputHandlerImpl::Paste() {
+  RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteCommandOnMainThread,
+                             this, "Paste", UpdateState::kIsPasting));
+}
+
+void FrameInputHandlerImpl::PasteAndMatchStyle() {
+  RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteCommandOnMainThread,
+                             this, "PasteAndMatchStyle",
+                             UpdateState::kIsPasting));
+}
+
+void FrameInputHandlerImpl::Replace(const base::string16& word) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(base::Bind(&FrameInputHandlerImpl::Replace, this, word));
+    return;
+  }
+  blink::WebLocalFrame* frame = GetRenderFrame()->GetWebFrame();
+  if (frame->HasSelection())
+    frame->SelectWordAroundCaret();
+  frame->ReplaceSelection(blink::WebString::FromUTF16(word));
+  GetRenderFrame()->SyncSelectionIfRequired();
+}
+
+void FrameInputHandlerImpl::ReplaceMisspelling(const base::string16& word) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(
+        base::Bind(&FrameInputHandlerImpl::ReplaceMisspelling, this, word));
+    return;
+  }
+  blink::WebLocalFrame* frame = GetRenderFrame()->GetWebFrame();
+  if (!frame->HasSelection())
+    return;
+  frame->ReplaceMisspelledRange(blink::WebString::FromUTF16(word));
+}
+
+void FrameInputHandlerImpl::Delete() {
+  RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteCommandOnMainThread,
+                             this, "Delete", UpdateState::kNone));
+}
+
+void FrameInputHandlerImpl::SelectAll() {
+  RunOnMainThread(base::Bind(&FrameInputHandlerImpl::ExecuteCommandOnMainThread,
+                             this, "SelectAll",
+                             UpdateState::kIsSelectingRange));
+}
+
+void FrameInputHandlerImpl::CollapseSelection() {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(
+        base::Bind(&FrameInputHandlerImpl::CollapseSelection, this));
+    return;
+  }
+
+  const blink::WebRange& range = GetRenderFrame()
+                                     ->GetRenderWidget()
+                                     ->GetWebWidget()
+                                     ->CaretOrSelectionRange();
+  if (range.IsNull())
+    return;
+
+  HandlingState handling_state(GetRenderFrame(),
+                               UpdateState::kIsSelectingRange);
+  GetRenderFrame()->GetWebFrame()->SelectRange(
+      blink::WebRange(range.EndOffset(), 0));
+}
+
+void FrameInputHandlerImpl::SelectRange(const gfx::Point& base,
+                                        const gfx::Point& extent) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    // TODO(dtapuska): This event should be coalesced. Chrome IPC used
+    // and ack scheme for this. We should be able to clobber them in the
+    // main thread event queue.
+    RunOnMainThread(
+        base::Bind(&FrameInputHandlerImpl::SelectRange, this, base, extent));
+    return;
+  }
+
+  RenderFrameImpl* render_frame = GetRenderFrame();
+  RenderViewImpl* render_view = render_frame->render_view();
+  HandlingState handling_state(render_frame, UpdateState::kIsSelectingRange);
+  render_frame->GetWebFrame()->SelectRange(
+      render_view->ConvertWindowPointToViewport(base),
+      render_view->ConvertWindowPointToViewport(extent));
+}
+
+void FrameInputHandlerImpl::AdjustSelectionByCharacterOffset(int32_t start,
+                                                             int32_t end) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    RunOnMainThread(
+        base::Bind(&FrameInputHandlerImpl::AdjustSelectionByCharacterOffset,
+                   this, start, end));
+    return;
+  }
+
+  blink::WebRange range = GetRenderFrame()
+                              ->GetRenderWidget()
+                              ->GetWebWidget()
+                              ->CaretOrSelectionRange();
+  if (range.IsNull())
+    return;
+
+  // Sanity checks to disallow empty and out of range selections.
+  if (start - end > range.length() || range.StartOffset() + start < 0)
+    return;
+
+  HandlingState handling_state(GetRenderFrame(),
+                               UpdateState::kIsSelectingRange);
+  // A negative adjust amount moves the selection towards the beginning of
+  // the document, a positive amount moves the selection towards the end of
+  // the document.
+  GetRenderFrame()->GetWebFrame()->SelectRange(
+      blink::WebRange(range.StartOffset() + start,
+                      range.length() + end - start),
+      blink::WebLocalFrame::kPreserveHandleVisibility);
+}
+
+void FrameInputHandlerImpl::MoveRangeSelectionExtent(const gfx::Point& extent) {
+  if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    // TODO(dtapuska): This event should be coalesced. Chrome IPC used
+    // and ack scheme for this. We should be able to clobber them in the
+    // main thread event queue.
+    RunOnMainThread(base::Bind(&FrameInputHandlerImpl::MoveRangeSelectionExtent,
+                               this, extent));
+    return;
+  }
+
+  HandlingState handling_state(GetRenderFrame(),
+                               UpdateState::kIsSelectingRange);
+  GetRenderFrame()->GetWebFrame()->MoveRangeSelectionExtent(
+      GetRenderFrame()->render_view()->ConvertWindowPointToViewport(extent));
+}
+
+void FrameInputHandlerImpl::ExecuteCommandOnMainThread(
+    const std::string& command,
+    UpdateState update_state) {
+  HandlingState handling_state(GetRenderFrame(), update_state);
+  GetRenderFrame()->GetWebFrame()->ExecuteCommand(
+      blink::WebString::FromUTF8(command));
+}
+
+void FrameInputHandlerImpl::BindOnCompositor(
+    mojom::FrameInputHandlerRequest request) {
+  BindNow(std::move(request));
+}
+
+void FrameInputHandlerImpl::BindNow(mojom::FrameInputHandlerRequest request) {
+  binding_.Bind(std::move(request));
+
+  // This will Release the ref-counted AddRef that was added in the constructor.
+  binding_.set_connection_error_handler(
+      base::Bind(&FrameInputHandlerImpl::Release, this));
+}
+
+RenderFrameImpl* FrameInputHandlerImpl::GetRenderFrame() {
+  DCHECK(main_thread_task_runner_->BelongsToCurrentThread());
+  return render_frame_;
+}
+
+FrameInputHandlerImpl::HandlingState::HandlingState(
+    RenderFrameImpl* render_frame,
+    UpdateState state)
+    : render_frame_(render_frame),
+      original_select_range_value_(render_frame->handling_select_range()),
+      original_pasting_value_(render_frame->IsPasting()) {
+  switch (state) {
+    case UpdateState::kIsPasting:
+      render_frame->set_is_pasting(true);
+    case UpdateState::kIsSelectingRange:
+      render_frame->set_handling_select_range(true);
+      break;
+    case UpdateState::kNone:
+      break;
+  }
+}
+
+FrameInputHandlerImpl::HandlingState::~HandlingState() {
+  render_frame_->set_handling_select_range(original_select_range_value_);
+  render_frame_->set_is_pasting(original_pasting_value_);
+}
+
+}  // namespace content