Move ownership of CrossProcessFrameConnector to RenderFrameProxyHost.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/bind.h"
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/user_metrics_action.h"
@@ skipping 261 matching lines @@
         Send(reply);
       }
       // Don't continue looking for someone to handle it.
       return true;
     }
   }
 
   if (delegate_->OnMessageReceived(this, msg))
     return true;
 
-  if (cross_process_frame_connector_ &&
-      cross_process_frame_connector_->OnMessageReceived(msg))
+  RenderFrameProxyHost* proxy =
+      frame_tree_node_->render_manager()->ProxyToParent();

[kenrb, 2014/06/06 15:45:54]

I think this is the problem. This message intercept here is intended to
intercept messages coming *from* the parent frame renderer and going *to* the
child frame renderer. This is currently exercised when the current
RenderFrameHostImpl is swapped out and has a CPFC -- indicating that it is
responsible for passing input events and iframe size information to its child.

In the current form, do we still have a parent-renderer RenderFrameHost for the
swapped out child, or has that been replaced with RenderFrameProxyHost yet? If
it has been replaced (I don't think it has, but I haven't been following
closely), this intercept just goes there -- the RFPH should be receiving the
message from the RenderFrameProxy. Otherwise, I'm not sure what the current
configuration of RenderFrameProxy and RenderFrameProxyHost looks like for a
swapepd out child frame.

+  if (proxy && proxy->cross_process_frame_connector() &&
+      proxy->cross_process_frame_connector()->OnMessageReceived(msg))
     return true;
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(RenderFrameHostImpl, msg)
     IPC_MESSAGE_HANDLER(FrameHostMsg_AddMessageToConsole, OnAddMessageToConsole)
     IPC_MESSAGE_HANDLER(FrameHostMsg_Detach, OnDetach)
     IPC_MESSAGE_HANDLER(FrameHostMsg_FrameFocused, OnFrameFocused)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidStartProvisionalLoadForFrame,
                         OnDidStartProvisionalLoadForFrame)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailProvisionalLoadWithError,
@@ skipping 596 matching lines @@
   cancel_notification_callbacks_.erase(notification_id);
 }
 
 void RenderFrameHostImpl::DesktopNotificationPermissionRequestDone(
     int callback_context) {
   Send(new DesktopNotificationMsg_PermissionRequestDone(
       routing_id_, callback_context));
 }
 
 }  // namespace content