Make RenderFrame(Host) own a RenderWidget(Host).

content/browser/frame_host/render_frame_host_manager.cc

Index: content/browser/frame_host/render_frame_host_manager.cc
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 807a450985156f6c5d4c97e5f611d53bb71f983c..3a392fa286e5f7db059c58d2ff97919607f854de 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -115,7 +115,8 @@ RenderWidgetHostView* RenderFrameHostManager::GetRenderWidgetHostView() const {
     return interstitial_page_->GetView();
   if (!render_frame_host_)
     return NULL;
-  return render_frame_host_->render_view_host()->GetView();
+  return static_cast<RenderFrameHostImpl*>(render_frame_host_->
+      render_view_host()->GetMainFrame())->GetView();

[ncarter (slow), 2014/12/15 19:53:07]

In the browser_test TaskManagerOOPIFBrowserTest.KillSubframe/1, we crash here
because the value below is NULL

render_frame_host_->render_view_host()->GetMainFrame()

Stack trace here: https://gist.github.com/anonymous/06a044609b96de3040bb

 }
 
 RenderFrameProxyHost* RenderFrameHostManager::GetProxyToParent() {
@@ -208,8 +209,8 @@ RenderFrameHostImpl* RenderFrameHostManager::Navigate(
     // our primary one.  Otherwise, we might crash if we try to call Show()
     // on it later.
     if (dest_render_frame_host != render_frame_host_ &&
-        dest_render_frame_host->render_view_host()->GetView()) {
-      dest_render_frame_host->render_view_host()->GetView()->Hide();
+        dest_render_frame_host->GetView()) {
+      dest_render_frame_host->GetView()->Hide();
     } else {
       // Notify here as we won't be calling CommitPending (which does the
       // notify).
@@ -1033,7 +1034,8 @@ void RenderFrameHostManager::CreatePendingRenderFrameHost(
     create_render_frame_flags |= CREATE_RF_HIDDEN;
 
   int opener_route_id =
-      CreateOpenerRenderViewsIfNeeded(old_instance, new_instance);
+      CreateOpenerRenderViewsIfNeeded(old_instance, new_instance,
+                                      create_render_frame_flags);
 
   if (pending_render_frame_host_)
     CancelPending();
@@ -1046,7 +1048,8 @@ void RenderFrameHostManager::CreatePendingRenderFrameHost(
 
 int RenderFrameHostManager::CreateOpenerRenderViewsIfNeeded(
     SiteInstance* old_instance,
-    SiteInstance* new_instance) {
+    SiteInstance* new_instance,
+    int& create_render_frame_flags) {
   int opener_route_id = MSG_ROUTING_NONE;
   if (new_instance->IsRelatedSiteInstance(old_instance)) {
     opener_route_id =
@@ -1057,6 +1060,13 @@ int RenderFrameHostManager::CreateOpenerRenderViewsIfNeeded(
       // SiteInstance in all nodes except the current one.
       frame_tree_node_->frame_tree()->CreateProxiesForSiteInstance(
           frame_tree_node_, new_instance);
+      // RenderFrames in different processes from their parent RenderFrames
+      // in the frame tree require RenderWidgets for rendering and processing
+      // input events.
+      if (frame_tree_node_->parent() &&
+          frame_tree_node_->parent()->render_manager()->
+              current_frame_host()->GetSiteInstance() != new_instance)
+        create_render_frame_flags |= CREATE_RF_NEEDS_RENDER_WIDGET_HOST;
     }
   }
   return opener_route_id;
@@ -1070,7 +1080,7 @@ scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::CreateRenderFrameHost(
   if (frame_routing_id == MSG_ROUTING_NONE)
     frame_routing_id = site_instance->GetProcess()->GetNextRoutingID();
 
-  bool swapped_out = !!(flags & CREATE_RF_SWAPPED_OUT);
+  bool swapped_out = flags & CREATE_RF_SWAPPED_OUT;
   bool hidden = !!(flags & CREATE_RF_HIDDEN);
 
   // Create a RVH for main frames, or find the existing one for subframes.
@@ -1078,7 +1088,11 @@ scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::CreateRenderFrameHost(
   RenderViewHostImpl* render_view_host = NULL;
   if (frame_tree_node_->IsMainFrame()) {
     render_view_host = frame_tree->CreateRenderViewHost(
-        site_instance, view_routing_id, frame_routing_id, swapped_out, hidden);
+        site_instance,
+        view_routing_id,
+        frame_routing_id,
+        swapped_out,
+        hidden);
   } else {
     render_view_host = frame_tree->GetRenderViewHost(site_instance);
 
@@ -1088,7 +1102,7 @@ scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::CreateRenderFrameHost(
   // TODO(creis): Pass hidden to RFH.
   scoped_ptr<RenderFrameHostImpl> render_frame_host =
       make_scoped_ptr(RenderFrameHostFactory::Create(
-                          render_view_host, render_frame_delegate_, frame_tree,
+                          render_view_host, render_frame_delegate_, render_widget_delegate_, frame_tree,
                           frame_tree_node_, frame_routing_id, flags).release());
   return render_frame_host.Pass();
 }
@@ -1176,7 +1190,11 @@ scoped_ptr<RenderFrameHostImpl> RenderFrameHostManager::CreateRenderFrame(
     if (success) {
       if (frame_tree_node_->IsMainFrame()) {
         // Don't show the main frame's view until we get a DidNavigate from it.
-        render_view_host->GetView()->Hide();
+        // Only top-level RenderViewHosts have RenderWidgetHostViews;
+        // RenderWidgetHosts for out-of-process iframes will be created
+        // later and hidden.
+        if (render_view_host->GetView())
+          render_view_host->GetView()->Hide();
       } else if (!swapped_out) {
         // Init the RFH, so a RenderFrame is created in the renderer.
         DCHECK(new_render_frame_host.get());
@@ -1324,8 +1342,8 @@ void RenderFrameHostManager::CommitPending() {
   // Remember if the page was focused so we can focus the new renderer in
   // that case.
   bool focus_render_view = !will_focus_location_bar &&
-      render_frame_host_->render_view_host()->GetView() &&
-      render_frame_host_->render_view_host()->GetView()->HasFocus();
+      render_frame_host_->GetView() &&
+      render_frame_host_->GetView()->HasFocus();
 
   bool is_main_frame = frame_tree_node_->IsMainFrame();
 
@@ -1340,10 +1358,10 @@ void RenderFrameHostManager::CommitPending() {
   render_frame_host_->GetProcess()->RemovePendingView();
 
   // Show the new view (or a sad tab) if necessary.
-  bool new_rfh_has_view = !!render_frame_host_->render_view_host()->GetView();
+  bool new_rfh_has_view = !!render_frame_host_->GetView();
   if (!delegate_->IsHidden() && new_rfh_has_view) {
     // In most cases, we need to show the new view.
-    render_frame_host_->render_view_host()->GetView()->Show();
+    render_frame_host_->GetView()->Show();
   }
   if (!new_rfh_has_view) {
     // If the view is gone, then this RenderViewHost died while it was hidden.
@@ -1367,8 +1385,8 @@ void RenderFrameHostManager::CommitPending() {
   if (will_focus_location_bar) {
     delegate_->SetFocusToLocationBar(false);
   } else if (focus_render_view &&
-             render_frame_host_->render_view_host()->GetView()) {
-    render_frame_host_->render_view_host()->GetView()->Focus();
+             render_frame_host_->GetView()) {
+    render_frame_host_->GetView()->Focus();
   }
 
   // Notify that we've swapped RenderFrameHosts. We do this before shutting down
@@ -1394,7 +1412,7 @@ void RenderFrameHostManager::CommitPending() {
     RenderFrameProxyHost* proxy_to_parent = GetProxyToParent();
     if (proxy_to_parent) {
       proxy_to_parent->SetChildRWHView(
-          render_frame_host_->render_view_host()->GetView());
+          render_frame_host_->GetView());
     }
 
     // Since the new RenderFrameHost is now committed, there must be no proxies