Cross-process postMessage

content/renderer/render_view_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/json/json_value_serializer.h"
 #include "base/json/json_writer.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/histogram.h"
 #include "base/path_service.h"
 #include "base/process_util.h"
 #include "base/string_piece.h"
 #include "base/string_split.h"
 #include "base/string_util.h"
 #include "base/sys_string_conversions.h"
 #include "base/time.h"
 #include "base/utf_string_conversions.h"
 #include "content/common/appcache/appcache_dispatcher.h"
+#include "content/common/child_thread.h"
 #include "content/common/clipboard_messages.h"
 #include "content/common/database_messages.h"
 #include "content/common/drag_messages.h"
 #include "content/common/file_system/file_system_dispatcher.h"
 #include "content/common/file_system/webfilesystem_callback_dispatcher.h"
 #include "content/common/intents_messages.h"
 #include "content/common/java_bridge_messages.h"
 #include "content/common/pepper_messages.h"
 #include "content/common/pepper_plugin_registry.h"
 #include "content/common/quota_dispatcher.h"
@@ skipping 43 matching lines @@
 #include "media/base/media_switches.h"
 #include "media/base/message_loop_factory_impl.h"
 #include "media/filters/gpu_video_decoder.h"
 #include "net/base/escape.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_util.h"
 #include "ppapi/c/private/ppb_flash_net_connector.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebAccessibilityObject.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDataSource.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDocument.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDOMEvent.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDOMMessageEvent.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebElement.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFileChooserParams.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFileSystemCallbacks.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFindOptions.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFormControlElement.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFormElement.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebHistoryItem.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebInputElement.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebInputEvent.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebIntent.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebIntentServiceInfo.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebMediaPlayerAction.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebNodeList.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPageSerializer.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPlugin.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginContainer.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginDocument.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginParams.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebRange.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebScriptSource.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSearchableFormData.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityPolicy.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebSerializedScriptValue.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSettings.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebStorageNamespace.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebStorageQuotaCallbacks.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebView.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebWindowFeatures.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebCString.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebDragData.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebImage.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebPoint.h"
@@ skipping 47 matching lines @@
 using WebKit::WebApplicationCacheHostClient;
 using WebKit::WebCString;
 using WebKit::WebColor;
 using WebKit::WebColorName;
 using WebKit::WebConsoleMessage;
 using WebKit::WebContextMenuData;
 using WebKit::WebCookieJar;
 using WebKit::WebData;
 using WebKit::WebDataSource;
 using WebKit::WebDocument;
+using WebKit::WebDOMEvent;
+using WebKit::WebDOMMessageEvent;
 using WebKit::WebDragData;
 using WebKit::WebDragOperation;
 using WebKit::WebDragOperationsMask;
 using WebKit::WebEditingAction;
 using WebKit::WebElement;
 using WebKit::WebExternalPopupMenu;
 using WebKit::WebExternalPopupMenuClient;
 using WebKit::WebFileChooserCompletion;
 using WebKit::WebFileSystem;
 using WebKit::WebFileSystemCallbacks;
@@ skipping 19 matching lines @@
 using WebKit::WebPluginParams;
 using WebKit::WebPoint;
 using WebKit::WebPopupMenuInfo;
 using WebKit::WebRange;
 using WebKit::WebRect;
 using WebKit::WebReferrerPolicy;
 using WebKit::WebScriptSource;
 using WebKit::WebSearchableFormData;
 using WebKit::WebSecurityOrigin;
 using WebKit::WebSecurityPolicy;
+using WebKit::WebSerializedScriptValue;
 using WebKit::WebSettings;
 using WebKit::WebSharedWorker;
 using WebKit::WebSize;
 using WebKit::WebStorageNamespace;
 using WebKit::WebStorageQuotaCallbacks;
 using WebKit::WebStorageQuotaError;
 using WebKit::WebStorageQuotaType;
 using WebKit::WebString;
 using WebKit::WebTextAffinity;
 using WebKit::WebTextDirection;
@@ skipping 94 matching lines @@
 
 RenderViewImpl::RenderViewImpl(
     gfx::NativeViewId parent_hwnd,
     int32 opener_id,
     const content::RendererPreferences& renderer_prefs,
     const WebPreferences& webkit_prefs,
     SharedRenderViewCounter* counter,
     int32 routing_id,
     int64 session_storage_namespace_id,
     const string16& frame_name,
+    bool is_renderer_created,
     int32 next_page_id)
     : RenderWidget(WebKit::WebPopupTypeNone),
       webkit_preferences_(webkit_prefs),
       send_content_state_immediately_(false),
       enabled_bindings_(0),
       send_preferred_size_changes_(false),
       is_loading_(false),
       navigation_gesture_(NavigationGestureUnknown),
       opened_by_user_gesture_(true),
       opener_suppressed_(false),
@@ skipping 10 matching lines @@
       cached_has_main_frame_vertical_scrollbar_(false),
       ALLOW_THIS_IN_INITIALIZER_LIST(cookie_jar_(this)),
       geolocation_dispatcher_(NULL),
       speech_input_dispatcher_(NULL),
       device_orientation_dispatcher_(NULL),
       p2p_socket_dispatcher_(NULL),
       devtools_agent_(NULL),
       renderer_accessibility_(NULL),
       session_storage_namespace_id_(session_storage_namespace_id),
       handling_select_range_(false),
+      active_content_frame_id_(-1),
 #if defined(OS_WIN)
       focused_plugin_id_(-1),
 #endif
       ALLOW_THIS_IN_INITIALIZER_LIST(pepper_delegate_(this)) {
   routing_id_ = routing_id;
-  if (opener_id != MSG_ROUTING_NONE)
+  if (opener_id != MSG_ROUTING_NONE && is_renderer_created)
     opener_id_ = opener_id;
 
   // Ensure we start with a valid next_page_id_ from the browser.
   DCHECK_GE(next_page_id_, 0);
 
 #if defined(ENABLE_NOTIFICATIONS)
   notification_provider_ = new NotificationProvider(this);
 #else
   notification_provider_ = NULL;
 #endif
@@ skipping 11 matching lines @@
 
   intents_dispatcher_ = new IntentsDispatcher(this);
 
   RenderThread::Get()->AddRoute(routing_id_, this);
   // Take a reference on behalf of the RenderThread.  This will be balanced
   // when we receive ViewMsg_ClosePage.
   AddRef();
 
   // If this is a popup, we must wait for the CreatingNew_ACK message before
   // completing initialization.  Otherwise, we can finish it now.
-  if (opener_id == MSG_ROUTING_NONE) {
+  if (opener_id_ == MSG_ROUTING_NONE) {
     did_show_ = true;
     CompleteInit(parent_hwnd);
   }
 
   g_view_map.Get().insert(std::make_pair(webview(), this));
   webkit_preferences_.Apply(webview());
   webview()->initializeMainFrame(this);
   if (!frame_name.empty())
     webview()->mainFrame()->setName(frame_name);
   webview()->settings()->setMinimumTimerInterval(
@@ skipping 19 matching lines @@
 
   new IdleUserDetector(this);
 
   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kEnableMediaStream)) {
     media_stream_impl_ = new MediaStreamImpl(
         RenderThreadImpl::current()->video_capture_impl_manager());
   }
 
   content::GetContentClient()->renderer()->RenderViewCreated(this);
+
+  // If we have an opener_id but we weren't created by a renderer, then
+  // it's the browser asking us to set our opener to another RenderView.
+  if (opener_id != MSG_ROUTING_NONE && !is_renderer_created) {
+    RenderViewImpl* opener_rv =
+          static_cast<RenderViewImpl*>(
+              ChildThread::current()->ResolveRoute(opener_id));
+    webview()->mainFrame()->setOpener(opener_rv->webview()->mainFrame());
+  }
 }
 
 RenderViewImpl::~RenderViewImpl() {
   history_page_ids_.clear();
 
   if (decrement_shared_popup_at_destruction_)
     shared_popup_counter_->data--;
 
   // If file chooser is still waiting for answer, dispatch empty answer.
   while (!file_chooser_completions_.empty()) {
@@ skipping 50 matching lines @@
 /*static*/
 RenderViewImpl* RenderViewImpl::Create(
     gfx::NativeViewId parent_hwnd,
     int32 opener_id,
     const content::RendererPreferences& renderer_prefs,
     const WebPreferences& webkit_prefs,
     SharedRenderViewCounter* counter,
     int32 routing_id,
     int64 session_storage_namespace_id,
     const string16& frame_name,
+    bool is_renderer_created,
     int32 next_page_id) {
   DCHECK(routing_id != MSG_ROUTING_NONE);
   return new RenderViewImpl(
       parent_hwnd,
       opener_id,
       renderer_prefs,
       webkit_prefs,
       counter,
       routing_id,
       session_storage_namespace_id,
       frame_name,
+      is_renderer_created,
       next_page_id);  // adds reference
 }
 
 void RenderViewImpl::AddObserver(RenderViewObserver* observer) {
   observers_.AddObserver(observer);
 }
 
 void RenderViewImpl::RemoveObserver(RenderViewObserver* observer) {
   observer->RenderViewGone();
   observers_.RemoveObserver(observer);
@@ skipping 157 matching lines @@
 #endif
 #if defined(OS_MACOSX)
     IPC_MESSAGE_HANDLER(ViewMsg_SetInLiveResize, OnSetInLiveResize)
 #endif
     IPC_MESSAGE_HANDLER(ViewMsg_SetHistoryLengthAndPrune,
                         OnSetHistoryLengthAndPrune)
     IPC_MESSAGE_HANDLER(ViewMsg_EnableViewSourceMode, OnEnableViewSourceMode)
     IPC_MESSAGE_HANDLER(ViewMsg_LockMouse_ACK, OnLockMouseACK)
     IPC_MESSAGE_HANDLER(ViewMsg_MouseLockLost, OnMouseLockLost)
     IPC_MESSAGE_HANDLER(JavaBridgeMsg_Init, OnJavaBridgeInit)
+    IPC_MESSAGE_HANDLER(ViewMsg_PostMessage, OnPostMessage)
 
     // Have the super handle all other messages.
     IPC_MESSAGE_UNHANDLED(handled = RenderWidget::OnMessageReceived(message))
   IPC_END_MESSAGE_MAP()
 
   if (!msg_is_ok) {
     // The message had a handler, but its deserialization failed.
     // Kill the renderer to avoid potential spoofing attacks.
     CHECK(false) << "Unable to deserialize message in RenderViewImpl.";
   }
 
   return handled;
 }
 
 void RenderViewImpl::OnNavigate(const ViewMsg_Navigate_Params& params) {
   if (!webview())
     return;
 
   FOR_EACH_OBSERVER(RenderViewObserver, observers_, Navigate(params.url));
 
   bool is_reload = IsReload(params);
 
   // If this is a stale back/forward (due to a recent navigation the browser
   // didn't know about), ignore it.
   if (IsBackForwardToStaleEntry(params, is_reload))
     return;
 
   // Swap this renderer back in if necessary.
-  if (is_swapped_out_)
+  if (is_swapped_out_) {
     SetSwappedOut(false);
+    active_content_frame_id_ = -1;
+  }
 
   history_list_offset_ = params.current_history_list_offset;
   history_list_length_ = params.current_history_list_length;
   if (history_list_length_ >= 0)
     history_page_ids_.resize(history_list_length_, -1);
   if (params.pending_history_list_offset >= 0 &&
       params.pending_history_list_offset < history_list_length_)
     history_page_ids_[params.pending_history_list_offset] = params.page_id;
 
   content::GetContentClient()->SetActiveURL(params.url);
@@ skipping 195 matching lines @@
 }
 
 void RenderViewImpl::OnPasteAndMatchStyle() {
   if (!webview())
     return;
 
   webview()->focusedFrame()->executeCommand(
       WebString::fromUTF8("PasteAndMatchStyle"));
 }
 
+void RenderViewImpl::OnPostMessage(int64 frame_id,
+                                   const ViewMsg_PostMessage_Params& params) {
+  // TODO(supersat): support subframes
+  WebFrame *frame = webview()->mainFrame();
+
+  // We need to check whether we can send this message to the frame, since the
+  // asynchrony of postMessage means that the target frame's origin can change
+  // in the middle of a postMessage dispatch. An empty target origin means that
+  // "*" was passed in, and any target origin is acceptable.
+  if (!params.target_origin.empty()) {
+    WebSecurityOrigin messageSpecifiedOrigin =
+        WebSecurityOrigin::createFromString(WebString(params.target_origin));
+    if (!messageSpecifiedOrigin.isSameSchemeHostPort(
+        frame->document().securityOrigin()))
+      return;
+  }
+
+  WebDOMEvent event = frame->document().createEvent("MessageEvent");
+  WebDOMMessageEvent msgEvent = event.to<WebDOMMessageEvent>();
+
+  // TODO(supersat): fix the source frame parameter
+  msgEvent.initMessageEvent("message",
+                            // |canBubble| and |cancellable| are always false
+                            false, false,
+                            WebSerializedScriptValue::fromString(params.data),
+                            params.source_origin, 0 /* source frame */,
+                            "" /* last event id, not used with postmsg */);
+
+  DLOG(WARNING) << "Dispatching postMessage event";
+  frame->dispatchEvent(msgEvent);
+}
+
 void RenderViewImpl::OnReplace(const string16& text) {
   if (!webview())
     return;
 
   WebFrame* frame = webview()->focusedFrame();
   if (!frame->hasSelection())
     frame->selectWordAroundCaret();
   frame->replaceSelection(text);
 }
 
@@ skipping 384 matching lines @@
 
   RenderViewImpl* view = RenderViewImpl::Create(
       0,
       routing_id_,
       renderer_preferences_,
       webkit_preferences_,
       shared_popup_counter_,
       routing_id,
       cloned_session_storage_namespace_id,
       frame_name,
+      true,
       1);
   view->opened_by_user_gesture_ = params.user_gesture;
 
   // Record whether the creator frame is trying to suppress the opener field.
   view->opener_suppressed_ = opener_suppressed;
 
   // Record the security origin of the creator.
   GURL creator_url(creator->document().securityOrigin().toString().utf8());
   if (!creator_url.is_valid() || !creator_url.IsStandard())
     creator_url = GURL();
@@ skipping 654 matching lines @@
   } else {
     OpenURL(frame, request.url(),
             Referrer(referrer, getReferrerPolicyFromRequest(request)), policy);
   }
 }
 
 WebNavigationPolicy RenderViewImpl::decidePolicyForNavigation(
     WebFrame* frame, const WebURLRequest& request, WebNavigationType type,
     const WebNode&, WebNavigationPolicy default_policy, bool is_redirect) {
   // TODO(creis): Remove this when we fix OnSwapOut to not need a navigation.
+  // TODO(supersat): This currently causes a crash when reloading an app that
+  // opens an out-of-app window
   if (is_swapped_out_) {
     DCHECK(request.url() == GURL("about:swappedout"));
     return default_policy;
   }
 
   // Webkit is asking whether to navigate to a new URL.
   // This is fine normally, except if we're showing UI from one security
   // context and they're trying to navigate to a different context.
   const GURL& url = request.url();
 
@@ skipping 1073 matching lines @@
 void RenderViewImpl::registerIntentService(
     WebKit::WebFrame* frame, const WebKit::WebIntentServiceInfo& service) {
   Send(new IntentsHostMsg_RegisterIntentService(routing_id_,
                                                 service.action(),
                                                 service.type(),
                                                 service.url().spec().utf16(),
                                                 service.title(),
                                                 service.disposition()));
 }
 
+bool RenderViewImpl::willCheckAndDispatchMessageEvent(
+    WebKit::WebFrame* source,
+    WebKit::WebSecurityOrigin target_origin,
+    WebKit::WebDOMMessageEvent event) {
+  if (!is_swapped_out_)
+    return false;
+  DCHECK_NE(active_content_frame_id_, -1);
+
+  ViewMsg_PostMessage_Params params;
+  params.data = event.data().toString();
+  params.source_origin = event.origin();
+  if (!target_origin.isNull())
+    params.target_origin = target_origin.toString();
+
+  Send(new ViewHostMsg_SendPostMessage(
+      active_content_frame_id_, params));
+  return true;
+}
+
 void RenderViewImpl::dispatchIntent(WebKit::WebFrame* frame,
                                     const WebKit::WebIntent& intent) {
   webkit_glue::WebIntentData intent_data(intent);
   Send(new IntentsHostMsg_WebIntentDispatch(
       routing_id_, intent_data, intent.identifier()));
 }
 
 // WebKit::WebPageSerializerClient implementation ------------------------------
 
 void RenderViewImpl::didSerializeDataForFrame(
@@ skipping 906 matching lines @@
 
   // Replace the page with a blank dummy URL.  The unload handler will not be
   // run a second time, thanks to a check in FrameLoader::stopLoading.
   // TODO(creis): Need to add a better way to do this that avoids running the
   // beforeunload handler.  For now, we just run it a second time silently.
   webview()->mainFrame()->loadHTMLString(std::string(),
                                          GURL("about:swappedout"),
                                          GURL("about:swappedout"),
                                          false);
 
+  active_content_frame_id_ = params.content_frame_id;
+
   // Just echo back the params in the ACK.
   Send(new ViewHostMsg_SwapOut_ACK(routing_id_, params));
 }
 
 void RenderViewImpl::OnClosePage() {
   FOR_EACH_OBSERVER(RenderViewObserver, observers_, ClosePage());
   // TODO(creis): We'd rather use webview()->Close() here, but that currently
   // sets the WebView's delegate_ to NULL, preventing any JavaScript dialogs
   // in the onunload handler from appearing.  For now, we're bypassing that and
   // calling the FrameLoader's CloseURL method directly.  This should be
@@ skipping 741 matching lines @@
 bool RenderViewImpl::WebWidgetHandlesCompositorScheduling() const {
   return !!RenderThreadImpl::current()->compositor_thread();
 }
 
 void RenderViewImpl::OnJavaBridgeInit() {
   DCHECK(!java_bridge_dispatcher_.get());
 #if defined(ENABLE_JAVA_BRIDGE)
   java_bridge_dispatcher_.reset(new JavaBridgeDispatcher(this));
 #endif
 }