Refactoring: de-couple Extensions from "script injection System" [render side]:2

extensions/renderer/user_script_injector.cc

Index: extensions/renderer/user_script_injector.cc
diff --git a/extensions/renderer/user_script_injector.cc b/extensions/renderer/user_script_injector.cc
index c3e15ef36e909c4a9cd0ec3568f226e1ce252587..e620a7c65e4ec79b361e9735aa4d4e7b70919a4f 100644
--- a/extensions/renderer/user_script_injector.cc
+++ b/extensions/renderer/user_script_injector.cc
@@ -8,6 +8,7 @@
 
 #include "base/lazy_instance.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/renderer/render_view.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "extensions/renderer/injection_host.h"
@@ -127,15 +128,21 @@ PermissionsData::AccessType UserScriptInjector::CanExecuteOnFrame(
     blink::WebFrame* web_frame,
     int tab_id,
     const GURL& top_url) const {
-  // If we don't have a tab id, we have no UI surface to ask for user consent.
-  // For now, we treat this as an automatic allow.
-  if (tab_id == -1)
-    return PermissionsData::ACCESS_ALLOWED;
-
   GURL effective_document_url = ScriptContext::GetEffectiveDocumentURL(
       web_frame, web_frame->document().url(), script_->match_about_blank());
-  return injection_host->CanExecuteOnFrame(
+  PermissionsData::AccessType can_execute = injection_host->CanExecuteOnFrame(
       effective_document_url, top_url, tab_id, is_declarative_);
+
+  if (script_->consumer_instance_type() !=
+      UserScript::ConsumerInstanceType::WEBVIEW ||

[Devlin, 2015/03/02 20:22:42]

This seems very wrong.  Why are we automatically denying all extension
injections here?

[Xi Han, 2015/03/02 20:30:17]

Hmm? We didn't deny all extensions injection. The logic here is: 
If it is not WEBVIEW, we will return the can_execute directly here. If it is
WEBVIEW and the can_execute is DENIED, we return directly as well. Only for
webview and the host is allowed, we do the following check. 

[Devlin, 2015/03/02 21:08:14]

Huh. I have no idea how I read that so wrong (for some reason in my mind, I saw
return ACCESS_DENIED).  Nevermind.

+      can_execute == PermissionsData::ACCESS_DENIED)
+    return can_execute;
+
+  int routing_id = content::RenderView::FromWebView(web_frame->top()->view())
+                      ->GetRoutingID();
+  return script_->routing_info().render_view_id == routing_id
+      ? PermissionsData::ACCESS_ALLOWED
+      : PermissionsData::ACCESS_DENIED;
 }
 
 std::vector<blink::WebScriptSource> UserScriptInjector::GetJsSources(