OOPIF: Fix window.open to work from frames with remote parent.
This CL addresses these remaining issues with that scenario:
1. WebContentsImpl::CreateNewWindow kills a renderer opening a new
window if the renderer's process doesn't match the process for
WebContents' main frame. This CL modifies this check to instead
look at all renderer processes under the current WebContents.
2. The popup was getting created in the wrong SiteInstance,
always using the SiteInstance of the WebContents' main frame rather
than the SiteInstance of the source frame. This CL fixes this by
plumbing the source frame's SiteInstance into
WebContentsImpl::CreateNewWindow.
3. Once created, the popup wasn't being shown. This is because the
message to show it (ViewHostMsg_ShowView) is sent via the opener's
RenderView, which in this case is swapped out. This caused
RenderViewHostImpl::OnShowView to exit early because it checked
is_active_. To fix this, this CL removes this check from ShowView.
Eventually, this IPC should be moved to RenderFrameHost.
BUG=463949,225940
Review URL: https://codereview.chromium.org/1224363002
Cr-Commit-Position: refs/heads/master@{#338949}
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 028eada..38903a01 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -172,6 +172,16 @@
return true;
}
+bool FindMatchingProcess(int render_process_id,
+ bool* did_match_process,
+ FrameTreeNode* node) {
+ if (node->current_frame_host()->GetProcess()->GetID() == render_process_id) {
+ *did_match_process = true;
+ return false;
+ }
+ return true;
+}
+
bool ForEachFrameInternal(
const base::Callback<void(RenderFrameHost*)>& on_frame,
FrameTreeNode* node) {
@@ -1607,7 +1617,7 @@
}
void WebContentsImpl::CreateNewWindow(
- int render_process_id,
+ SiteInstance* source_site_instance,
int route_id,
int main_frame_route_id,
const ViewHostMsg_CreateWindow_Params& params,
@@ -1632,15 +1642,19 @@
DCHECK(!params.opener_suppressed || route_id == MSG_ROUTING_NONE);
scoped_refptr<SiteInstance> site_instance =
- params.opener_suppressed && !is_guest ?
- SiteInstance::CreateForURL(GetBrowserContext(), params.target_url) :
- GetSiteInstance();
+ params.opener_suppressed && !is_guest
+ ? SiteInstance::CreateForURL(GetBrowserContext(), params.target_url)
+ : source_site_instance;
- // A message to create a new window can only come from the active process for
- // this WebContentsImpl instance. If any other process sends the request,
- // it is invalid and the process must be terminated.
- if (GetRenderProcessHost()->GetID() != render_process_id) {
- RenderProcessHost* rph = RenderProcessHost::FromID(render_process_id);
+ // A message to create a new window can only come from a process for a frame
+ // in this WebContents' FrameTree. If any other process sends the request, it
+ // is invalid and the process must be terminated.
+ int render_process_id = source_site_instance->GetProcess()->GetID();
+ bool did_match_process = false;
+ frame_tree_.ForEach(
+ base::Bind(&FindMatchingProcess, render_process_id, &did_match_process));
+ if (!did_match_process) {
+ RenderProcessHost* rph = source_site_instance->GetProcess();
base::ProcessHandle process_handle = rph->GetHandle();
if (process_handle != base::kNullProcessHandle) {
RecordAction(
@@ -1692,7 +1706,7 @@
create_params.routing_id = route_id;
create_params.main_frame_routing_id = main_frame_route_id;
create_params.main_frame_name = params.frame_name;
- create_params.opener_render_process_id = GetRenderProcessHost()->GetID();
+ create_params.opener_render_process_id = render_process_id;
create_params.opener_render_frame_id = params.opener_render_frame_id;
create_params.opener_suppressed = params.opener_suppressed;
if (params.disposition == NEW_BACKGROUND_TAB)
