src/content/renderer/render_frame_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/renderer/render_frame_impl.h"
   6
   7 #include <map>
   8 #include <string>
   9
  10 #include "base/auto_reset.h"
  11 #include "base/command_line.h"
  12 #include "base/debug/alias.h"
  13 #include "base/debug/asan_invalid_access.h"
  14 #include "base/debug/dump_without_crashing.h"
  15 #include "base/i18n/char_iterator.h"
  16 #include "base/metrics/histogram.h"
  17 #include "base/process/kill.h"
  18 #include "base/process/process.h"
  19 #include "base/strings/string16.h"
  20 #include "base/strings/utf_string_conversions.h"
  21 #include "base/time/time.h"
  22 #include "content/child/appcache/appcache_dispatcher.h"
  23 #include "content/child/plugin_messages.h"
  24 #include "content/child/quota_dispatcher.h"
  25 #include "content/child/request_extra_data.h"
  26 #include "content/child/service_worker/service_worker_network_provider.h"
  27 #include "content/child/service_worker/service_worker_provider_context.h"
  28 #include "content/child/service_worker/web_service_worker_provider_impl.h"
  29 #include "content/child/web_socket_stream_handle_impl.h"
  30 #include "content/child/web_url_request_util.h"
  31 #include "content/child/webmessageportchannel_impl.h"
  32 #include "content/child/websocket_bridge.h"
  33 #include "content/child/weburlresponse_extradata_impl.h"
  34 #include "content/common/clipboard_messages.h"
  35 #include "content/common/frame_messages.h"
  36 #include "content/common/input_messages.h"
  37 #include "content/common/service_worker/service_worker_types.h"
  38 #include "content/common/socket_stream_handle_data.h"
  39 #include "content/common/swapped_out_messages.h"
  40 #include "content/common/view_messages.h"
  41 #include "content/public/common/bindings_policy.h"
  42 #include "content/public/common/content_constants.h"
  43 #include "content/public/common/content_switches.h"
  44 #include "content/public/common/context_menu_params.h"
  45 #include "content/public/common/url_constants.h"
  46 #include "content/public/common/url_utils.h"
  47 #include "content/public/renderer/browser_plugin_delegate.h"
  48 #include "content/public/renderer/content_renderer_client.h"
  49 #include "content/public/renderer/context_menu_client.h"
  50 #include "content/public/renderer/document_state.h"
  51 #include "content/public/renderer/navigation_state.h"
  52 #include "content/public/renderer/render_frame_observer.h"
  53 #include "content/renderer/accessibility/renderer_accessibility.h"
  54 #include "content/renderer/accessibility/renderer_accessibility_complete.h"
  55 #include "content/renderer/accessibility/renderer_accessibility_focus_only.h"
  56 #include "content/renderer/browser_plugin/browser_plugin.h"
  57 #include "content/renderer/browser_plugin/browser_plugin_manager.h"
  58 #include "content/renderer/child_frame_compositing_helper.h"
  59 #include "content/renderer/context_menu_params_builder.h"
  60 #include "content/renderer/devtools/devtools_agent.h"
  61 #include "content/renderer/dom_automation_controller.h"
  62 #include "content/renderer/dom_utils.h"
  63 #include "content/renderer/external_popup_menu.h"
  64 #include "content/renderer/geolocation_dispatcher.h"
  65 #include "content/renderer/history_controller.h"
  66 #include "content/renderer/history_serialization.h"
  67 #include "content/renderer/image_loading_helper.h"
  68 #include "content/renderer/ime_event_guard.h"
  69 #include "content/renderer/internal_document_state_data.h"
  70 #include "content/renderer/manifest/manifest_manager.h"
  71 #include "content/renderer/media/audio_renderer_mixer_manager.h"
  72 #include "content/renderer/media/crypto/encrypted_media_player_support_impl.h"
  73 #include "content/renderer/media/media_stream_dispatcher.h"
  74 #include "content/renderer/media/media_stream_renderer_factory.h"
  75 #include "content/renderer/media/midi_dispatcher.h"
  76 #include "content/renderer/media/render_media_log.h"
  77 #include "content/renderer/media/user_media_client_impl.h"
  78 #include "content/renderer/media/webcontentdecryptionmodule_impl.h"
  79 #include "content/renderer/media/webmediaplayer_ms.h"
  80 #include "content/renderer/notification_permission_dispatcher.h"
  81 #include "content/renderer/notification_provider.h"
  82 #include "content/renderer/npapi/plugin_channel_host.h"
  83 #include "content/renderer/push_messaging_dispatcher.h"
  84 #include "content/renderer/render_frame_proxy.h"
  85 #include "content/renderer/render_process.h"
  86 #include "content/renderer/render_thread_impl.h"
  87 #include "content/renderer/render_view_impl.h"
  88 #include "content/renderer/render_widget_fullscreen_pepper.h"
  89 #include "content/renderer/renderer_webapplicationcachehost_impl.h"
  90 #include "content/renderer/renderer_webcolorchooser_impl.h"
  91 #include "content/renderer/screen_orientation/screen_orientation_dispatcher.h"
  92 #include "content/renderer/shared_worker_repository.h"
  93 #include "content/renderer/v8_value_converter_impl.h"
  94 #include "content/renderer/websharedworker_proxy.h"
  95 #include "media/base/audio_renderer_mixer_input.h"
  96 #include "media/blink/webmediaplayer_impl.h"
  97 #include "media/blink/webmediaplayer_params.h"
  98 #include "media/filters/gpu_video_accelerator_factories.h"
  99 #include "net/base/data_url.h"
 100 #include "net/base/net_errors.h"
 101 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 102 #include "net/http/http_util.h"
 103 #include "third_party/WebKit/public/platform/WebStorageQuotaCallbacks.h"
 104 #include "third_party/WebKit/public/platform/WebString.h"
 105 #include "third_party/WebKit/public/platform/WebURL.h"
 106 #include "third_party/WebKit/public/platform/WebURLError.h"
 107 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 108 #include "third_party/WebKit/public/platform/WebVector.h"
 109 #include "third_party/WebKit/public/web/WebColorSuggestion.h"
 110 #include "third_party/WebKit/public/web/WebDocument.h"
 111 #include "third_party/WebKit/public/web/WebGlyphCache.h"
 112 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 113 #include "third_party/WebKit/public/web/WebMediaStreamRegistry.h"
 114 #include "third_party/WebKit/public/web/WebNavigationPolicy.h"
 115 #include "third_party/WebKit/public/web/WebPlugin.h"
 116 #include "third_party/WebKit/public/web/WebPluginParams.h"
 117 #include "third_party/WebKit/public/web/WebRange.h"
 118 #include "third_party/WebKit/public/web/WebScriptSource.h"
 119 #include "third_party/WebKit/public/web/WebSearchableFormData.h"
 120 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 121 #include "third_party/WebKit/public/web/WebSecurityPolicy.h"
 122 #include "third_party/WebKit/public/web/WebSurroundingText.h"
 123 #include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
 124 #include "third_party/WebKit/public/web/WebView.h"
 125
 126 #if defined(ENABLE_PLUGINS)
 127 #include "content/renderer/npapi/webplugin_impl.h"
 128 #include "content/renderer/pepper/pepper_browser_connection.h"
 129 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 130 #include "content/renderer/pepper/pepper_webplugin_impl.h"
 131 #include "content/renderer/pepper/plugin_module.h"
 132 #endif
 133
 134 #if defined(ENABLE_WEBRTC)
 135 #include "content/renderer/media/rtc_peer_connection_handler.h"
 136 #endif
 137
 138 #if defined(OS_ANDROID)
 139 #include <cpu-features.h>
 140
 141 #include "content/common/gpu/client/context_provider_command_buffer.h"
 142 #include "content/renderer/android/synchronous_compositor_factory.h"
 143 #include "content/renderer/java/gin_java_bridge_dispatcher.h"
 144 #include "content/renderer/media/android/renderer_media_player_manager.h"
 145 #include "content/renderer/media/android/stream_texture_factory_impl.h"
 146 #include "content/renderer/media/android/webmediaplayer_android.h"
 147 #endif
 148
 149 #if defined(ENABLE_BROWSER_CDMS)
 150 #include "content/renderer/media/crypto/renderer_cdm_manager.h"
 151 #endif
 152
 153 #if defined(OS_TIZEN) && defined(ENABLE_MURPHY)
 154 #include "xwalk/tizen/renderer/media/renderer_mediaplayer_manager.h"
 155 #include "xwalk/tizen/renderer/media/mediaplayer_impl.h"
 156 #endif
 157
 158 using blink::WebContextMenuData;
 159 using blink::WebData;
 160 using blink::WebDataSource;
 161 using blink::WebDocument;
 162 using blink::WebElement;
 163 using blink::WebExternalPopupMenu;
 164 using blink::WebExternalPopupMenuClient;
 165 using blink::WebFrame;
 166 using blink::WebHistoryItem;
 167 using blink::WebHTTPBody;
 168 using blink::WebLocalFrame;
 169 using blink::WebMediaPlayer;
 170 using blink::WebMediaPlayerClient;
 171 using blink::WebNavigationPolicy;
 172 using blink::WebNavigationType;
 173 using blink::WebNode;
 174 using blink::WebPluginParams;
 175 using blink::WebPopupMenuInfo;
 176 using blink::WebRange;
 177 using blink::WebReferrerPolicy;
 178 using blink::WebScriptSource;
 179 using blink::WebSearchableFormData;
 180 using blink::WebSecurityOrigin;
 181 using blink::WebSecurityPolicy;
 182 using blink::WebServiceWorkerProvider;
 183 using blink::WebStorageQuotaCallbacks;
 184 using blink::WebString;
 185 using blink::WebURL;
 186 using blink::WebURLError;
 187 using blink::WebURLRequest;
 188 using blink::WebURLResponse;
 189 using blink::WebUserGestureIndicator;
 190 using blink::WebVector;
 191 using blink::WebView;
 192 using base::Time;
 193 using base::TimeDelta;
 194
 195 namespace content {
 196
 197 namespace {
 198
 199 const char kDefaultAcceptHeader[] =
 200     "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/"
 201     "*;q=0.8";
 202 const char kAcceptHeader[] = "Accept";
 203
 204 const size_t kExtraCharsBeforeAndAfterSelection = 100;
 205
 206 typedef std::map<int, RenderFrameImpl*> RoutingIDFrameMap;
 207 static base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
 208     LAZY_INSTANCE_INITIALIZER;
 209
 210 typedef std::map<blink::WebFrame*, RenderFrameImpl*> FrameMap;
 211 base::LazyInstance<FrameMap> g_frame_map = LAZY_INSTANCE_INITIALIZER;
 212
 213 int64 ExtractPostId(const WebHistoryItem& item) {
 214   if (item.isNull())
 215     return -1;
 216
 217   if (item.httpBody().isNull())
 218     return -1;
 219
 220   return item.httpBody().identifier();
 221 }
 222
 223 WebURLResponseExtraDataImpl* GetExtraDataFromResponse(
 224     const WebURLResponse& response) {
 225   return static_cast<WebURLResponseExtraDataImpl*>(response.extraData());
 226 }
 227
 228 void GetRedirectChain(WebDataSource* ds, std::vector<GURL>* result) {
 229   // Replace any occurrences of swappedout:// with about:blank.
 230   const WebURL& blank_url = GURL(url::kAboutBlankURL);
 231   WebVector<WebURL> urls;
 232   ds->redirectChain(urls);
 233   result->reserve(urls.size());
 234   for (size_t i = 0; i < urls.size(); ++i) {
 235     if (urls[i] != GURL(kSwappedOutURL))
 236       result->push_back(urls[i]);
 237     else
 238       result->push_back(blank_url);
 239   }
 240 }
 241
 242 // Returns the original request url. If there is no redirect, the original
 243 // url is the same as ds->request()->url(). If the WebDataSource belongs to a
 244 // frame was loaded by loadData, the original url will be ds->unreachableURL()
 245 static GURL GetOriginalRequestURL(WebDataSource* ds) {
 246   // WebDataSource has unreachable URL means that the frame is loaded through
 247   // blink::WebFrame::loadData(), and the base URL will be in the redirect
 248   // chain. However, we never visited the baseURL. So in this case, we should
 249   // use the unreachable URL as the original URL.
 250   if (ds->hasUnreachableURL())
 251     return ds->unreachableURL();
 252
 253   std::vector<GURL> redirects;
 254   GetRedirectChain(ds, &redirects);
 255   if (!redirects.empty())
 256     return redirects.at(0);
 257
 258   return ds->originalRequest().url();
 259 }
 260
 261 NOINLINE static void CrashIntentionally() {
 262   // NOTE(shess): Crash directly rather than using NOTREACHED() so
 263   // that the signature is easier to triage in crash reports.
 264   volatile int* zero = NULL;
 265   *zero = 0;
 266 }
 267
 268 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 269 NOINLINE static void MaybeTriggerAsanError(const GURL& url) {
 270   // NOTE(rogerm): We intentionally perform an invalid heap access here in
 271   //     order to trigger an Address Sanitizer (ASAN) error report.
 272   const char kCrashDomain[] = "crash";
 273   const char kHeapOverflow[] = "/heap-overflow";
 274   const char kHeapUnderflow[] = "/heap-underflow";
 275   const char kUseAfterFree[] = "/use-after-free";
 276 #if defined(SYZYASAN)
 277   const char kCorruptHeapBlock[] = "/corrupt-heap-block";
 278   const char kCorruptHeap[] = "/corrupt-heap";
 279 #endif
 280
 281   if (!url.DomainIs(kCrashDomain, sizeof(kCrashDomain) - 1))
 282     return;
 283
 284   if (!url.has_path())
 285     return;
 286
 287   std::string crash_type(url.path());
 288   if (crash_type == kHeapOverflow) {
 289     base::debug::AsanHeapOverflow();
 290   } else if (crash_type == kHeapUnderflow ) {
 291     base::debug::AsanHeapUnderflow();
 292   } else if (crash_type == kUseAfterFree) {
 293     base::debug::AsanHeapUseAfterFree();
 294 #if defined(SYZYASAN)
 295   } else if (crash_type == kCorruptHeapBlock) {
 296     base::debug::AsanCorruptHeapBlock();
 297   } else if (crash_type == kCorruptHeap) {
 298     base::debug::AsanCorruptHeap();
 299 #endif
 300   }
 301 }
 302 #endif  // ADDRESS_SANITIZER || SYZYASAN
 303
 304 static void MaybeHandleDebugURL(const GURL& url) {
 305   if (!url.SchemeIs(kChromeUIScheme))
 306     return;
 307   if (url == GURL(kChromeUICrashURL)) {
 308     CrashIntentionally();
 309   } else if (url == GURL(kChromeUIDumpURL)) {
 310     // This URL will only correctly create a crash dump file if content is
 311     // hosted in a process that has correctly called
 312     // base::debug::SetDumpWithoutCrashingFunction.  Refer to the documentation
 313     // of base::debug::DumpWithoutCrashing for more details.
 314     base::debug::DumpWithoutCrashing();
 315   } else if (url == GURL(kChromeUIKillURL)) {
 316     base::KillProcess(base::GetCurrentProcessHandle(), 1, false);
 317   } else if (url == GURL(kChromeUIHangURL)) {
 318     for (;;) {
 319       base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(1));
 320     }
 321   } else if (url == GURL(kChromeUIShorthangURL)) {
 322     base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(20));
 323   }
 324
 325 #if defined(ADDRESS_SANITIZER) || defined(SYZYASAN)
 326   MaybeTriggerAsanError(url);
 327 #endif  // ADDRESS_SANITIZER || SYZYASAN
 328 }
 329
 330 // Returns false unless this is a top-level navigation.
 331 static bool IsTopLevelNavigation(WebFrame* frame) {
 332   return frame->parent() == NULL;
 333 }
 334
 335 // Returns false unless this is a top-level navigation that crosses origins.
 336 static bool IsNonLocalTopLevelNavigation(const GURL& url,
 337                                          WebFrame* frame,
 338                                          WebNavigationType type,
 339                                          bool is_form_post) {
 340   if (!IsTopLevelNavigation(frame))
 341     return false;
 342
 343   // Navigations initiated within Webkit are not sent out to the external host
 344   // in the following cases.
 345   // 1. The url scheme is not http/https
 346   // 2. The origin of the url and the opener is the same in which case the
 347   //    opener relationship is maintained.
 348   // 3. Reloads/form submits/back forward navigations
 349   if (!url.SchemeIs(url::kHttpScheme) && !url.SchemeIs(url::kHttpsScheme))
 350     return false;
 351
 352   if (type != blink::WebNavigationTypeReload &&
 353       type != blink::WebNavigationTypeBackForward && !is_form_post) {
 354     // The opener relationship between the new window and the parent allows the
 355     // new window to script the parent and vice versa. This is not allowed if
 356     // the origins of the two domains are different. This can be treated as a
 357     // top level navigation and routed back to the host.
 358     blink::WebFrame* opener = frame->opener();
 359     if (!opener)
 360       return true;
 361
 362     if (url.GetOrigin() != GURL(opener->document().url()).GetOrigin())
 363       return true;
 364   }
 365   return false;
 366 }
 367
 368 }  // namespace
 369
 370 static RenderFrameImpl* (*g_create_render_frame_impl)(RenderViewImpl*, int32) =
 371     NULL;
 372
 373 // static
 374 RenderFrameImpl* RenderFrameImpl::Create(RenderViewImpl* render_view,
 375                                          int32 routing_id) {
 376   DCHECK(routing_id != MSG_ROUTING_NONE);
 377
 378   if (g_create_render_frame_impl)
 379     return g_create_render_frame_impl(render_view, routing_id);
 380   else
 381     return new RenderFrameImpl(render_view, routing_id);
 382 }
 383
 384 // static
 385 RenderFrameImpl* RenderFrameImpl::FromRoutingID(int32 routing_id) {
 386   RoutingIDFrameMap::iterator iter =
 387       g_routing_id_frame_map.Get().find(routing_id);
 388   if (iter != g_routing_id_frame_map.Get().end())
 389     return iter->second;
 390   return NULL;
 391 }
 392
 393 // static
 394 void RenderFrameImpl::CreateFrame(int routing_id, int parent_routing_id) {
 395   // TODO(nasko): For now, this message is only sent for subframes, as the
 396   // top level frame is created when the RenderView is created through the
 397   // ViewMsg_New IPC.
 398   CHECK_NE(MSG_ROUTING_NONE, parent_routing_id);
 399
 400   RenderFrameProxy* proxy = RenderFrameProxy::FromRoutingID(parent_routing_id);
 401
 402   // If the browser is sending a valid parent routing id, it should already be
 403   // created and registered.
 404   CHECK(proxy);
 405   blink::WebRemoteFrame* parent_web_frame = proxy->web_frame();
 406
 407   // Create the RenderFrame and WebLocalFrame, linking the two.
 408   RenderFrameImpl* render_frame =
 409       RenderFrameImpl::Create(proxy->render_view(), routing_id);
 410   blink::WebLocalFrame* web_frame =
 411       parent_web_frame->createLocalChild("", render_frame);
 412   render_frame->SetWebFrame(web_frame);
 413   render_frame->Initialize();
 414 }
 415
 416 // static
 417 RenderFrame* RenderFrame::FromWebFrame(blink::WebFrame* web_frame) {
 418   return RenderFrameImpl::FromWebFrame(web_frame);
 419 }
 420
 421 // static
 422 RenderFrameImpl* RenderFrameImpl::FromWebFrame(blink::WebFrame* web_frame) {
 423   FrameMap::iterator iter = g_frame_map.Get().find(web_frame);
 424   if (iter != g_frame_map.Get().end())
 425     return iter->second;
 426   return NULL;
 427 }
 428
 429 // static
 430 void RenderFrameImpl::InstallCreateHook(
 431     RenderFrameImpl* (*create_render_frame_impl)(RenderViewImpl*, int32)) {
 432   CHECK(!g_create_render_frame_impl);
 433   g_create_render_frame_impl = create_render_frame_impl;
 434 }
 435
 436 // RenderFrameImpl ----------------------------------------------------------
 437 RenderFrameImpl::RenderFrameImpl(RenderViewImpl* render_view, int routing_id)
 438     : frame_(NULL),
 439       render_view_(render_view->AsWeakPtr()),
 440       routing_id_(routing_id),
 441       is_swapped_out_(false),
 442       render_frame_proxy_(NULL),
 443       is_detaching_(false),
 444       cookie_jar_(this),
 445       selection_text_offset_(0),
 446       selection_range_(gfx::Range::InvalidRange()),
 447       handling_select_range_(false),
 448       notification_permission_dispatcher_(NULL),
 449       notification_provider_(NULL),
 450       web_user_media_client_(NULL),
 451       midi_dispatcher_(NULL),
 452 #if defined(OS_ANDROID)
 453       media_player_manager_(NULL),
 454 #endif
 455 #if defined(ENABLE_BROWSER_CDMS)
 456       cdm_manager_(NULL),
 457 #endif
 458 #if defined(VIDEO_HOLE)
 459       contains_media_player_(false),
 460 #endif
 461 #if defined(OS_TIZEN) && defined(ENABLE_MURPHY)
 462       media_player_manager_(NULL),
 463 #endif
 464       geolocation_dispatcher_(NULL),
 465       push_messaging_dispatcher_(NULL),
 466       screen_orientation_dispatcher_(NULL),
 467       manifest_manager_(NULL),
 468       accessibility_mode_(AccessibilityModeOff),
 469       renderer_accessibility_(NULL),
 470       weak_factory_(this) {
 471   std::pair<RoutingIDFrameMap::iterator, bool> result =
 472       g_routing_id_frame_map.Get().insert(std::make_pair(routing_id_, this));
 473   CHECK(result.second) << "Inserting a duplicate item.";
 474
 475   RenderThread::Get()->AddRoute(routing_id_, this);
 476
 477   render_view_->RegisterRenderFrame(this);
 478
 479 #if defined(OS_ANDROID)
 480   new GinJavaBridgeDispatcher(this);
 481 #endif
 482
 483 #if defined(ENABLE_NOTIFICATIONS)
 484   notification_provider_ = new NotificationProvider(this);
 485 #endif
 486
 487   manifest_manager_ = new ManifestManager(this);
 488 }
 489
 490 RenderFrameImpl::~RenderFrameImpl() {
 491   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, RenderFrameGone());
 492   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnDestruct());
 493
 494 #if defined(VIDEO_HOLE)
 495   if (contains_media_player_)
 496     render_view_->UnregisterVideoHoleFrame(this);
 497 #endif
 498
 499   render_view_->UnregisterRenderFrame(this);
 500   g_routing_id_frame_map.Get().erase(routing_id_);
 501   RenderThread::Get()->RemoveRoute(routing_id_);
 502 }
 503
 504 void RenderFrameImpl::SetWebFrame(blink::WebLocalFrame* web_frame) {
 505   DCHECK(!frame_);
 506
 507   std::pair<FrameMap::iterator, bool> result = g_frame_map.Get().insert(
 508       std::make_pair(web_frame, this));
 509   CHECK(result.second) << "Inserting a duplicate item.";
 510
 511   frame_ = web_frame;
 512 }
 513
 514 void RenderFrameImpl::Initialize() {
 515 #if defined(ENABLE_PLUGINS)
 516   new PepperBrowserConnection(this);
 517 #endif
 518   new SharedWorkerRepository(this);
 519
 520   if (!frame_->parent())
 521     new ImageLoadingHelper(this);
 522
 523   // We delay calling this until we have the WebFrame so that any observer or
 524   // embedder can call GetWebFrame on any RenderFrame.
 525   GetContentClient()->renderer()->RenderFrameCreated(this);
 526 }
 527
 528 RenderWidget* RenderFrameImpl::GetRenderWidget() {
 529   return render_view_.get();
 530 }
 531
 532 #if defined(ENABLE_PLUGINS)
 533 void RenderFrameImpl::PepperPluginCreated(RendererPpapiHost* host) {
 534   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
 535                     DidCreatePepperPlugin(host));
 536 }
 537
 538 void RenderFrameImpl::PepperDidChangeCursor(
 539     PepperPluginInstanceImpl* instance,
 540     const blink::WebCursorInfo& cursor) {
 541   // Update the cursor appearance immediately if the requesting plugin is the
 542   // one which receives the last mouse event. Otherwise, the new cursor won't be
 543   // picked up until the plugin gets the next input event. That is bad if, e.g.,
 544   // the plugin would like to set an invisible cursor when there isn't any user
 545   // input for a while.
 546   if (instance == render_view_->pepper_last_mouse_event_target())
 547     GetRenderWidget()->didChangeCursor(cursor);
 548 }
 549
 550 void RenderFrameImpl::PepperDidReceiveMouseEvent(
 551     PepperPluginInstanceImpl* instance) {
 552   render_view_->set_pepper_last_mouse_event_target(instance);
 553 }
 554
 555 void RenderFrameImpl::PepperTextInputTypeChanged(
 556     PepperPluginInstanceImpl* instance) {
 557   if (instance != render_view_->focused_pepper_plugin())
 558     return;
 559
 560   GetRenderWidget()->UpdateTextInputType();
 561   if (renderer_accessibility())
 562     renderer_accessibility()->FocusedNodeChanged(WebNode());
 563 }
 564
 565 void RenderFrameImpl::PepperCaretPositionChanged(
 566     PepperPluginInstanceImpl* instance) {
 567   if (instance != render_view_->focused_pepper_plugin())
 568     return;
 569   GetRenderWidget()->UpdateSelectionBounds();
 570 }
 571
 572 void RenderFrameImpl::PepperCancelComposition(
 573     PepperPluginInstanceImpl* instance) {
 574   if (instance != render_view_->focused_pepper_plugin())
 575     return;
 576   Send(new InputHostMsg_ImeCancelComposition(render_view_->GetRoutingID()));;
 577 #if defined(OS_MACOSX) || defined(USE_AURA)
 578   GetRenderWidget()->UpdateCompositionInfo(true);
 579 #endif
 580 }
 581
 582 void RenderFrameImpl::PepperSelectionChanged(
 583     PepperPluginInstanceImpl* instance) {
 584   if (instance != render_view_->focused_pepper_plugin())
 585     return;
 586   SyncSelectionIfRequired();
 587 }
 588
 589 RenderWidgetFullscreenPepper* RenderFrameImpl::CreatePepperFullscreenContainer(
 590     PepperPluginInstanceImpl* plugin) {
 591   GURL active_url;
 592   if (render_view_->webview() && render_view_->webview()->mainFrame())
 593     active_url = GURL(render_view_->webview()->mainFrame()->document().url());
 594   RenderWidgetFullscreenPepper* widget = RenderWidgetFullscreenPepper::Create(
 595       GetRenderWidget()->routing_id(), plugin, active_url,
 596       GetRenderWidget()->screenInfo());
 597   widget->show(blink::WebNavigationPolicyIgnore);
 598   return widget;
 599 }
 600
 601 bool RenderFrameImpl::IsPepperAcceptingCompositionEvents() const {
 602   if (!render_view_->focused_pepper_plugin())
 603     return false;
 604   return render_view_->focused_pepper_plugin()->
 605       IsPluginAcceptingCompositionEvents();
 606 }
 607
 608 void RenderFrameImpl::PluginCrashed(const base::FilePath& plugin_path,
 609                                    base::ProcessId plugin_pid) {
 610   // TODO(jam): dispatch this IPC in RenderFrameHost and switch to use
 611   // routing_id_ as a result.
 612   Send(new FrameHostMsg_PluginCrashed(routing_id_, plugin_path, plugin_pid));
 613 }
 614
 615 void RenderFrameImpl::SimulateImeSetComposition(
 616     const base::string16& text,
 617     const std::vector<blink::WebCompositionUnderline>& underlines,
 618     int selection_start,
 619     int selection_end) {
 620   render_view_->OnImeSetComposition(
 621       text, underlines, selection_start, selection_end);
 622 }
 623
 624 void RenderFrameImpl::SimulateImeConfirmComposition(
 625     const base::string16& text,
 626     const gfx::Range& replacement_range) {
 627   render_view_->OnImeConfirmComposition(text, replacement_range, false);
 628 }
 629
 630
 631 void RenderFrameImpl::OnImeSetComposition(
 632     const base::string16& text,
 633     const std::vector<blink::WebCompositionUnderline>& underlines,
 634     int selection_start,
 635     int selection_end) {
 636   // When a PPAPI plugin has focus, we bypass WebKit.
 637   if (!IsPepperAcceptingCompositionEvents()) {
 638     pepper_composition_text_ = text;
 639   } else {
 640     // TODO(kinaba) currently all composition events are sent directly to
 641     // plugins. Use DOM event mechanism after WebKit is made aware about
 642     // plugins that support composition.
 643     // The code below mimics the behavior of WebCore::Editor::setComposition.
 644
 645     // Empty -> nonempty: composition started.
 646     if (pepper_composition_text_.empty() && !text.empty()) {
 647       render_view_->focused_pepper_plugin()->HandleCompositionStart(
 648           base::string16());
 649     }
 650     // Nonempty -> empty: composition canceled.
 651     if (!pepper_composition_text_.empty() && text.empty()) {
 652       render_view_->focused_pepper_plugin()->HandleCompositionEnd(
 653           base::string16());
 654     }
 655     pepper_composition_text_ = text;
 656     // Nonempty: composition is ongoing.
 657     if (!pepper_composition_text_.empty()) {
 658       render_view_->focused_pepper_plugin()->HandleCompositionUpdate(
 659           pepper_composition_text_, underlines, selection_start,
 660           selection_end);
 661     }
 662   }
 663 }
 664
 665 void RenderFrameImpl::OnImeConfirmComposition(
 666     const base::string16& text,
 667     const gfx::Range& replacement_range,
 668     bool keep_selection) {
 669   // When a PPAPI plugin has focus, we bypass WebKit.
 670   // Here, text.empty() has a special meaning. It means to commit the last
 671   // update of composition text (see
 672   // RenderWidgetHost::ImeConfirmComposition()).
 673   const base::string16& last_text = text.empty() ? pepper_composition_text_
 674                                                  : text;
 675
 676   // last_text is empty only when both text and pepper_composition_text_ is.
 677   // Ignore it.
 678   if (last_text.empty())
 679     return;
 680
 681   if (!IsPepperAcceptingCompositionEvents()) {
 682     base::i18n::UTF16CharIterator iterator(&last_text);
 683     int32 i = 0;
 684     while (iterator.Advance()) {
 685       blink::WebKeyboardEvent char_event;
 686       char_event.type = blink::WebInputEvent::Char;
 687       char_event.timeStampSeconds = base::Time::Now().ToDoubleT();
 688       char_event.modifiers = 0;
 689       char_event.windowsKeyCode = last_text[i];
 690       char_event.nativeKeyCode = last_text[i];
 691
 692       const int32 char_start = i;
 693       for (; i < iterator.array_pos(); ++i) {
 694         char_event.text[i - char_start] = last_text[i];
 695         char_event.unmodifiedText[i - char_start] = last_text[i];
 696       }
 697
 698       if (GetRenderWidget()->webwidget())
 699         GetRenderWidget()->webwidget()->handleInputEvent(char_event);
 700     }
 701   } else {
 702     // Mimics the order of events sent by WebKit.
 703     // See WebCore::Editor::setComposition() for the corresponding code.
 704     render_view_->focused_pepper_plugin()->HandleCompositionEnd(last_text);
 705     render_view_->focused_pepper_plugin()->HandleTextInput(last_text);
 706   }
 707   pepper_composition_text_.clear();
 708 }
 709
 710 #endif  // ENABLE_PLUGINS
 711
 712 MediaStreamDispatcher* RenderFrameImpl::GetMediaStreamDispatcher() {
 713   if (!web_user_media_client_)
 714     InitializeUserMediaClient();
 715   return web_user_media_client_ ?
 716       web_user_media_client_->media_stream_dispatcher() : NULL;
 717 }
 718
 719 bool RenderFrameImpl::Send(IPC::Message* message) {
 720   if (is_detaching_) {
 721     delete message;
 722     return false;
 723   }
 724   if (frame_->parent() == NULL &&
 725       (is_swapped_out_ || render_view_->is_swapped_out())) {
 726     if (!SwappedOutMessages::CanSendWhileSwappedOut(message)) {
 727       delete message;
 728       return false;
 729     }
 730
 731     // In most cases, send IPCs through the proxy when swapped out. In some
 732     // calls the associated RenderViewImpl routing id is used to send
 733     // messages, so don't use the proxy.
 734     if (render_frame_proxy_ && message->routing_id() == routing_id_)
 735       return render_frame_proxy_->Send(message);
 736   }
 737
 738   return RenderThread::Get()->Send(message);
 739 }
 740
 741 #if defined(OS_MACOSX) || defined(OS_ANDROID)
 742 void RenderFrameImpl::DidHideExternalPopupMenu() {
 743   // We need to clear external_popup_menu_ as soon as ExternalPopupMenu::close
 744   // is called. Otherwise, createExternalPopupMenu() for new popup will fail.
 745   external_popup_menu_.reset();
 746 }
 747 #endif
 748
 749 bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
 750   // TODO(kenrb): document() should not be null, but as a transitional step
 751   // we have RenderFrameProxy 'wrapping' a RenderFrameImpl, passing messages
 752   // to this method. This happens for a top-level remote frame, where a
 753   // document-less RenderFrame is replaced by a RenderFrameProxy but kept
 754   // around and is still able to receive messages.
 755   if (!frame_->document().isNull())
 756     GetContentClient()->SetActiveURL(frame_->document().url());
 757
 758   ObserverListBase<RenderFrameObserver>::Iterator it(observers_);
 759   RenderFrameObserver* observer;
 760   while ((observer = it.GetNext()) != NULL) {
 761     if (observer->OnMessageReceived(msg))
 762       return true;
 763   }
 764
 765   bool handled = true;
 766   IPC_BEGIN_MESSAGE_MAP(RenderFrameImpl, msg)
 767     IPC_MESSAGE_HANDLER(FrameMsg_Navigate, OnNavigate)
 768     IPC_MESSAGE_HANDLER(FrameMsg_BeforeUnload, OnBeforeUnload)
 769     IPC_MESSAGE_HANDLER(FrameMsg_SwapOut, OnSwapOut)
 770     IPC_MESSAGE_HANDLER(FrameMsg_Stop, OnStop)
 771     IPC_MESSAGE_HANDLER(FrameMsg_ContextMenuClosed, OnContextMenuClosed)
 772     IPC_MESSAGE_HANDLER(FrameMsg_CustomContextMenuAction,
 773                         OnCustomContextMenuAction)
 774     IPC_MESSAGE_HANDLER(InputMsg_Undo, OnUndo)
 775     IPC_MESSAGE_HANDLER(InputMsg_Redo, OnRedo)
 776     IPC_MESSAGE_HANDLER(InputMsg_Cut, OnCut)
 777     IPC_MESSAGE_HANDLER(InputMsg_Copy, OnCopy)
 778     IPC_MESSAGE_HANDLER(InputMsg_Paste, OnPaste)
 779     IPC_MESSAGE_HANDLER(InputMsg_PasteAndMatchStyle, OnPasteAndMatchStyle)
 780     IPC_MESSAGE_HANDLER(InputMsg_Delete, OnDelete)
 781     IPC_MESSAGE_HANDLER(InputMsg_SelectAll, OnSelectAll)
 782     IPC_MESSAGE_HANDLER(InputMsg_SelectRange, OnSelectRange)
 783     IPC_MESSAGE_HANDLER(InputMsg_Unselect, OnUnselect)
 784     IPC_MESSAGE_HANDLER(InputMsg_Replace, OnReplace)
 785     IPC_MESSAGE_HANDLER(InputMsg_ReplaceMisspelling, OnReplaceMisspelling)
 786     IPC_MESSAGE_HANDLER(InputMsg_ExtendSelectionAndDelete,
 787                         OnExtendSelectionAndDelete)
 788     IPC_MESSAGE_HANDLER(InputMsg_SetCompositionFromExistingText,
 789                         OnSetCompositionFromExistingText)
 790     IPC_MESSAGE_HANDLER(FrameMsg_CSSInsertRequest, OnCSSInsertRequest)
 791     IPC_MESSAGE_HANDLER(FrameMsg_JavaScriptExecuteRequest,
 792                         OnJavaScriptExecuteRequest)
 793     IPC_MESSAGE_HANDLER(FrameMsg_JavaScriptExecuteRequestForTests,
 794                         OnJavaScriptExecuteRequestForTests)
 795     IPC_MESSAGE_HANDLER(FrameMsg_SetEditableSelectionOffsets,
 796                         OnSetEditableSelectionOffsets)
 797     IPC_MESSAGE_HANDLER(FrameMsg_SetupTransitionView, OnSetupTransitionView)
 798     IPC_MESSAGE_HANDLER(FrameMsg_BeginExitTransition, OnBeginExitTransition)
 799     IPC_MESSAGE_HANDLER(FrameMsg_Reload, OnReload)
 800     IPC_MESSAGE_HANDLER(FrameMsg_TextSurroundingSelectionRequest,
 801                         OnTextSurroundingSelectionRequest)
 802     IPC_MESSAGE_HANDLER(FrameMsg_AddStyleSheetByURL,
 803                         OnAddStyleSheetByURL)
 804     IPC_MESSAGE_HANDLER(FrameMsg_SetAccessibilityMode,
 805                         OnSetAccessibilityMode)
 806     IPC_MESSAGE_HANDLER(FrameMsg_DisownOpener, OnDisownOpener)
 807 #if defined(OS_ANDROID)
 808     IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItems, OnSelectPopupMenuItems)
 809 #elif defined(OS_MACOSX)
 810     IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItem, OnSelectPopupMenuItem)
 811     IPC_MESSAGE_HANDLER(InputMsg_CopyToFindPboard, OnCopyToFindPboard)
 812 #endif
 813   IPC_END_MESSAGE_MAP()
 814
 815   return handled;
 816 }
 817
 818 void RenderFrameImpl::OnNavigate(const FrameMsg_Navigate_Params& params) {
 819   TRACE_EVENT2("navigation", "RenderFrameImpl::OnNavigate",
 820                "id", routing_id_, "url", params.url.possibly_invalid_spec());
 821   MaybeHandleDebugURL(params.url);
 822   if (!render_view_->webview())
 823     return;
 824
 825   FOR_EACH_OBSERVER(
 826       RenderViewObserver, render_view_->observers_, Navigate(params.url));
 827
 828   bool is_reload = RenderViewImpl::IsReload(params);
 829   WebURLRequest::CachePolicy cache_policy =
 830       WebURLRequest::UseProtocolCachePolicy;
 831
 832   // If this is a stale back/forward (due to a recent navigation the browser
 833   // didn't know about), ignore it.
 834   if (render_view_->IsBackForwardToStaleEntry(params, is_reload))
 835     return;
 836
 837   // Swap this renderer back in if necessary.
 838   if (render_view_->is_swapped_out_ &&
 839       GetWebFrame() == render_view_->webview()->mainFrame()) {
 840     // We marked the view as hidden when swapping the view out, so be sure to
 841     // reset the visibility state before navigating to the new URL.
 842     render_view_->webview()->setVisibilityState(
 843         render_view_->visibilityState(), false);
 844
 845     // If this is an attempt to reload while we are swapped out, we should not
 846     // reload swappedout://, but the previous page, which is stored in
 847     // params.state.  Setting is_reload to false will treat this like a back
 848     // navigation to accomplish that.
 849     is_reload = false;
 850     cache_policy = WebURLRequest::ReloadIgnoringCacheData;
 851
 852     // We refresh timezone when a view is swapped in since timezone
 853     // can get out of sync when the system timezone is updated while
 854     // the view is swapped out.
 855     RenderThreadImpl::NotifyTimezoneChange();
 856
 857     render_view_->SetSwappedOut(false);
 858     is_swapped_out_ = false;
 859   }
 860
 861   if (params.should_clear_history_list) {
 862     CHECK_EQ(params.pending_history_list_offset, -1);
 863     CHECK_EQ(params.current_history_list_offset, -1);
 864     CHECK_EQ(params.current_history_list_length, 0);
 865   }
 866   render_view_->history_list_offset_ = params.current_history_list_offset;
 867   render_view_->history_list_length_ = params.current_history_list_length;
 868   if (render_view_->history_list_length_ >= 0) {
 869     render_view_->history_page_ids_.resize(
 870         render_view_->history_list_length_, -1);
 871   }
 872   if (params.pending_history_list_offset >= 0 &&
 873       params.pending_history_list_offset < render_view_->history_list_length_) {
 874     render_view_->history_page_ids_[params.pending_history_list_offset] =
 875         params.page_id;
 876   }
 877
 878   GetContentClient()->SetActiveURL(params.url);
 879
 880   WebFrame* frame = frame_;
 881   if (!params.frame_to_navigate.empty()) {
 882     // TODO(nasko): Move this lookup to the browser process.
 883     frame = render_view_->webview()->findFrameByName(
 884         WebString::fromUTF8(params.frame_to_navigate));
 885     CHECK(frame) << "Invalid frame name passed: " << params.frame_to_navigate;
 886   }
 887
 888   if (is_reload && !render_view_->history_controller()->GetCurrentEntry()) {
 889     // We cannot reload if we do not have any history state.  This happens, for
 890     // example, when recovering from a crash.
 891     is_reload = false;
 892     cache_policy = WebURLRequest::ReloadIgnoringCacheData;
 893   }
 894
 895   render_view_->pending_navigation_params_.reset(
 896       new FrameMsg_Navigate_Params(params));
 897
 898   // If we are reloading, then WebKit will use the history state of the current
 899   // page, so we should just ignore any given history state.  Otherwise, if we
 900   // have history state, then we need to navigate to it, which corresponds to a
 901   // back/forward navigation event.
 902   if (is_reload) {
 903     bool reload_original_url =
 904         (params.navigation_type ==
 905             FrameMsg_Navigate_Type::RELOAD_ORIGINAL_REQUEST_URL);
 906     bool ignore_cache = (params.navigation_type ==
 907                              FrameMsg_Navigate_Type::RELOAD_IGNORING_CACHE);
 908
 909     if (reload_original_url)
 910       frame->reloadWithOverrideURL(params.url, true);
 911     else
 912       frame->reload(ignore_cache);
 913   } else if (params.page_state.IsValid()) {
 914     // We must know the page ID of the page we are navigating back to.
 915     DCHECK_NE(params.page_id, -1);
 916     scoped_ptr<HistoryEntry> entry =
 917         PageStateToHistoryEntry(params.page_state);
 918     if (entry) {
 919       // Ensure we didn't save the swapped out URL in UpdateState, since the
 920       // browser should never be telling us to navigate to swappedout://.
 921       CHECK(entry->root().urlString() != WebString::fromUTF8(kSwappedOutURL));
 922       render_view_->history_controller()->GoToEntry(entry.Pass(), cache_policy);
 923     }
 924   } else if (!params.base_url_for_data_url.is_empty()) {
 925     // A loadData request with a specified base URL.
 926     std::string mime_type, charset, data;
 927     if (net::DataURL::Parse(params.url, &mime_type, &charset, &data)) {
 928       frame->loadData(
 929           WebData(data.c_str(), data.length()),
 930           WebString::fromUTF8(mime_type),
 931           WebString::fromUTF8(charset),
 932           params.base_url_for_data_url,
 933           params.history_url_for_data_url,
 934           false);
 935     } else {
 936       CHECK(false) <<
 937           "Invalid URL passed: " << params.url.possibly_invalid_spec();
 938     }
 939   } else {
 940     // Navigate to the given URL.
 941     WebURLRequest request(params.url);
 942
 943     // A session history navigation should have been accompanied by state.
 944     CHECK_EQ(params.page_id, -1);
 945
 946     if (frame->isViewSourceModeEnabled())
 947       request.setCachePolicy(WebURLRequest::ReturnCacheDataElseLoad);
 948
 949     if (params.referrer.url.is_valid()) {
 950       WebString referrer = WebSecurityPolicy::generateReferrerHeader(
 951           params.referrer.policy,
 952           params.url,
 953           WebString::fromUTF8(params.referrer.url.spec()));
 954       if (!referrer.isEmpty())
 955         request.setHTTPReferrer(referrer, params.referrer.policy);
 956     }
 957
 958     if (!params.extra_headers.empty()) {
 959       for (net::HttpUtil::HeadersIterator i(params.extra_headers.begin(),
 960                                             params.extra_headers.end(), "\n");
 961            i.GetNext(); ) {
 962         request.addHTTPHeaderField(WebString::fromUTF8(i.name()),
 963                                    WebString::fromUTF8(i.values()));
 964       }
 965     }
 966
 967     if (params.is_post) {
 968       request.setHTTPMethod(WebString::fromUTF8("POST"));
 969
 970       // Set post data.
 971       WebHTTPBody http_body;
 972       http_body.initialize();
 973       const char* data = NULL;
 974       if (params.browser_initiated_post_data.size()) {
 975         data = reinterpret_cast<const char*>(
 976             &params.browser_initiated_post_data.front());
 977       }
 978       http_body.appendData(
 979           WebData(data, params.browser_initiated_post_data.size()));
 980       request.setHTTPBody(http_body);
 981     }
 982
 983     // Record this before starting the load, we need a lower bound of this time
 984     // to sanitize the navigationStart override set below.
 985     base::TimeTicks renderer_navigation_start = base::TimeTicks::Now();
 986     frame->loadRequest(request);
 987
 988     // The browser provides the navigation_start time to bootstrap the
 989     // Navigation Timing information for the browser-initiated navigations. In
 990     // case of cross-process navigations, this carries over the time of
 991     // finishing the onbeforeunload handler of the previous page.
 992     DCHECK(!params.browser_navigation_start.is_null());
 993     if (frame->provisionalDataSource()) {
 994       // |browser_navigation_start| is likely before this process existed, so we
 995       // can't use InterProcessTimeTicksConverter. We need at least to ensure
 996       // that the browser-side navigation start we set is not later than the one
 997       // on the renderer side.
 998       base::TimeTicks navigation_start = std::min(
 999           params.browser_navigation_start, renderer_navigation_start);
1000       double navigation_start_seconds =
1001           (navigation_start - base::TimeTicks()).InSecondsF();
1002       frame->provisionalDataSource()->setNavigationStartTime(
1003           navigation_start_seconds);
1004     }
1005   }
1006
1007   // In case LoadRequest failed before DidCreateDataSource was called.
1008   render_view_->pending_navigation_params_.reset();
1009 }
1010
1011 void RenderFrameImpl::BindServiceRegistry(
1012     mojo::ScopedMessagePipeHandle service_provider_handle) {
1013   service_registry_.BindRemoteServiceProvider(service_provider_handle.Pass());
1014 }
1015
1016 void RenderFrameImpl::OnBeforeUnload() {
1017   TRACE_EVENT1("navigation", "RenderFrameImpl::OnBeforeUnload",
1018                "id", routing_id_);
1019   // TODO(creis): Right now, this is only called on the main frame.  Make the
1020   // browser process send dispatchBeforeUnloadEvent to every frame that needs
1021   // it.
1022   CHECK(!frame_->parent());
1023
1024   base::TimeTicks before_unload_start_time = base::TimeTicks::Now();
1025   bool proceed = frame_->dispatchBeforeUnloadEvent();
1026   base::TimeTicks before_unload_end_time = base::TimeTicks::Now();
1027   Send(new FrameHostMsg_BeforeUnload_ACK(routing_id_, proceed,
1028                                          before_unload_start_time,
1029                                          before_unload_end_time));
1030 }
1031
1032 void RenderFrameImpl::OnSwapOut(int proxy_routing_id) {
1033   TRACE_EVENT1("navigation", "RenderFrameImpl::OnSwapOut", "id", routing_id_);
1034   RenderFrameProxy* proxy = NULL;
1035   bool is_site_per_process =
1036       CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess);
1037   bool is_main_frame = !frame_->parent();
1038
1039   // Only run unload if we're not swapped out yet, but send the ack either way.
1040   if (!is_swapped_out_ || !render_view_->is_swapped_out_) {
1041     // Swap this RenderFrame out so the frame can navigate to a page rendered by
1042     // a different process.  This involves running the unload handler and
1043     // clearing the page.  We also allow this process to exit if there are no
1044     // other active RenderFrames in it.
1045
1046     // Send an UpdateState message before we get swapped out. Create the
1047     // RenderFrameProxy as well so its routing id is registered for receiving
1048     // IPC messages.
1049     render_view_->SyncNavigationState();
1050     proxy = RenderFrameProxy::CreateProxyToReplaceFrame(this,
1051                                                         proxy_routing_id);
1052
1053     // Synchronously run the unload handler before sending the ACK.
1054     // TODO(creis): Call dispatchUnloadEvent unconditionally here to support
1055     // unload on subframes as well.
1056     if (is_main_frame)
1057       frame_->dispatchUnloadEvent();
1058
1059     // Swap out and stop sending any IPC messages that are not ACKs.
1060     // TODO(nasko): Do we need RenderFrameImpl::is_swapped_out_ anymore?
1061     if (is_main_frame)
1062       render_view_->SetSwappedOut(true);
1063     is_swapped_out_ = true;
1064
1065     // Now that we're swapped out and filtering IPC messages, stop loading to
1066     // ensure that no other in-progress navigation continues.  We do this here
1067     // to avoid sending a DidStopLoading message to the browser process.
1068     // TODO(creis): Should we be stopping all frames here and using
1069     // StopAltErrorPageFetcher with RenderView::OnStop, or just stopping this
1070     // frame?
1071     OnStop();
1072
1073     // Transfer settings such as initial drawing parameters to the remote frame
1074     // that will replace this frame.
1075     if (!is_main_frame)
1076       proxy->web_frame()->initializeFromFrame(frame_);
1077
1078     // Replace the page with a blank dummy URL. The unload handler will not be
1079     // run a second time, thanks to a check in FrameLoader::stopLoading.
1080     // TODO(creis): Need to add a better way to do this that avoids running the
1081     // beforeunload handler. For now, we just run it a second time silently.
1082     if (!is_site_per_process || is_main_frame)
1083       render_view_->NavigateToSwappedOutURL(frame_);
1084
1085     // Let WebKit know that this view is hidden so it can drop resources and
1086     // stop compositing.
1087     // TODO(creis): Support this for subframes as well.
1088     if (is_main_frame) {
1089       render_view_->webview()->setVisibilityState(
1090           blink::WebPageVisibilityStateHidden, false);
1091     }
1092   }
1093
1094   // It is now safe to show modal dialogs again.
1095   // TODO(creis): Deal with modal dialogs from subframes.
1096   if (is_main_frame)
1097     render_view_->suppress_dialogs_until_swap_out_ = false;
1098
1099   Send(new FrameHostMsg_SwapOut_ACK(routing_id_));
1100
1101   // Now that all of the cleanup is complete and the browser side is notified,
1102   // start using the RenderFrameProxy, if one is created.
1103   if (proxy) {
1104     if (!is_main_frame) {
1105       frame_->swap(proxy->web_frame());
1106       if (is_site_per_process) {
1107         // TODO(nasko): delete the frame here, since we've replaced it with a
1108         // proxy.
1109       }
1110     } else {
1111       set_render_frame_proxy(proxy);
1112     }
1113   }
1114
1115   // Safe to exit if no one else is using the process.
1116   if (is_main_frame)
1117     render_view_->WasSwappedOut();
1118 }
1119
1120 void RenderFrameImpl::OnContextMenuClosed(
1121     const CustomContextMenuContext& custom_context) {
1122   if (custom_context.request_id) {
1123     // External request, should be in our map.
1124     ContextMenuClient* client =
1125         pending_context_menus_.Lookup(custom_context.request_id);
1126     if (client) {
1127       client->OnMenuClosed(custom_context.request_id);
1128       pending_context_menus_.Remove(custom_context.request_id);
1129     }
1130   } else {
1131     if (custom_context.link_followed.is_valid()) {
1132         frame_->sendPings(
1133             DomUtils::ExtractParentAnchorNode(context_menu_node_),
1134             custom_context.link_followed);
1135     }
1136     // Internal request, forward to WebKit.
1137     context_menu_node_.reset();
1138   }
1139 }
1140
1141 void RenderFrameImpl::OnCustomContextMenuAction(
1142     const CustomContextMenuContext& custom_context,
1143     unsigned action) {
1144   if (custom_context.request_id) {
1145     // External context menu request, look in our map.
1146     ContextMenuClient* client =
1147         pending_context_menus_.Lookup(custom_context.request_id);
1148     if (client)
1149       client->OnMenuAction(custom_context.request_id, action);
1150   } else {
1151     // Internal request, forward to WebKit.
1152     render_view_->webview()->performCustomContextMenuAction(action);
1153   }
1154 }
1155
1156 void RenderFrameImpl::OnUndo() {
1157   frame_->executeCommand(WebString::fromUTF8("Undo"), GetFocusedElement());
1158 }
1159
1160 void RenderFrameImpl::OnRedo() {
1161   frame_->executeCommand(WebString::fromUTF8("Redo"), GetFocusedElement());
1162 }
1163
1164 void RenderFrameImpl::OnCut() {
1165   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1166   frame_->executeCommand(WebString::fromUTF8("Cut"), GetFocusedElement());
1167 }
1168
1169 void RenderFrameImpl::OnCopy() {
1170   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1171   WebNode current_node = context_menu_node_.isNull() ?
1172       GetFocusedElement() : context_menu_node_;
1173   frame_->executeCommand(WebString::fromUTF8("Copy"), current_node);
1174 }
1175
1176 void RenderFrameImpl::OnPaste() {
1177   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1178   frame_->executeCommand(WebString::fromUTF8("Paste"), GetFocusedElement());
1179 }
1180
1181 void RenderFrameImpl::OnPasteAndMatchStyle() {
1182   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1183   frame_->executeCommand(
1184       WebString::fromUTF8("PasteAndMatchStyle"), GetFocusedElement());
1185 }
1186
1187 #if defined(OS_MACOSX)
1188 void RenderFrameImpl::OnCopyToFindPboard() {
1189   // Since the find pasteboard supports only plain text, this can be simpler
1190   // than the |OnCopy()| case.
1191   if (frame_->hasSelection()) {
1192     base::string16 selection = frame_->selectionAsText();
1193     RenderThread::Get()->Send(
1194         new ClipboardHostMsg_FindPboardWriteStringAsync(selection));
1195   }
1196 }
1197 #endif
1198
1199 void RenderFrameImpl::OnDelete() {
1200   frame_->executeCommand(WebString::fromUTF8("Delete"), GetFocusedElement());
1201 }
1202
1203 void RenderFrameImpl::OnSelectAll() {
1204   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1205   frame_->executeCommand(WebString::fromUTF8("SelectAll"), GetFocusedElement());
1206 }
1207
1208 void RenderFrameImpl::OnSelectRange(const gfx::Point& start,
1209                                     const gfx::Point& end) {
1210   // This IPC is dispatched by RenderWidgetHost, so use its routing id.
1211   Send(new ViewHostMsg_SelectRange_ACK(GetRenderWidget()->routing_id()));
1212
1213   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1214   frame_->selectRange(start, end);
1215 }
1216
1217 void RenderFrameImpl::OnUnselect() {
1218   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1219   frame_->executeCommand(WebString::fromUTF8("Unselect"), GetFocusedElement());
1220 }
1221
1222 void RenderFrameImpl::OnReplace(const base::string16& text) {
1223   if (!frame_->hasSelection())
1224     frame_->selectWordAroundCaret();
1225
1226   frame_->replaceSelection(text);
1227 }
1228
1229 void RenderFrameImpl::OnReplaceMisspelling(const base::string16& text) {
1230   if (!frame_->hasSelection())
1231     return;
1232
1233   frame_->replaceMisspelledRange(text);
1234 }
1235
1236 void RenderFrameImpl::OnCSSInsertRequest(const std::string& css) {
1237   frame_->document().insertStyleSheet(WebString::fromUTF8(css));
1238 }
1239
1240 void RenderFrameImpl::OnJavaScriptExecuteRequest(
1241     const base::string16& jscript,
1242     int id,
1243     bool notify_result) {
1244   TRACE_EVENT_INSTANT0("test_tracing", "OnJavaScriptExecuteRequest",
1245                        TRACE_EVENT_SCOPE_THREAD);
1246
1247   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
1248   v8::Handle<v8::Value> result =
1249       frame_->executeScriptAndReturnValue(WebScriptSource(jscript));
1250
1251   HandleJavascriptExecutionResult(jscript, id, notify_result, result);
1252 }
1253
1254 void RenderFrameImpl::OnJavaScriptExecuteRequestForTests(
1255     const base::string16& jscript,
1256     int id,
1257     bool notify_result) {
1258   TRACE_EVENT_INSTANT0("test_tracing", "OnJavaScriptExecuteRequestForTests",
1259                        TRACE_EVENT_SCOPE_THREAD);
1260
1261   v8::HandleScope handle_scope(v8::Isolate::GetCurrent());
1262   v8::Handle<v8::Value> result =
1263       frame_->executeScriptAndReturnValueForTests(WebScriptSource(jscript));
1264
1265   HandleJavascriptExecutionResult(jscript, id, notify_result, result);
1266 }
1267
1268 void RenderFrameImpl::HandleJavascriptExecutionResult(
1269     const base::string16& jscript,
1270     int id,
1271     bool notify_result,
1272     v8::Handle<v8::Value> result) {
1273   if (notify_result) {
1274     base::ListValue list;
1275     if (!result.IsEmpty()) {
1276       v8::Local<v8::Context> context = frame_->mainWorldScriptContext();
1277       v8::Context::Scope context_scope(context);
1278       V8ValueConverterImpl converter;
1279       converter.SetDateAllowed(true);
1280       converter.SetRegExpAllowed(true);
1281       base::Value* result_value = converter.FromV8Value(result, context);
1282       list.Set(0, result_value ? result_value : base::Value::CreateNullValue());
1283     } else {
1284       list.Set(0, base::Value::CreateNullValue());
1285     }
1286     Send(new FrameHostMsg_JavaScriptExecuteResponse(routing_id_, id, list));
1287   }
1288 }
1289
1290 void RenderFrameImpl::OnSetEditableSelectionOffsets(int start, int end) {
1291   base::AutoReset<bool> handling_select_range(&handling_select_range_, true);
1292   if (!GetRenderWidget()->ShouldHandleImeEvent())
1293     return;
1294   ImeEventGuard guard(GetRenderWidget());
1295   frame_->setEditableSelectionOffsets(start, end);
1296 }
1297
1298 void RenderFrameImpl::OnSetCompositionFromExistingText(
1299     int start, int end,
1300     const std::vector<blink::WebCompositionUnderline>& underlines) {
1301   if (!GetRenderWidget()->ShouldHandleImeEvent())
1302     return;
1303   ImeEventGuard guard(GetRenderWidget());
1304   frame_->setCompositionFromExistingText(start, end, underlines);
1305 }
1306
1307 void RenderFrameImpl::OnExtendSelectionAndDelete(int before, int after) {
1308   if (!GetRenderWidget()->ShouldHandleImeEvent())
1309     return;
1310   ImeEventGuard guard(GetRenderWidget());
1311   frame_->extendSelectionAndDelete(before, after);
1312 }
1313
1314 void RenderFrameImpl::OnSetAccessibilityMode(AccessibilityMode new_mode) {
1315   if (accessibility_mode_ == new_mode)
1316     return;
1317   accessibility_mode_ = new_mode;
1318   if (renderer_accessibility_) {
1319     delete renderer_accessibility_;
1320     renderer_accessibility_ = NULL;
1321   }
1322   if (accessibility_mode_ == AccessibilityModeOff)
1323     return;
1324
1325   if (accessibility_mode_ & AccessibilityModeFlagFullTree)
1326     renderer_accessibility_ = new RendererAccessibilityComplete(this);
1327 #if !defined(OS_ANDROID)
1328   else
1329     renderer_accessibility_ = new RendererAccessibilityFocusOnly(this);
1330 #endif
1331 }
1332
1333 void RenderFrameImpl::OnDisownOpener() {
1334   // TODO(creis): We should only see this for main frames for now.  To support
1335   // disowning the opener on subframes, we will need to move WebContentsImpl's
1336   // opener_ to FrameTreeNode.
1337   CHECK(!frame_->parent());
1338
1339   if (frame_->opener())
1340     frame_->setOpener(NULL);
1341 }
1342
1343 #if defined(OS_ANDROID)
1344 void RenderFrameImpl::OnSelectPopupMenuItems(
1345     bool canceled,
1346     const std::vector<int>& selected_indices) {
1347   // It is possible to receive more than one of these calls if the user presses
1348   // a select faster than it takes for the show-select-popup IPC message to make
1349   // it to the browser UI thread. Ignore the extra-messages.
1350   // TODO(jcivelli): http:/b/5793321 Implement a better fix, as detailed in bug.
1351   if (!external_popup_menu_)
1352     return;
1353
1354   external_popup_menu_->DidSelectItems(canceled, selected_indices);
1355   external_popup_menu_.reset();
1356 }
1357 #endif
1358
1359 #if defined(OS_MACOSX)
1360 void RenderFrameImpl::OnSelectPopupMenuItem(int selected_index) {
1361   if (external_popup_menu_ == NULL)
1362     return;
1363   external_popup_menu_->DidSelectItem(selected_index);
1364   external_popup_menu_.reset();
1365 }
1366 #endif
1367
1368 void RenderFrameImpl::OnReload(bool ignore_cache) {
1369   frame_->reload(ignore_cache);
1370 }
1371
1372 void RenderFrameImpl::OnTextSurroundingSelectionRequest(size_t max_length) {
1373   blink::WebSurroundingText surroundingText;
1374   surroundingText.initialize(frame_->selectionRange(), max_length);
1375
1376   if (surroundingText.isNull()) {
1377     // |surroundingText| might not be correctly initialized, for example if
1378     // |frame_->selectionRange().isNull()|, in other words, if there was no
1379     // selection.
1380     Send(new FrameHostMsg_TextSurroundingSelectionResponse(
1381         routing_id_, base::string16(), 0, 0));
1382     return;
1383   }
1384
1385   Send(new FrameHostMsg_TextSurroundingSelectionResponse(
1386       routing_id_,
1387       surroundingText.textContent(),
1388       surroundingText.startOffsetInTextContent(),
1389       surroundingText.endOffsetInTextContent()));
1390 }
1391
1392 void RenderFrameImpl::OnAddStyleSheetByURL(const std::string& url) {
1393   frame_->addStyleSheetByURL(WebString::fromUTF8(url));
1394 }
1395
1396 void RenderFrameImpl::OnSetupTransitionView(const std::string& markup) {
1397   frame_->document().setIsTransitionDocument();
1398   frame_->navigateToSandboxedMarkup(WebData(markup.data(), markup.length()));
1399 }
1400
1401 void RenderFrameImpl::OnBeginExitTransition(const std::string& css_selector) {
1402   frame_->document().setIsTransitionDocument();
1403   frame_->document().beginExitTransition(WebString::fromUTF8(css_selector));
1404 }
1405
1406 bool RenderFrameImpl::ShouldUpdateSelectionTextFromContextMenuParams(
1407     const base::string16& selection_text,
1408     size_t selection_text_offset,
1409     const gfx::Range& selection_range,
1410     const ContextMenuParams& params) {
1411   base::string16 trimmed_selection_text;
1412   if (!selection_text.empty() && !selection_range.is_empty()) {
1413     const int start = selection_range.GetMin() - selection_text_offset;
1414     const size_t length = selection_range.length();
1415     if (start >= 0 && start + length <= selection_text.length()) {
1416       base::TrimWhitespace(selection_text.substr(start, length), base::TRIM_ALL,
1417                            &trimmed_selection_text);
1418     }
1419   }
1420   base::string16 trimmed_params_text;
1421   base::TrimWhitespace(params.selection_text, base::TRIM_ALL,
1422                        &trimmed_params_text);
1423   return trimmed_params_text != trimmed_selection_text;
1424 }
1425
1426 bool RenderFrameImpl::RunJavaScriptMessage(JavaScriptMessageType type,
1427                                            const base::string16& message,
1428                                            const base::string16& default_value,
1429                                            const GURL& frame_url,
1430                                            base::string16* result) {
1431   // Don't allow further dialogs if we are waiting to swap out, since the
1432   // PageGroupLoadDeferrer in our stack prevents it.
1433   if (render_view()->suppress_dialogs_until_swap_out_)
1434     return false;
1435
1436   bool success = false;
1437   base::string16 result_temp;
1438   if (!result)
1439     result = &result_temp;
1440
1441   render_view()->SendAndRunNestedMessageLoop(
1442       new FrameHostMsg_RunJavaScriptMessage(
1443         routing_id_, message, default_value, frame_url, type, &success,
1444         result));
1445   return success;
1446 }
1447
1448 void RenderFrameImpl::LoadNavigationErrorPage(
1449     const WebURLRequest& failed_request,
1450     const WebURLError& error,
1451     bool replace) {
1452   std::string error_html;
1453   GetContentClient()->renderer()->GetNavigationErrorStrings(
1454       render_view(), frame_, failed_request, error, &error_html, NULL);
1455
1456   frame_->loadHTMLString(error_html,
1457                          GURL(kUnreachableWebDataURL),
1458                          error.unreachableURL,
1459                          replace);
1460 }
1461
1462 void RenderFrameImpl::DidCommitCompositorFrame() {
1463   FOR_EACH_OBSERVER(
1464       RenderFrameObserver, observers_, DidCommitCompositorFrame());
1465 }
1466
1467 RenderView* RenderFrameImpl::GetRenderView() {
1468   return render_view_.get();
1469 }
1470
1471 int RenderFrameImpl::GetRoutingID() {
1472   return routing_id_;
1473 }
1474
1475 blink::WebLocalFrame* RenderFrameImpl::GetWebFrame() {
1476   DCHECK(frame_);
1477   return frame_;
1478 }
1479
1480 WebPreferences& RenderFrameImpl::GetWebkitPreferences() {
1481   return render_view_->GetWebkitPreferences();
1482 }
1483
1484 int RenderFrameImpl::ShowContextMenu(ContextMenuClient* client,
1485                                      const ContextMenuParams& params) {
1486   DCHECK(client);  // A null client means "internal" when we issue callbacks.
1487   ContextMenuParams our_params(params);
1488   our_params.custom_context.request_id = pending_context_menus_.Add(client);
1489   Send(new FrameHostMsg_ContextMenu(routing_id_, our_params));
1490   return our_params.custom_context.request_id;
1491 }
1492
1493 void RenderFrameImpl::CancelContextMenu(int request_id) {
1494   DCHECK(pending_context_menus_.Lookup(request_id));
1495   pending_context_menus_.Remove(request_id);
1496 }
1497
1498 blink::WebNode RenderFrameImpl::GetContextMenuNode() const {
1499   return context_menu_node_;
1500 }
1501
1502 blink::WebPlugin* RenderFrameImpl::CreatePlugin(
1503     blink::WebFrame* frame,
1504     const WebPluginInfo& info,
1505     const blink::WebPluginParams& params) {
1506   DCHECK_EQ(frame_, frame);
1507 #if defined(ENABLE_PLUGINS)
1508   bool pepper_plugin_was_registered = false;
1509   scoped_refptr<PluginModule> pepper_module(PluginModule::Create(
1510       this, info, &pepper_plugin_was_registered));
1511   if (pepper_plugin_was_registered) {
1512     if (pepper_module.get()) {
1513       return new PepperWebPluginImpl(pepper_module.get(), params, this);
1514     }
1515   }
1516 #if defined(OS_CHROMEOS)
1517   LOG(WARNING) << "Pepper module/plugin creation failed.";
1518   return NULL;
1519 #else
1520   // TODO(jam): change to take RenderFrame.
1521   return new WebPluginImpl(frame, params, info.path, render_view_, this);
1522 #endif
1523 #else
1524   return NULL;
1525 #endif
1526 }
1527
1528 void RenderFrameImpl::LoadURLExternally(blink::WebLocalFrame* frame,
1529                                         const blink::WebURLRequest& request,
1530                                         blink::WebNavigationPolicy policy) {
1531   DCHECK(!frame_ || frame_ == frame);
1532   loadURLExternally(frame, request, policy, WebString());
1533 }
1534
1535 void RenderFrameImpl::ExecuteJavaScript(const base::string16& javascript) {
1536   OnJavaScriptExecuteRequest(javascript, 0, false);
1537 }
1538
1539 ServiceRegistry* RenderFrameImpl::GetServiceRegistry() {
1540   return &service_registry_;
1541 }
1542
1543 bool RenderFrameImpl::IsFTPDirectoryListing() {
1544   WebURLResponseExtraDataImpl* extra_data =
1545       GetExtraDataFromResponse(frame_->dataSource()->response());
1546   return extra_data ? extra_data->is_ftp_directory_listing() : false;
1547 }
1548
1549 void RenderFrameImpl::AttachGuest(int element_instance_id) {
1550   render_view_->GetBrowserPluginManager()->Attach(element_instance_id);
1551 }
1552
1553 // blink::WebFrameClient implementation ----------------------------------------
1554
1555 blink::WebPlugin* RenderFrameImpl::createPlugin(
1556     blink::WebLocalFrame* frame,
1557     const blink::WebPluginParams& params) {
1558   DCHECK_EQ(frame_, frame);
1559   blink::WebPlugin* plugin = NULL;
1560   if (GetContentClient()->renderer()->OverrideCreatePlugin(
1561           this, frame, params, &plugin)) {
1562     return plugin;
1563   }
1564
1565   if (base::UTF16ToUTF8(params.mimeType) == kBrowserPluginMimeType) {
1566     scoped_ptr<BrowserPluginDelegate> browser_plugin_delegate(
1567         GetContentClient()->renderer()->CreateBrowserPluginDelegate(
1568             this, std::string()));
1569     return render_view_->GetBrowserPluginManager()->CreateBrowserPlugin(
1570         render_view_.get(), frame, browser_plugin_delegate.Pass());
1571   }
1572
1573 #if defined(ENABLE_PLUGINS)
1574   WebPluginInfo info;
1575   std::string mime_type;
1576   bool found = false;
1577   Send(new FrameHostMsg_GetPluginInfo(
1578       routing_id_, params.url, frame->top()->document().url(),
1579       params.mimeType.utf8(), &found, &info, &mime_type));
1580   if (!found)
1581     return NULL;
1582
1583   if (info.type == content::WebPluginInfo::PLUGIN_TYPE_BROWSER_PLUGIN) {
1584     scoped_ptr<BrowserPluginDelegate> browser_plugin_delegate(
1585         GetContentClient()->renderer()->CreateBrowserPluginDelegate(
1586             this, base::UTF16ToUTF8(params.mimeType)));
1587     return render_view_->GetBrowserPluginManager()->CreateBrowserPlugin(
1588         render_view_.get(), frame, browser_plugin_delegate.Pass());
1589   }
1590
1591
1592   WebPluginParams params_to_use = params;
1593   params_to_use.mimeType = WebString::fromUTF8(mime_type);
1594   return CreatePlugin(frame, info, params_to_use);
1595 #else
1596   return NULL;
1597 #endif  // defined(ENABLE_PLUGINS)
1598 }
1599
1600 blink::WebMediaPlayer* RenderFrameImpl::createMediaPlayer(
1601     blink::WebLocalFrame* frame,
1602     const blink::WebURL& url,
1603     blink::WebMediaPlayerClient* client) {
1604   return createMediaPlayer(frame, url, client, NULL);
1605 }
1606
1607 blink::WebMediaPlayer* RenderFrameImpl::createMediaPlayer(
1608     blink::WebLocalFrame* frame,
1609     const blink::WebURL& url,
1610     blink::WebMediaPlayerClient* client,
1611     blink::WebContentDecryptionModule* initial_cdm) {
1612 #if defined(VIDEO_HOLE)
1613   if (!contains_media_player_) {
1614     render_view_->RegisterVideoHoleFrame(this);
1615     contains_media_player_ = true;
1616   }
1617 #endif  // defined(VIDEO_HOLE)
1618
1619   blink::WebMediaStream web_stream(
1620       blink::WebMediaStreamRegistry::lookupMediaStreamDescriptor(url));
1621   if (!web_stream.isNull())
1622     return CreateWebMediaPlayerForMediaStream(url, client);
1623
1624 #if defined(OS_ANDROID)
1625   return CreateAndroidWebMediaPlayer(url, client, initial_cdm);
1626 #else
1627   RenderThreadImpl* render_thread = RenderThreadImpl::current();
1628   media::WebMediaPlayerParams params(
1629       base::Bind(&ContentRendererClient::DeferMediaLoad,
1630                  base::Unretained(GetContentClient()->renderer()),
1631                  static_cast<RenderFrame*>(this)),
1632       render_thread->GetAudioRendererMixerManager()->CreateInput(
1633           render_view_->routing_id_, routing_id_),
1634       *render_thread->GetAudioHardwareConfig(),
1635       new RenderMediaLog(),
1636       render_thread->GetGpuFactories(),
1637       render_thread->GetMediaThreadTaskRunner(),
1638       render_thread->compositor_message_loop_proxy(),
1639       base::Bind(&EncryptedMediaPlayerSupportImpl::Create),
1640       initial_cdm);
1641
1642 #if defined(OS_TIZEN) && defined(ENABLE_MURPHY)
1643   tizen::MediaPlayerImpl* media_player = new tizen::MediaPlayerImpl(
1644       frame, client, weak_factory_.GetWeakPtr(),
1645       GetTizenMediaPlayerManager(), params);
1646   return media_player;
1647 #endif
1648   return new media::WebMediaPlayerImpl(frame,
1649                                        client,
1650                                        weak_factory_.GetWeakPtr(),
1651                                        params);
1652 #endif  // defined(OS_ANDROID)
1653 }
1654
1655 #if defined(OS_TIZEN) && defined(ENABLE_MURPHY)
1656 tizen::RendererMediaPlayerManager*
1657 RenderFrameImpl::GetTizenMediaPlayerManager() {
1658   if (!media_player_manager_)
1659     media_player_manager_ = new tizen::RendererMediaPlayerManager(this);
1660
1661   return media_player_manager_;
1662 }
1663 #endif
1664
1665 blink::WebContentDecryptionModule*
1666 RenderFrameImpl::createContentDecryptionModule(
1667     blink::WebLocalFrame* frame,
1668     const blink::WebSecurityOrigin& security_origin,
1669     const blink::WebString& key_system) {
1670   DCHECK(!frame_ || frame_ == frame);
1671   return WebContentDecryptionModuleImpl::Create(
1672 #if defined(ENABLE_PEPPER_CDMS)
1673       frame,
1674 #elif defined(ENABLE_BROWSER_CDMS)
1675       GetCdmManager(),
1676 #endif
1677       security_origin,
1678       key_system);
1679 }
1680
1681 blink::WebApplicationCacheHost* RenderFrameImpl::createApplicationCacheHost(
1682     blink::WebLocalFrame* frame,
1683     blink::WebApplicationCacheHostClient* client) {
1684   if (!frame || !frame->view())
1685     return NULL;
1686   DCHECK(!frame_ || frame_ == frame);
1687   return new RendererWebApplicationCacheHostImpl(
1688       RenderViewImpl::FromWebView(frame->view()), client,
1689       RenderThreadImpl::current()->appcache_dispatcher()->backend_proxy());
1690 }
1691
1692 blink::WebWorkerPermissionClientProxy*
1693 RenderFrameImpl::createWorkerPermissionClientProxy(
1694     blink::WebLocalFrame* frame) {
1695   if (!frame || !frame->view())
1696     return NULL;
1697   DCHECK(!frame_ || frame_ == frame);
1698   return GetContentClient()->renderer()->CreateWorkerPermissionClientProxy(
1699       this, frame);
1700 }
1701
1702 WebExternalPopupMenu* RenderFrameImpl::createExternalPopupMenu(
1703     const WebPopupMenuInfo& popup_menu_info,
1704     WebExternalPopupMenuClient* popup_menu_client) {
1705 #if defined(OS_MACOSX) || defined(OS_ANDROID)
1706   // An IPC message is sent to the browser to build and display the actual
1707   // popup. The user could have time to click a different select by the time
1708   // the popup is shown. In that case external_popup_menu_ is non NULL.
1709   // By returning NULL in that case, we instruct Blink to cancel that new
1710   // popup. So from the user perspective, only the first one will show, and
1711   // will have to close the first one before another one can be shown.
1712   if (external_popup_menu_)
1713     return NULL;
1714   external_popup_menu_.reset(
1715       new ExternalPopupMenu(this, popup_menu_info, popup_menu_client));
1716   if (render_view_->screen_metrics_emulator_) {
1717     render_view_->SetExternalPopupOriginAdjustmentsForEmulation(
1718         external_popup_menu_.get(),
1719         render_view_->screen_metrics_emulator_.get());
1720   }
1721   return external_popup_menu_.get();
1722 #else
1723   return NULL;
1724 #endif
1725 }
1726
1727 blink::WebCookieJar* RenderFrameImpl::cookieJar(blink::WebLocalFrame* frame) {
1728   DCHECK(!frame_ || frame_ == frame);
1729   return &cookie_jar_;
1730 }
1731
1732 blink::WebServiceWorkerProvider* RenderFrameImpl::createServiceWorkerProvider(
1733     blink::WebLocalFrame* frame) {
1734   DCHECK(!frame_ || frame_ == frame);
1735   // At this point we should have non-null data source.
1736   DCHECK(frame->dataSource());
1737   if (!ChildThread::current())
1738     return NULL;  // May be null in some tests.
1739   ServiceWorkerNetworkProvider* provider =
1740       ServiceWorkerNetworkProvider::FromDocumentState(
1741           DocumentState::FromDataSource(frame->dataSource()));
1742   return new WebServiceWorkerProviderImpl(
1743       ChildThread::current()->thread_safe_sender(),
1744       provider ? provider->context() : NULL);
1745 }
1746
1747 void RenderFrameImpl::didAccessInitialDocument(blink::WebLocalFrame* frame) {
1748   DCHECK(!frame_ || frame_ == frame);
1749   // Notify the browser process that it is no longer safe to show the pending
1750   // URL of the main frame, since a URL spoof is now possible.
1751   if (!frame->parent() && render_view_->page_id_ == -1)
1752     Send(new FrameHostMsg_DidAccessInitialDocument(routing_id_));
1753 }
1754
1755 blink::WebFrame* RenderFrameImpl::createChildFrame(
1756     blink::WebLocalFrame* parent,
1757     const blink::WebString& name) {
1758   // Synchronously notify the browser of a child frame creation to get the
1759   // routing_id for the RenderFrame.
1760   int child_routing_id = MSG_ROUTING_NONE;
1761   Send(new FrameHostMsg_CreateChildFrame(routing_id_,
1762                                          base::UTF16ToUTF8(name),
1763                                          &child_routing_id));
1764   // Allocation of routing id failed, so we can't create a child frame. This can
1765   // happen if this RenderFrameImpl's IPCs are being filtered when in swapped
1766   // out state.
1767   if (child_routing_id == MSG_ROUTING_NONE) {
1768 #if !defined(OS_LINUX)
1769     // DumpWithoutCrashing() crashes on Linux in renderer processes when
1770     // breakpad and sandboxing are enabled: crbug.com/349600
1771     base::debug::Alias(parent);
1772     base::debug::Alias(&routing_id_);
1773     bool render_view_is_swapped_out = GetRenderWidget()->is_swapped_out();
1774     base::debug::Alias(&render_view_is_swapped_out);
1775     bool render_view_is_closing = GetRenderWidget()->closing();
1776     base::debug::Alias(&render_view_is_closing);
1777     base::debug::Alias(&is_swapped_out_);
1778     base::debug::DumpWithoutCrashing();
1779 #endif
1780     return NULL;
1781   }
1782
1783   // Create the RenderFrame and WebLocalFrame, linking the two.
1784   RenderFrameImpl* child_render_frame = RenderFrameImpl::Create(
1785       render_view_.get(), child_routing_id);
1786   blink::WebLocalFrame* web_frame = WebLocalFrame::create(child_render_frame);
1787   child_render_frame->SetWebFrame(web_frame);
1788
1789   // Add the frame to the frame tree and initialize it.
1790   parent->appendChild(web_frame);
1791   child_render_frame->Initialize();
1792
1793   return web_frame;
1794 }
1795
1796 void RenderFrameImpl::didDisownOpener(blink::WebLocalFrame* frame) {
1797   DCHECK(!frame_ || frame_ == frame);
1798   // We only need to notify the browser if the active, top-level frame clears
1799   // its opener.  We can ignore cases where a swapped out frame clears its
1800   // opener after hearing about it from the browser, and the browser does not
1801   // (yet) care about subframe openers.
1802   if (render_view_->is_swapped_out_ || frame->parent())
1803     return;
1804
1805   // Notify WebContents and all its swapped out RenderViews.
1806   Send(new FrameHostMsg_DidDisownOpener(routing_id_));
1807 }
1808
1809 void RenderFrameImpl::frameDetached(blink::WebFrame* frame) {
1810   // NOTE: This function is called on the frame that is being detached and not
1811   // the parent frame.  This is different from createChildFrame() which is
1812   // called on the parent frame.
1813   CHECK(!is_detaching_);
1814   DCHECK(!frame_ || frame_ == frame);
1815
1816   bool is_subframe = !!frame->parent();
1817
1818   Send(new FrameHostMsg_Detach(routing_id_));
1819
1820   // The |is_detaching_| flag disables Send(). FrameHostMsg_Detach must be
1821   // sent before setting |is_detaching_| to true. In contrast, Observers
1822   // should only be notified afterwards so they cannot call back into here and
1823   // have IPCs fired off.
1824   is_detaching_ = true;
1825
1826   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1827                     FrameDetached(frame));
1828
1829   // We need to clean up subframes by removing them from the map and deleting
1830   // the RenderFrameImpl.  In contrast, the main frame is owned by its
1831   // containing RenderViewHost (so that they have the same lifetime), so only
1832   // removal from the map is needed and no deletion.
1833   FrameMap::iterator it = g_frame_map.Get().find(frame);
1834   CHECK(it != g_frame_map.Get().end());
1835   CHECK_EQ(it->second, this);
1836   g_frame_map.Get().erase(it);
1837
1838   if (is_subframe)
1839     frame->parent()->removeChild(frame);
1840
1841   // |frame| is invalid after here.
1842   frame->close();
1843
1844   if (is_subframe) {
1845     delete this;
1846     // Object is invalid after this point.
1847   }
1848 }
1849
1850 void RenderFrameImpl::frameFocused() {
1851   Send(new FrameHostMsg_FrameFocused(routing_id_));
1852 }
1853
1854 void RenderFrameImpl::willClose(blink::WebFrame* frame) {
1855   DCHECK(!frame_ || frame_ == frame);
1856
1857   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, FrameWillClose());
1858   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1859                     FrameWillClose(frame));
1860 }
1861
1862 void RenderFrameImpl::didChangeName(blink::WebLocalFrame* frame,
1863                                     const blink::WebString& name) {
1864   DCHECK(!frame_ || frame_ == frame);
1865   if (!render_view_->renderer_preferences_.report_frame_name_changes)
1866     return;
1867
1868   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidChangeName(name));
1869 }
1870
1871 void RenderFrameImpl::didMatchCSS(
1872     blink::WebLocalFrame* frame,
1873     const blink::WebVector<blink::WebString>& newly_matching_selectors,
1874     const blink::WebVector<blink::WebString>& stopped_matching_selectors) {
1875   DCHECK(!frame_ || frame_ == frame);
1876
1877   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1878                     DidMatchCSS(frame,
1879                                 newly_matching_selectors,
1880                                 stopped_matching_selectors));
1881 }
1882
1883 bool RenderFrameImpl::shouldReportDetailedMessageForSource(
1884     const blink::WebString& source) {
1885   return GetContentClient()->renderer()->ShouldReportDetailedMessageForSource(
1886       source);
1887 }
1888
1889 void RenderFrameImpl::didAddMessageToConsole(
1890     const blink::WebConsoleMessage& message,
1891     const blink::WebString& source_name,
1892     unsigned source_line,
1893     const blink::WebString& stack_trace) {
1894   logging::LogSeverity log_severity = logging::LOG_VERBOSE;
1895   switch (message.level) {
1896     case blink::WebConsoleMessage::LevelDebug:
1897       log_severity = logging::LOG_VERBOSE;
1898       break;
1899     case blink::WebConsoleMessage::LevelLog:
1900     case blink::WebConsoleMessage::LevelInfo:
1901       log_severity = logging::LOG_INFO;
1902       break;
1903     case blink::WebConsoleMessage::LevelWarning:
1904       log_severity = logging::LOG_WARNING;
1905       break;
1906     case blink::WebConsoleMessage::LevelError:
1907       log_severity = logging::LOG_ERROR;
1908       break;
1909     default:
1910       NOTREACHED();
1911   }
1912
1913   if (shouldReportDetailedMessageForSource(source_name)) {
1914     FOR_EACH_OBSERVER(
1915         RenderFrameObserver, observers_,
1916         DetailedConsoleMessageAdded(message.text,
1917                                     source_name,
1918                                     stack_trace,
1919                                     source_line,
1920                                     static_cast<int32>(log_severity)));
1921   }
1922
1923   Send(new FrameHostMsg_AddMessageToConsole(routing_id_,
1924                                             static_cast<int32>(log_severity),
1925                                             message.text,
1926                                             static_cast<int32>(source_line),
1927                                             source_name));
1928 }
1929
1930 void RenderFrameImpl::loadURLExternally(
1931     blink::WebLocalFrame* frame,
1932     const blink::WebURLRequest& request,
1933     blink::WebNavigationPolicy policy,
1934     const blink::WebString& suggested_name) {
1935   DCHECK(!frame_ || frame_ == frame);
1936   Referrer referrer(RenderViewImpl::GetReferrerFromRequest(frame, request));
1937   if (policy == blink::WebNavigationPolicyDownload) {
1938     render_view_->Send(new ViewHostMsg_DownloadUrl(render_view_->GetRoutingID(),
1939                                                    request.url(), referrer,
1940                                                    suggested_name));
1941   } else {
1942     OpenURL(frame, request.url(), referrer, policy);
1943   }
1944 }
1945
1946 blink::WebNavigationPolicy RenderFrameImpl::decidePolicyForNavigation(
1947     const NavigationPolicyInfo& info) {
1948   DCHECK(!frame_ || frame_ == info.frame);
1949   return DecidePolicyForNavigation(this, info);
1950 }
1951
1952 blink::WebHistoryItem RenderFrameImpl::historyItemForNewChildFrame(
1953     blink::WebFrame* frame) {
1954   DCHECK(!frame_ || frame_ == frame);
1955   return render_view_->history_controller()->GetItemForNewChildFrame(this);
1956 }
1957
1958 void RenderFrameImpl::willSendSubmitEvent(blink::WebLocalFrame* frame,
1959                                           const blink::WebFormElement& form) {
1960   DCHECK(!frame_ || frame_ == frame);
1961
1962   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1963                     WillSendSubmitEvent(frame, form));
1964 }
1965
1966 void RenderFrameImpl::willSubmitForm(blink::WebLocalFrame* frame,
1967                                      const blink::WebFormElement& form) {
1968   DCHECK(!frame_ || frame_ == frame);
1969   DocumentState* document_state =
1970       DocumentState::FromDataSource(frame->provisionalDataSource());
1971   NavigationState* navigation_state = document_state->navigation_state();
1972   InternalDocumentStateData* internal_data =
1973       InternalDocumentStateData::FromDocumentState(document_state);
1974
1975   if (ui::PageTransitionCoreTypeIs(navigation_state->transition_type(),
1976                                    ui::PAGE_TRANSITION_LINK)) {
1977     navigation_state->set_transition_type(ui::PAGE_TRANSITION_FORM_SUBMIT);
1978   }
1979
1980   // Save these to be processed when the ensuing navigation is committed.
1981   WebSearchableFormData web_searchable_form_data(form);
1982   internal_data->set_searchable_form_url(web_searchable_form_data.url());
1983   internal_data->set_searchable_form_encoding(
1984       web_searchable_form_data.encoding().utf8());
1985
1986   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
1987                     WillSubmitForm(frame, form));
1988 }
1989
1990 void RenderFrameImpl::didCreateDataSource(blink::WebLocalFrame* frame,
1991                                           blink::WebDataSource* datasource) {
1992   DCHECK(!frame_ || frame_ == frame);
1993
1994   // TODO(nasko): Move implementation here. Needed state:
1995   // * pending_navigation_params_
1996   // * webview
1997   // Needed methods:
1998   // * PopulateDocumentStateFromPending
1999   // * CreateNavigationStateFromPending
2000   render_view_->didCreateDataSource(frame, datasource);
2001
2002   // Create the serviceworker's per-document network observing object.
2003   scoped_ptr<ServiceWorkerNetworkProvider>
2004       network_provider(new ServiceWorkerNetworkProvider());
2005   ServiceWorkerNetworkProvider::AttachToDocumentState(
2006       DocumentState::FromDataSource(datasource),
2007       network_provider.Pass());
2008 }
2009
2010 void RenderFrameImpl::didStartProvisionalLoad(blink::WebLocalFrame* frame,
2011                                               bool is_transition_navigation) {
2012   DCHECK(!frame_ || frame_ == frame);
2013   WebDataSource* ds = frame->provisionalDataSource();
2014
2015   // In fast/loader/stop-provisional-loads.html, we abort the load before this
2016   // callback is invoked.
2017   if (!ds)
2018     return;
2019
2020   TRACE_EVENT2("navigation", "RenderFrameImpl::didStartProvisionalLoad",
2021                "id", routing_id_, "url", ds->request().url().string().utf8());
2022   DocumentState* document_state = DocumentState::FromDataSource(ds);
2023
2024   // We should only navigate to swappedout:// when is_swapped_out_ is true.
2025   CHECK((ds->request().url() != GURL(kSwappedOutURL)) ||
2026         is_swapped_out_ ||
2027         render_view_->is_swapped_out()) <<
2028         "Heard swappedout:// when not swapped out.";
2029
2030   // Update the request time if WebKit has better knowledge of it.
2031   if (document_state->request_time().is_null()) {
2032     double event_time = ds->triggeringEventTime();
2033     if (event_time != 0.0)
2034       document_state->set_request_time(Time::FromDoubleT(event_time));
2035   }
2036
2037   // Start time is only set after request time.
2038   document_state->set_start_load_time(Time::Now());
2039
2040   bool is_top_most = !frame->parent();
2041   if (is_top_most) {
2042     render_view_->set_navigation_gesture(
2043         WebUserGestureIndicator::isProcessingUserGesture() ?
2044             NavigationGestureUser : NavigationGestureAuto);
2045   } else if (ds->replacesCurrentHistoryItem()) {
2046     // Subframe navigations that don't add session history items must be
2047     // marked with AUTO_SUBFRAME. See also didFailProvisionalLoad for how we
2048     // handle loading of error pages.
2049     document_state->navigation_state()->set_transition_type(
2050         ui::PAGE_TRANSITION_AUTO_SUBFRAME);
2051   }
2052
2053   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2054                     DidStartProvisionalLoad(frame));
2055   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidStartProvisionalLoad());
2056
2057   Send(new FrameHostMsg_DidStartProvisionalLoadForFrame(
2058        routing_id_, ds->request().url(), is_transition_navigation));
2059 }
2060
2061 void RenderFrameImpl::didReceiveServerRedirectForProvisionalLoad(
2062     blink::WebLocalFrame* frame) {
2063   DCHECK(!frame_ || frame_ == frame);
2064   render_view_->history_controller()->RemoveChildrenForRedirect(this);
2065 }
2066
2067 void RenderFrameImpl::didFailProvisionalLoad(blink::WebLocalFrame* frame,
2068                                              const blink::WebURLError& error) {
2069   TRACE_EVENT1("navigation", "RenderFrameImpl::didFailProvisionalLoad",
2070                "id", routing_id_);
2071   DCHECK(!frame_ || frame_ == frame);
2072   WebDataSource* ds = frame->provisionalDataSource();
2073   DCHECK(ds);
2074
2075   const WebURLRequest& failed_request = ds->request();
2076
2077   // Notify the browser that we failed a provisional load with an error.
2078   //
2079   // Note: It is important this notification occur before DidStopLoading so the
2080   //       SSL manager can react to the provisional load failure before being
2081   //       notified the load stopped.
2082   //
2083   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2084                     DidFailProvisionalLoad(frame, error));
2085   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
2086                     DidFailProvisionalLoad(error));
2087
2088   bool show_repost_interstitial =
2089       (error.reason == net::ERR_CACHE_MISS &&
2090        EqualsASCII(failed_request.httpMethod(), "POST"));
2091
2092   FrameHostMsg_DidFailProvisionalLoadWithError_Params params;
2093   params.error_code = error.reason;
2094   GetContentClient()->renderer()->GetNavigationErrorStrings(
2095       render_view_.get(),
2096       frame,
2097       failed_request,
2098       error,
2099       NULL,
2100       &params.error_description);
2101   params.url = error.unreachableURL;
2102   params.showing_repost_interstitial = show_repost_interstitial;
2103   Send(new FrameHostMsg_DidFailProvisionalLoadWithError(
2104       routing_id_, params));
2105
2106   // Don't display an error page if this is simply a cancelled load.  Aside
2107   // from being dumb, WebCore doesn't expect it and it will cause a crash.
2108   if (error.reason == net::ERR_ABORTED)
2109     return;
2110
2111   // Don't display "client blocked" error page if browser has asked us not to.
2112   if (error.reason == net::ERR_BLOCKED_BY_CLIENT &&
2113       render_view_->renderer_preferences_.disable_client_blocked_error_page) {
2114     return;
2115   }
2116
2117   // Allow the embedder to suppress an error page.
2118   if (GetContentClient()->renderer()->ShouldSuppressErrorPage(this,
2119           error.unreachableURL)) {
2120     return;
2121   }
2122
2123   if (RenderThreadImpl::current() &&
2124       RenderThreadImpl::current()->layout_test_mode()) {
2125     return;
2126   }
2127
2128   // Make sure we never show errors in view source mode.
2129   frame->enableViewSourceMode(false);
2130
2131   DocumentState* document_state = DocumentState::FromDataSource(ds);
2132   NavigationState* navigation_state = document_state->navigation_state();
2133
2134   // If this is a failed back/forward/reload navigation, then we need to do a
2135   // 'replace' load.  This is necessary to avoid messing up session history.
2136   // Otherwise, we do a normal load, which simulates a 'go' navigation as far
2137   // as session history is concerned.
2138   //
2139   // AUTO_SUBFRAME loads should always be treated as loads that do not advance
2140   // the page id.
2141   //
2142   // TODO(davidben): This should also take the failed navigation's replacement
2143   // state into account, if a location.replace() failed.
2144   bool replace =
2145       navigation_state->pending_page_id() != -1 ||
2146       ui::PageTransitionCoreTypeIs(navigation_state->transition_type(),
2147                                ui::PAGE_TRANSITION_AUTO_SUBFRAME);
2148
2149   // If we failed on a browser initiated request, then make sure that our error
2150   // page load is regarded as the same browser initiated request.
2151   if (!navigation_state->is_content_initiated()) {
2152     render_view_->pending_navigation_params_.reset(
2153         new FrameMsg_Navigate_Params);
2154     render_view_->pending_navigation_params_->page_id =
2155         navigation_state->pending_page_id();
2156     render_view_->pending_navigation_params_->pending_history_list_offset =
2157         navigation_state->pending_history_list_offset();
2158     render_view_->pending_navigation_params_->should_clear_history_list =
2159         navigation_state->history_list_was_cleared();
2160     render_view_->pending_navigation_params_->transition =
2161         navigation_state->transition_type();
2162     render_view_->pending_navigation_params_->request_time =
2163         document_state->request_time();
2164     render_view_->pending_navigation_params_->should_replace_current_entry =
2165         replace;
2166   }
2167
2168   // Load an error page.
2169   LoadNavigationErrorPage(failed_request, error, replace);
2170 }
2171
2172 void RenderFrameImpl::didCommitProvisionalLoad(
2173     blink::WebLocalFrame* frame,
2174     const blink::WebHistoryItem& item,
2175     blink::WebHistoryCommitType commit_type) {
2176   TRACE_EVENT2("navigation", "RenderFrameImpl::didCommitProvisionalLoad",
2177                "id", routing_id_,
2178                "url", GetLoadingUrl().possibly_invalid_spec());
2179   DCHECK(!frame_ || frame_ == frame);
2180   DocumentState* document_state =
2181       DocumentState::FromDataSource(frame->dataSource());
2182   NavigationState* navigation_state = document_state->navigation_state();
2183
2184   // When we perform a new navigation, we need to update the last committed
2185   // session history entry with state for the page we are leaving. Do this
2186   // before updating the HistoryController state.
2187   render_view_->UpdateSessionHistory(frame);
2188
2189   render_view_->history_controller()->UpdateForCommit(this, item, commit_type,
2190       navigation_state->was_within_same_page());
2191
2192   InternalDocumentStateData* internal_data =
2193       InternalDocumentStateData::FromDocumentState(document_state);
2194
2195   if (document_state->commit_load_time().is_null())
2196     document_state->set_commit_load_time(Time::Now());
2197
2198   if (internal_data->must_reset_scroll_and_scale_state()) {
2199     render_view_->webview()->resetScrollAndScaleState();
2200     internal_data->set_must_reset_scroll_and_scale_state(false);
2201   }
2202   internal_data->set_use_error_page(false);
2203
2204   bool is_new_navigation = commit_type == blink::WebStandardCommit;
2205   if (is_new_navigation) {
2206     // We bump our Page ID to correspond with the new session history entry.
2207     render_view_->page_id_ = render_view_->next_page_id_++;
2208
2209     // Don't update history_page_ids_ (etc) for kSwappedOutURL, since
2210     // we don't want to forget the entry that was there, and since we will
2211     // never come back to kSwappedOutURL.  Note that we have to call
2212     // UpdateSessionHistory and update page_id_ even in this case, so that
2213     // the current entry gets a state update and so that we don't send a
2214     // state update to the wrong entry when we swap back in.
2215     if (GetLoadingUrl() != GURL(kSwappedOutURL)) {
2216       // Advance our offset in session history, applying the length limit.
2217       // There is now no forward history.
2218       render_view_->history_list_offset_++;
2219       if (render_view_->history_list_offset_ >= kMaxSessionHistoryEntries)
2220         render_view_->history_list_offset_ = kMaxSessionHistoryEntries - 1;
2221       render_view_->history_list_length_ =
2222           render_view_->history_list_offset_ + 1;
2223       render_view_->history_page_ids_.resize(
2224           render_view_->history_list_length_, -1);
2225       render_view_->history_page_ids_[render_view_->history_list_offset_] =
2226           render_view_->page_id_;
2227     }
2228   } else {
2229     // Inspect the navigation_state on this frame to see if the navigation
2230     // corresponds to a session history navigation...  Note: |frame| may or
2231     // may not be the toplevel frame, but for the case of capturing session
2232     // history, the first committed frame suffices.  We keep track of whether
2233     // we've seen this commit before so that only capture session history once
2234     // per navigation.
2235     //
2236     // Note that we need to check if the page ID changed. In the case of a
2237     // reload, the page ID doesn't change, and UpdateSessionHistory gets the
2238     // previous URL and the current page ID, which would be wrong.
2239     if (navigation_state->pending_page_id() != -1 &&
2240         navigation_state->pending_page_id() != render_view_->page_id_ &&
2241         !navigation_state->request_committed()) {
2242       // This is a successful session history navigation!
2243       render_view_->page_id_ = navigation_state->pending_page_id();
2244
2245       render_view_->history_list_offset_ =
2246           navigation_state->pending_history_list_offset();
2247
2248       // If the history list is valid, our list of page IDs should be correct.
2249       DCHECK(render_view_->history_list_length_ <= 0 ||
2250              render_view_->history_list_offset_ < 0 ||
2251              render_view_->history_list_offset_ >=
2252                  render_view_->history_list_length_ ||
2253              render_view_->history_page_ids_[render_view_->history_list_offset_]
2254                   == render_view_->page_id_);
2255     }
2256   }
2257
2258   Send(new FrameHostMsg_DidAssignPageId(routing_id_, render_view_->page_id_));
2259
2260   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers_,
2261                     DidCommitProvisionalLoad(frame, is_new_navigation));
2262   FOR_EACH_OBSERVER(RenderFrameObserver, observers_,
2263                     DidCommitProvisionalLoad(is_new_navigation));
2264
2265   if (!frame->parent()) {  // Only for top frames.
2266     RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
2267     if (render_thread_impl) {  // Can be NULL in tests.
2268       render_thread_impl->histogram_customizer()->
2269           RenderViewNavigatedToHost(GURL(GetLoadingUrl()).host(),
2270                                     RenderViewImpl::GetRenderViewCount());
2271     }
2272   }
2273
2274   // Remember that we've already processed this request, so we don't update
2275   // the session history again.  We do this regardless of whether this is
2276   // a session history navigation, because if we attempted a session history
2277   // navigation without valid HistoryItem state, WebCore will think it is a
2278   // new navigation.
2279   navigation_state->set_request_committed(true);
2280
2281   SendDidCommitProvisionalLoad(frame);
2282
2283   // Check whether we have new encoding name.
2284   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2285 }
2286
2287 void RenderFrameImpl::didClearWindowObject(blink::WebLocalFrame* frame) {
2288   DCHECK(!frame_ || frame_ == frame);
2289   // TODO(nasko): Move implementation here. Needed state:
2290   // * enabled_bindings_
2291   // * dom_automation_controller_
2292   // * stats_collection_controller_
2293
2294   render_view_->didClearWindowObject(frame);
2295
2296   if (render_view_->GetEnabledBindings() & BINDINGS_POLICY_DOM_AUTOMATION)
2297     DomAutomationController::Install(this, frame);
2298
2299   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidClearWindowObject());
2300 }
2301
2302 void RenderFrameImpl::didCreateDocumentElement(blink::WebLocalFrame* frame) {
2303   DCHECK(!frame_ || frame_ == frame);
2304
2305   // Notify the browser about non-blank documents loading in the top frame.
2306   GURL url = frame->document().url();
2307   if (url.is_valid() && url.spec() != url::kAboutBlankURL) {
2308     // TODO(nasko): Check if webview()->mainFrame() is the same as the
2309     // frame->tree()->top().
2310     blink::WebFrame* main_frame = render_view_->webview()->mainFrame();
2311     if (frame == main_frame) {
2312       // For now, don't remember plugin zoom values.  We don't want to mix them
2313       // with normal web content (i.e. a fixed layout plugin would usually want
2314       // them different).
2315       render_view_->Send(new ViewHostMsg_DocumentAvailableInMainFrame(
2316           render_view_->GetRoutingID(),
2317           main_frame->document().isPluginDocument()));
2318     }
2319   }
2320
2321   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2322                     DidCreateDocumentElement(frame));
2323 }
2324
2325 void RenderFrameImpl::didReceiveTitle(blink::WebLocalFrame* frame,
2326                                       const blink::WebString& title,
2327                                       blink::WebTextDirection direction) {
2328   DCHECK(!frame_ || frame_ == frame);
2329   // Ignore all but top level navigations.
2330   if (!frame->parent()) {
2331     base::string16 title16 = title;
2332     base::debug::TraceLog::GetInstance()->UpdateProcessLabel(
2333         routing_id_, base::UTF16ToUTF8(title16));
2334
2335     base::string16 shortened_title = title16.substr(0, kMaxTitleChars);
2336     Send(new FrameHostMsg_UpdateTitle(routing_id_,
2337                                       render_view_->page_id_,
2338                                       shortened_title, direction));
2339   }
2340
2341   // Also check whether we have new encoding name.
2342   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2343 }
2344
2345 void RenderFrameImpl::didChangeIcon(blink::WebLocalFrame* frame,
2346                                     blink::WebIconURL::Type icon_type) {
2347   DCHECK(!frame_ || frame_ == frame);
2348   // TODO(nasko): Investigate wheather implementation should move here.
2349   render_view_->didChangeIcon(frame, icon_type);
2350 }
2351
2352 void RenderFrameImpl::didFinishDocumentLoad(blink::WebLocalFrame* frame) {
2353   TRACE_EVENT1("navigation", "RenderFrameImpl::didFinishDocumentLoad",
2354                "id", routing_id_);
2355   DCHECK(!frame_ || frame_ == frame);
2356   WebDataSource* ds = frame->dataSource();
2357   DocumentState* document_state = DocumentState::FromDataSource(ds);
2358   document_state->set_finish_document_load_time(Time::Now());
2359
2360   Send(new FrameHostMsg_DidFinishDocumentLoad(routing_id_));
2361
2362   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2363                     DidFinishDocumentLoad(frame));
2364   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishDocumentLoad());
2365
2366   // Check whether we have new encoding name.
2367   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
2368 }
2369
2370 void RenderFrameImpl::didHandleOnloadEvents(blink::WebLocalFrame* frame) {
2371   DCHECK(!frame_ || frame_ == frame);
2372   if (!frame->parent())
2373     Send(new FrameHostMsg_DocumentOnLoadCompleted(routing_id_));
2374 }
2375
2376 void RenderFrameImpl::didFailLoad(blink::WebLocalFrame* frame,
2377                                   const blink::WebURLError& error) {
2378   TRACE_EVENT1("navigation", "RenderFrameImpl::didFailLoad",
2379                "id", routing_id_);
2380   DCHECK(!frame_ || frame_ == frame);
2381   // TODO(nasko): Move implementation here. No state needed.
2382   WebDataSource* ds = frame->dataSource();
2383   DCHECK(ds);
2384
2385   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2386                     DidFailLoad(frame, error));
2387
2388   const WebURLRequest& failed_request = ds->request();
2389   base::string16 error_description;
2390   GetContentClient()->renderer()->GetNavigationErrorStrings(
2391       render_view_.get(),
2392       frame,
2393       failed_request,
2394       error,
2395       NULL,
2396       &error_description);
2397   Send(new FrameHostMsg_DidFailLoadWithError(routing_id_,
2398                                              failed_request.url(),
2399                                              error.reason,
2400                                              error_description));
2401 }
2402
2403 void RenderFrameImpl::didFinishLoad(blink::WebLocalFrame* frame) {
2404   TRACE_EVENT1("navigation", "RenderFrameImpl::didFinishLoad",
2405                "id", routing_id_);
2406   DCHECK(!frame_ || frame_ == frame);
2407   WebDataSource* ds = frame->dataSource();
2408   DocumentState* document_state = DocumentState::FromDataSource(ds);
2409   if (document_state->finish_load_time().is_null()) {
2410     if (!frame->parent()) {
2411       TRACE_EVENT_INSTANT0("WebCore", "LoadFinished",
2412                            TRACE_EVENT_SCOPE_PROCESS);
2413     }
2414     document_state->set_finish_load_time(Time::Now());
2415   }
2416
2417   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
2418                     DidFinishLoad(frame));
2419   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishLoad());
2420
2421   // Don't send this message while the frame is swapped out.
2422   if (is_swapped_out())
2423     return;
2424
2425   Send(new FrameHostMsg_DidFinishLoad(routing_id_,
2426                                       ds->request().url()));
2427 }
2428
2429 void RenderFrameImpl::didNavigateWithinPage(blink::WebLocalFrame* frame,
2430     const blink::WebHistoryItem& item,
2431     blink::WebHistoryCommitType commit_type) {
2432   TRACE_EVENT1("navigation", "RenderFrameImpl::didNavigateWithinPage",
2433                "id", routing_id_);
2434   DCHECK(!frame_ || frame_ == frame);
2435   // If this was a reference fragment navigation that we initiated, then we
2436   // could end up having a non-null pending navigation params.  We just need to
2437   // update the ExtraData on the datasource so that others who read the
2438   // ExtraData will get the new NavigationState.  Similarly, if we did not
2439   // initiate this navigation, then we need to take care to reset any pre-
2440   // existing navigation state to a content-initiated navigation state.
2441   // DidCreateDataSource conveniently takes care of this for us.
2442   didCreateDataSource(frame, frame->dataSource());
2443
2444   DocumentState* document_state =
2445       DocumentState::FromDataSource(frame->dataSource());
2446   NavigationState* new_state = document_state->navigation_state();
2447   new_state->set_was_within_same_page(true);
2448
2449   didCommitProvisionalLoad(frame, item, commit_type);
2450 }
2451
2452 void RenderFrameImpl::didUpdateCurrentHistoryItem(blink::WebLocalFrame* frame) {
2453   DCHECK(!frame_ || frame_ == frame);
2454   // TODO(nasko): Move implementation here. Needed methods:
2455   // * StartNavStateSyncTimerIfNecessary
2456   render_view_->didUpdateCurrentHistoryItem(frame);
2457 }
2458
2459 void RenderFrameImpl::addNavigationTransitionData(
2460     const blink::WebString& allowed_destination_host_pattern,
2461     const blink::WebString& selector,
2462     const blink::WebString& markup) {
2463   Send(new FrameHostMsg_AddNavigationTransitionData(
2464       routing_id_, allowed_destination_host_pattern.utf8(), selector.utf8(),
2465       markup.utf8()));
2466 }
2467
2468 void RenderFrameImpl::didChangeThemeColor() {
2469   if (frame_->parent())
2470     return;
2471
2472   Send(new FrameHostMsg_DidChangeThemeColor(
2473       routing_id_, frame_->document().themeColor()));
2474 }
2475
2476 void RenderFrameImpl::requestNotificationPermission(
2477     const blink::WebSecurityOrigin& origin,
2478     blink::WebNotificationPermissionCallback* callback) {
2479   if (!notification_permission_dispatcher_) {
2480     notification_permission_dispatcher_ =
2481         new NotificationPermissionDispatcher(this);
2482   }
2483
2484   notification_permission_dispatcher_->RequestPermission(origin, callback);
2485 }
2486
2487 blink::WebNotificationPresenter* RenderFrameImpl::notificationPresenter() {
2488   return notification_provider_;
2489 }
2490
2491 void RenderFrameImpl::didChangeSelection(bool is_empty_selection) {
2492   if (!GetRenderWidget()->handling_input_event() && !handling_select_range_)
2493     return;
2494
2495   if (is_empty_selection)
2496     selection_text_.clear();
2497
2498   // UpdateTextInputType should be called before SyncSelectionIfRequired.
2499   // UpdateTextInputType may send TextInputTypeChanged to notify the focus
2500   // was changed, and SyncSelectionIfRequired may send SelectionChanged
2501   // to notify the selection was changed.  Focus change should be notified
2502   // before selection change.
2503   GetRenderWidget()->UpdateTextInputType();
2504   SyncSelectionIfRequired();
2505 #if defined(OS_ANDROID)
2506   GetRenderWidget()->UpdateTextInputState(RenderWidget::NO_SHOW_IME,
2507                                           RenderWidget::FROM_NON_IME);
2508 #endif
2509 }
2510
2511 blink::WebColorChooser* RenderFrameImpl::createColorChooser(
2512     blink::WebColorChooserClient* client,
2513     const blink::WebColor& initial_color,
2514     const blink::WebVector<blink::WebColorSuggestion>& suggestions) {
2515   RendererWebColorChooserImpl* color_chooser =
2516       new RendererWebColorChooserImpl(this, client);
2517   std::vector<content::ColorSuggestion> color_suggestions;
2518   for (size_t i = 0; i < suggestions.size(); i++) {
2519     color_suggestions.push_back(content::ColorSuggestion(suggestions[i]));
2520   }
2521   color_chooser->Open(static_cast<SkColor>(initial_color), color_suggestions);
2522   return color_chooser;
2523 }
2524
2525 void RenderFrameImpl::runModalAlertDialog(const blink::WebString& message) {
2526   RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_ALERT,
2527                        message,
2528                        base::string16(),
2529                        frame_->document().url(),
2530                        NULL);
2531 }
2532
2533 bool RenderFrameImpl::runModalConfirmDialog(const blink::WebString& message) {
2534   return RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_CONFIRM,
2535                               message,
2536                               base::string16(),
2537                               frame_->document().url(),
2538                               NULL);
2539 }
2540
2541 bool RenderFrameImpl::runModalPromptDialog(
2542     const blink::WebString& message,
2543     const blink::WebString& default_value,
2544     blink::WebString* actual_value) {
2545   base::string16 result;
2546   bool ok = RunJavaScriptMessage(JAVASCRIPT_MESSAGE_TYPE_PROMPT,
2547                                  message,
2548                                  default_value,
2549                                  frame_->document().url(),
2550                                  &result);
2551   if (ok)
2552     actual_value->assign(result);
2553   return ok;
2554 }
2555
2556 bool RenderFrameImpl::runModalBeforeUnloadDialog(
2557     bool is_reload,
2558     const blink::WebString& message) {
2559   // If we are swapping out, we have already run the beforeunload handler.
2560   // TODO(creis): Fix OnSwapOut to clear the frame without running beforeunload
2561   // at all, to avoid running it twice.
2562   if (render_view()->is_swapped_out_)
2563     return true;
2564
2565   // Don't allow further dialogs if we are waiting to swap out, since the
2566   // PageGroupLoadDeferrer in our stack prevents it.
2567   if (render_view()->suppress_dialogs_until_swap_out_)
2568     return false;
2569
2570   bool success = false;
2571   // This is an ignored return value, but is included so we can accept the same
2572   // response as RunJavaScriptMessage.
2573   base::string16 ignored_result;
2574   render_view()->SendAndRunNestedMessageLoop(
2575       new FrameHostMsg_RunBeforeUnloadConfirm(
2576           routing_id_, frame_->document().url(), message, is_reload,
2577           &success, &ignored_result));
2578   return success;
2579 }
2580
2581 void RenderFrameImpl::showContextMenu(const blink::WebContextMenuData& data) {
2582   ContextMenuParams params = ContextMenuParamsBuilder::Build(data);
2583   params.source_type = GetRenderWidget()->context_menu_source_type();
2584   GetRenderWidget()->OnShowHostContextMenu(&params);
2585   if (GetRenderWidget()->has_host_context_menu_location()) {
2586     params.x = GetRenderWidget()->host_context_menu_location().x();
2587     params.y = GetRenderWidget()->host_context_menu_location().y();
2588   }
2589
2590   // Plugins, e.g. PDF, don't currently update the render view when their
2591   // selected text changes, but the context menu params do contain the updated
2592   // selection. If that's the case, update the render view's state just prior
2593   // to showing the context menu.
2594   // TODO(asvitkine): http://crbug.com/152432
2595   if (ShouldUpdateSelectionTextFromContextMenuParams(
2596           selection_text_, selection_text_offset_, selection_range_, params)) {
2597     selection_text_ = params.selection_text;
2598     // TODO(asvitkine): Text offset and range is not available in this case.
2599     selection_text_offset_ = 0;
2600     selection_range_ = gfx::Range(0, selection_text_.length());
2601     // This IPC is dispatched by RenderWidetHost, so use its routing ID.
2602     Send(new ViewHostMsg_SelectionChanged(
2603         GetRenderWidget()->routing_id(), selection_text_,
2604         selection_text_offset_, selection_range_));
2605   }
2606
2607   // Serializing a GURL longer than kMaxURLChars will fail, so don't do
2608   // it.  We replace it with an empty GURL so the appropriate items are disabled
2609   // in the context menu.
2610   // TODO(jcivelli): http://crbug.com/45160 This prevents us from saving large
2611   //                 data encoded images.  We should have a way to save them.
2612   if (params.src_url.spec().size() > GetMaxURLChars())
2613     params.src_url = GURL();
2614   context_menu_node_ = data.node;
2615
2616 #if defined(OS_ANDROID)
2617   gfx::Rect start_rect;
2618   gfx::Rect end_rect;
2619   GetRenderWidget()->GetSelectionBounds(&start_rect, &end_rect);
2620   params.selection_start = gfx::Point(start_rect.x(), start_rect.bottom());
2621   params.selection_end = gfx::Point(end_rect.right(), end_rect.bottom());
2622 #endif
2623
2624   Send(new FrameHostMsg_ContextMenu(routing_id_, params));
2625 }
2626
2627 void RenderFrameImpl::clearContextMenu() {
2628   context_menu_node_.reset();
2629 }
2630
2631 void RenderFrameImpl::willSendRequest(
2632     blink::WebLocalFrame* frame,
2633     unsigned identifier,
2634     blink::WebURLRequest& request,
2635     const blink::WebURLResponse& redirect_response) {
2636   DCHECK(!frame_ || frame_ == frame);
2637   // The request my be empty during tests.
2638   if (request.url().isEmpty())
2639     return;
2640
2641   // Set the first party for cookies url if it has not been set yet (new
2642   // requests). For redirects, it is updated by WebURLLoaderImpl.
2643   if (request.firstPartyForCookies().isEmpty()) {
2644     if (request.frameType() == blink::WebURLRequest::FrameTypeTopLevel) {
2645       request.setFirstPartyForCookies(request.url());
2646     } else {
2647       // TODO(nasko): When the top-level frame is remote, there is no document.
2648       // This is broken and should be fixed to propagate the first party.
2649       WebFrame* top = frame->top();
2650       if (top->isWebLocalFrame()) {
2651         request.setFirstPartyForCookies(
2652             frame->top()->document().firstPartyForCookies());
2653       }
2654     }
2655   }
2656
2657   WebFrame* top_frame = frame->top();
2658   // TODO(nasko): Hack around asking about top-frame data source. This means
2659   // for out-of-process iframes we are treating the current frame as the
2660   // top-level frame, which is wrong.
2661   if (!top_frame || top_frame->isWebRemoteFrame())
2662     top_frame = frame;
2663   WebDataSource* provisional_data_source = top_frame->provisionalDataSource();
2664   WebDataSource* top_data_source = top_frame->dataSource();
2665   WebDataSource* data_source =
2666       provisional_data_source ? provisional_data_source : top_data_source;
2667
2668   ui::PageTransition transition_type = ui::PAGE_TRANSITION_LINK;
2669   DocumentState* document_state = DocumentState::FromDataSource(data_source);
2670   DCHECK(document_state);
2671   InternalDocumentStateData* internal_data =
2672       InternalDocumentStateData::FromDocumentState(document_state);
2673   NavigationState* navigation_state = document_state->navigation_state();
2674   transition_type = navigation_state->transition_type();
2675
2676   GURL request_url(request.url());
2677   GURL new_url;
2678   if (GetContentClient()->renderer()->WillSendRequest(
2679           frame,
2680           transition_type,
2681           request_url,
2682           request.firstPartyForCookies(),
2683           &new_url)) {
2684     request.setURL(WebURL(new_url));
2685   }
2686
2687   if (internal_data->is_cache_policy_override_set())
2688     request.setCachePolicy(internal_data->cache_policy_override());
2689
2690   // The request's extra data may indicate that we should set a custom user
2691   // agent. This needs to be done here, after WebKit is through with setting the
2692   // user agent on its own. Similarly, it may indicate that we should set an
2693   // X-Requested-With header. This must be done here to avoid breaking CORS
2694   // checks.
2695   WebString custom_user_agent;
2696   WebString requested_with;
2697   if (request.extraData()) {
2698     RequestExtraData* old_extra_data =
2699         static_cast<RequestExtraData*>(request.extraData());
2700
2701     custom_user_agent = old_extra_data->custom_user_agent();
2702     if (!custom_user_agent.isNull()) {
2703       if (custom_user_agent.isEmpty())
2704         request.clearHTTPHeaderField("User-Agent");
2705       else
2706         request.setHTTPHeaderField("User-Agent", custom_user_agent);
2707     }
2708
2709     requested_with = old_extra_data->requested_with();
2710     if (!requested_with.isNull()) {
2711       if (requested_with.isEmpty())
2712         request.clearHTTPHeaderField("X-Requested-With");
2713       else
2714         request.setHTTPHeaderField("X-Requested-With", requested_with);
2715     }
2716   }
2717
2718   // Add the default accept header for frame request if it has not been set
2719   // already.
2720   if ((request.frameType() == blink::WebURLRequest::FrameTypeTopLevel ||
2721        request.frameType() == blink::WebURLRequest::FrameTypeNested) &&
2722       request.httpHeaderField(WebString::fromUTF8(kAcceptHeader)).isEmpty()) {
2723     request.setHTTPHeaderField(WebString::fromUTF8(kAcceptHeader),
2724                                WebString::fromUTF8(kDefaultAcceptHeader));
2725   }
2726
2727   // Add an empty HTTP origin header for non GET methods if none is currently
2728   // present.
2729   request.addHTTPOriginIfNeeded(WebString());
2730
2731   // Attach |should_replace_current_entry| state to requests so that, should
2732   // this navigation later require a request transfer, all state is preserved
2733   // when it is re-created in the new process.
2734   bool should_replace_current_entry = false;
2735   if (navigation_state->is_content_initiated()) {
2736     should_replace_current_entry = data_source->replacesCurrentHistoryItem();
2737   } else {
2738     // If the navigation is browser-initiated, the NavigationState contains the
2739     // correct value instead of the WebDataSource.
2740     //
2741     // TODO(davidben): Avoid this awkward duplication of state. See comment on
2742     // NavigationState::should_replace_current_entry().
2743     should_replace_current_entry =
2744         navigation_state->should_replace_current_entry();
2745   }
2746
2747   int provider_id = kInvalidServiceWorkerProviderId;
2748   if (request.frameType() == blink::WebURLRequest::FrameTypeTopLevel ||
2749       request.frameType() == blink::WebURLRequest::FrameTypeNested) {
2750     // |provisionalDataSource| may be null in some content::ResourceFetcher
2751     // use cases, we don't hook those requests.
2752     if (frame->provisionalDataSource()) {
2753       ServiceWorkerNetworkProvider* provider =
2754           ServiceWorkerNetworkProvider::FromDocumentState(
2755               DocumentState::FromDataSource(frame->provisionalDataSource()));
2756       provider_id = provider->provider_id();
2757     }
2758   } else if (frame->dataSource()) {
2759     ServiceWorkerNetworkProvider* provider =
2760         ServiceWorkerNetworkProvider::FromDocumentState(
2761             DocumentState::FromDataSource(frame->dataSource()));
2762     provider_id = provider->provider_id();
2763   }
2764
2765   WebFrame* parent = frame->parent();
2766   int parent_routing_id = MSG_ROUTING_NONE;
2767   if (!parent) {
2768     parent_routing_id = -1;
2769   } else if (parent->isWebLocalFrame()) {
2770     parent_routing_id = FromWebFrame(parent)->GetRoutingID();
2771   } else {
2772     parent_routing_id = RenderFrameProxy::FromWebFrame(parent)->routing_id();
2773   }
2774
2775   RequestExtraData* extra_data = new RequestExtraData();
2776   extra_data->set_visibility_state(render_view_->visibilityState());
2777   extra_data->set_custom_user_agent(custom_user_agent);
2778   extra_data->set_requested_with(requested_with);
2779   extra_data->set_render_frame_id(routing_id_);
2780   extra_data->set_is_main_frame(frame == top_frame);
2781   extra_data->set_frame_origin(
2782       GURL(frame->document().securityOrigin().toString()));
2783   extra_data->set_parent_is_main_frame(frame->parent() == top_frame);
2784   extra_data->set_parent_render_frame_id(parent_routing_id);
2785   extra_data->set_allow_download(navigation_state->allow_download());
2786   extra_data->set_transition_type(transition_type);
2787   extra_data->set_should_replace_current_entry(should_replace_current_entry);
2788   extra_data->set_transferred_request_child_id(
2789       navigation_state->transferred_request_child_id());
2790   extra_data->set_transferred_request_request_id(
2791       navigation_state->transferred_request_request_id());
2792   extra_data->set_service_worker_provider_id(provider_id);
2793   request.setExtraData(extra_data);
2794
2795   DocumentState* top_document_state =
2796       DocumentState::FromDataSource(top_data_source);
2797   if (top_document_state) {
2798     // TODO(gavinp): separate out prefetching and prerender field trials
2799     // if the rel=prerender rel type is sticking around.
2800     if (request.requestContext() == WebURLRequest::RequestContextPrefetch)
2801       top_document_state->set_was_prefetcher(true);
2802   }
2803
2804   // This is an instance where we embed a copy of the routing id
2805   // into the data portion of the message. This can cause problems if we
2806   // don't register this id on the browser side, since the download manager
2807   // expects to find a RenderViewHost based off the id.
2808   request.setRequestorID(render_view_->GetRoutingID());
2809   request.setHasUserGesture(WebUserGestureIndicator::isProcessingUserGesture());
2810
2811   if (!navigation_state->extra_headers().empty()) {
2812     for (net::HttpUtil::HeadersIterator i(
2813         navigation_state->extra_headers().begin(),
2814         navigation_state->extra_headers().end(), "\n");
2815         i.GetNext(); ) {
2816       if (LowerCaseEqualsASCII(i.name(), "referer")) {
2817         WebString referrer = WebSecurityPolicy::generateReferrerHeader(
2818             blink::WebReferrerPolicyDefault,
2819             request.url(),
2820             WebString::fromUTF8(i.values()));
2821         request.setHTTPReferrer(referrer, blink::WebReferrerPolicyDefault);
2822       } else {
2823         request.setHTTPHeaderField(WebString::fromUTF8(i.name()),
2824                                    WebString::fromUTF8(i.values()));
2825       }
2826     }
2827   }
2828
2829   if (!render_view_->renderer_preferences_.enable_referrers)
2830     request.setHTTPReferrer(WebString(), blink::WebReferrerPolicyDefault);
2831 }
2832
2833 void RenderFrameImpl::didReceiveResponse(
2834     blink::WebLocalFrame* frame,
2835     unsigned identifier,
2836     const blink::WebURLResponse& response) {
2837   DCHECK(!frame_ || frame_ == frame);
2838   // Only do this for responses that correspond to a provisional data source
2839   // of the top-most frame.  If we have a provisional data source, then we
2840   // can't have any sub-resources yet, so we know that this response must
2841   // correspond to a frame load.
2842   if (!frame->provisionalDataSource() || frame->parent())
2843     return;
2844
2845   // If we are in view source mode, then just let the user see the source of
2846   // the server's error page.
2847   if (frame->isViewSourceModeEnabled())
2848     return;
2849
2850   DocumentState* document_state =
2851       DocumentState::FromDataSource(frame->provisionalDataSource());
2852   int http_status_code = response.httpStatusCode();
2853
2854   // Record page load flags.
2855   WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
2856   if (extra_data) {
2857     document_state->set_was_fetched_via_spdy(
2858         extra_data->was_fetched_via_spdy());
2859     document_state->set_was_npn_negotiated(
2860         extra_data->was_npn_negotiated());
2861     document_state->set_npn_negotiated_protocol(
2862         extra_data->npn_negotiated_protocol());
2863     document_state->set_was_alternate_protocol_available(
2864         extra_data->was_alternate_protocol_available());
2865     document_state->set_connection_info(
2866         extra_data->connection_info());
2867     document_state->set_was_fetched_via_proxy(
2868         extra_data->was_fetched_via_proxy());
2869   }
2870   InternalDocumentStateData* internal_data =
2871       InternalDocumentStateData::FromDocumentState(document_state);
2872   internal_data->set_http_status_code(http_status_code);
2873   // Whether or not the http status code actually corresponds to an error is
2874   // only checked when the page is done loading, if |use_error_page| is
2875   // still true.
2876   internal_data->set_use_error_page(true);
2877 }
2878
2879 void RenderFrameImpl::didFinishResourceLoad(blink::WebLocalFrame* frame,
2880                                             unsigned identifier) {
2881   DCHECK(!frame_ || frame_ == frame);
2882   InternalDocumentStateData* internal_data =
2883       InternalDocumentStateData::FromDataSource(frame->dataSource());
2884   if (!internal_data->use_error_page())
2885     return;
2886
2887   // Do not show error page when DevTools is attached.
2888   if (render_view_->devtools_agent_->IsAttached())
2889     return;
2890
2891   // Display error page, if appropriate.
2892   std::string error_domain = "http";
2893   int http_status_code = internal_data->http_status_code();
2894   if (GetContentClient()->renderer()->HasErrorPage(
2895           http_status_code, &error_domain)) {
2896     WebURLError error;
2897     error.unreachableURL = frame->document().url();
2898     error.domain = WebString::fromUTF8(error_domain);
2899     error.reason = http_status_code;
2900     LoadNavigationErrorPage(frame->dataSource()->request(), error, true);
2901   }
2902 }
2903
2904 void RenderFrameImpl::didLoadResourceFromMemoryCache(
2905     blink::WebLocalFrame* frame,
2906     const blink::WebURLRequest& request,
2907     const blink::WebURLResponse& response) {
2908   DCHECK(!frame_ || frame_ == frame);
2909   // The recipients of this message have no use for data: URLs: they don't
2910   // affect the page's insecure content list and are not in the disk cache. To
2911   // prevent large (1M+) data: URLs from crashing in the IPC system, we simply
2912   // filter them out here.
2913   GURL url(request.url());
2914   if (url.SchemeIs(url::kDataScheme))
2915     return;
2916
2917   // Let the browser know we loaded a resource from the memory cache.  This
2918   // message is needed to display the correct SSL indicators.
2919   render_view_->Send(new ViewHostMsg_DidLoadResourceFromMemoryCache(
2920       render_view_->GetRoutingID(),
2921       url,
2922       response.securityInfo(),
2923       request.httpMethod().utf8(),
2924       response.mimeType().utf8(),
2925       WebURLRequestToResourceType(request)));
2926 }
2927
2928 void RenderFrameImpl::didDisplayInsecureContent(blink::WebLocalFrame* frame) {
2929   DCHECK(!frame_ || frame_ == frame);
2930   render_view_->Send(new ViewHostMsg_DidDisplayInsecureContent(
2931       render_view_->GetRoutingID()));
2932 }
2933
2934 void RenderFrameImpl::didRunInsecureContent(
2935     blink::WebLocalFrame* frame,
2936     const blink::WebSecurityOrigin& origin,
2937     const blink::WebURL& target) {
2938   DCHECK(!frame_ || frame_ == frame);
2939   render_view_->Send(new ViewHostMsg_DidRunInsecureContent(
2940       render_view_->GetRoutingID(),
2941       origin.toString().utf8(),
2942       target));
2943 }
2944
2945 void RenderFrameImpl::didAbortLoading(blink::WebLocalFrame* frame) {
2946   DCHECK(!frame_ || frame_ == frame);
2947 #if defined(ENABLE_PLUGINS)
2948   if (frame != render_view_->webview()->mainFrame())
2949     return;
2950   PluginChannelHost::Broadcast(
2951       new PluginHostMsg_DidAbortLoading(render_view_->GetRoutingID()));
2952 #endif
2953 }
2954
2955 void RenderFrameImpl::didCreateScriptContext(blink::WebLocalFrame* frame,
2956                                              v8::Handle<v8::Context> context,
2957                                              int extension_group,
2958                                              int world_id) {
2959   DCHECK(!frame_ || frame_ == frame);
2960   GetContentClient()->renderer()->DidCreateScriptContext(
2961       frame, context, extension_group, world_id);
2962 }
2963
2964 void RenderFrameImpl::willReleaseScriptContext(blink::WebLocalFrame* frame,
2965                                                v8::Handle<v8::Context> context,
2966                                                int world_id) {
2967   DCHECK(!frame_ || frame_ == frame);
2968
2969   FOR_EACH_OBSERVER(RenderFrameObserver,
2970                     observers_,
2971                     WillReleaseScriptContext(context, world_id));
2972 }
2973
2974 void RenderFrameImpl::didFirstVisuallyNonEmptyLayout(
2975     blink::WebLocalFrame* frame) {
2976   DCHECK(!frame_ || frame_ == frame);
2977   if (frame->parent())
2978     return;
2979
2980   InternalDocumentStateData* data =
2981       InternalDocumentStateData::FromDataSource(frame->dataSource());
2982   data->set_did_first_visually_non_empty_layout(true);
2983
2984 #if defined(OS_ANDROID)
2985   GetRenderWidget()->DidChangeBodyBackgroundColor(
2986       render_view_->webwidget_->backgroundColor());
2987 #endif
2988
2989   GetRenderWidget()->QueueMessage(
2990       new FrameHostMsg_DidFirstVisuallyNonEmptyPaint(routing_id_),
2991       MESSAGE_DELIVERY_POLICY_WITH_VISUAL_STATE);
2992 }
2993
2994 void RenderFrameImpl::didChangeScrollOffset(blink::WebLocalFrame* frame) {
2995   DCHECK(!frame_ || frame_ == frame);
2996   // TODO(nasko): Move implementation here. Needed methods:
2997   // * StartNavStateSyncTimerIfNecessary
2998   render_view_->didChangeScrollOffset(frame);
2999 }
3000
3001 void RenderFrameImpl::willInsertBody(blink::WebLocalFrame* frame) {
3002   DCHECK(!frame_ || frame_ == frame);
3003   if (!frame->parent()) {
3004     render_view_->Send(new ViewHostMsg_WillInsertBody(
3005         render_view_->GetRoutingID()));
3006   }
3007 }
3008
3009 void RenderFrameImpl::reportFindInPageMatchCount(int request_id,
3010                                                  int count,
3011                                                  bool final_update) {
3012   int active_match_ordinal = -1;  // -1 = don't update active match ordinal
3013   if (!count)
3014     active_match_ordinal = 0;
3015
3016   render_view_->Send(new ViewHostMsg_Find_Reply(
3017       render_view_->GetRoutingID(), request_id, count,
3018       gfx::Rect(), active_match_ordinal, final_update));
3019 }
3020
3021 void RenderFrameImpl::reportFindInPageSelection(
3022     int request_id,
3023     int active_match_ordinal,
3024     const blink::WebRect& selection_rect) {
3025   render_view_->Send(new ViewHostMsg_Find_Reply(
3026       render_view_->GetRoutingID(), request_id, -1, selection_rect,
3027       active_match_ordinal, false));
3028 }
3029
3030 void RenderFrameImpl::requestStorageQuota(
3031     blink::WebLocalFrame* frame,
3032     blink::WebStorageQuotaType type,
3033     unsigned long long requested_size,
3034     blink::WebStorageQuotaCallbacks callbacks) {
3035   DCHECK(!frame_ || frame_ == frame);
3036   WebSecurityOrigin origin = frame->document().securityOrigin();
3037   if (origin.isUnique()) {
3038     // Unique origins cannot store persistent state.
3039     callbacks.didFail(blink::WebStorageQuotaErrorAbort);
3040     return;
3041   }
3042   ChildThread::current()->quota_dispatcher()->RequestStorageQuota(
3043       render_view_->GetRoutingID(),
3044       GURL(origin.toString()),
3045       static_cast<storage::StorageType>(type),
3046       requested_size,
3047       QuotaDispatcher::CreateWebStorageQuotaCallbacksWrapper(callbacks));
3048 }
3049
3050 void RenderFrameImpl::willOpenSocketStream(
3051     blink::WebSocketStreamHandle* handle) {
3052   WebSocketStreamHandleImpl* impl =
3053       static_cast<WebSocketStreamHandleImpl*>(handle);
3054   impl->SetUserData(handle, new SocketStreamHandleData(routing_id_));
3055 }
3056
3057 void RenderFrameImpl::willOpenWebSocket(blink::WebSocketHandle* handle) {
3058   WebSocketBridge* impl = static_cast<WebSocketBridge*>(handle);
3059   impl->set_render_frame_id(routing_id_);
3060 }
3061
3062 blink::WebGeolocationClient* RenderFrameImpl::geolocationClient() {
3063   if (!geolocation_dispatcher_)
3064     geolocation_dispatcher_ = new GeolocationDispatcher(this);
3065   return geolocation_dispatcher_;
3066 }
3067
3068 blink::WebPushClient* RenderFrameImpl::pushClient() {
3069   if (!push_messaging_dispatcher_)
3070     push_messaging_dispatcher_ = new PushMessagingDispatcher(this);
3071   return push_messaging_dispatcher_;
3072 }
3073
3074 void RenderFrameImpl::willStartUsingPeerConnectionHandler(
3075     blink::WebLocalFrame* frame,
3076     blink::WebRTCPeerConnectionHandler* handler) {
3077   DCHECK(!frame_ || frame_ == frame);
3078 #if defined(ENABLE_WEBRTC)
3079   static_cast<RTCPeerConnectionHandler*>(handler)->associateWithFrame(frame);
3080 #endif
3081 }
3082
3083 blink::WebUserMediaClient* RenderFrameImpl::userMediaClient() {
3084   if (!web_user_media_client_)
3085     InitializeUserMediaClient();
3086   return web_user_media_client_;
3087 }
3088
3089 blink::WebMIDIClient* RenderFrameImpl::webMIDIClient() {
3090   if (!midi_dispatcher_)
3091     midi_dispatcher_ = new MidiDispatcher(this);
3092   return midi_dispatcher_;
3093 }
3094
3095 bool RenderFrameImpl::willCheckAndDispatchMessageEvent(
3096     blink::WebLocalFrame* source_frame,
3097     blink::WebFrame* target_frame,
3098     blink::WebSecurityOrigin target_origin,
3099     blink::WebDOMMessageEvent event) {
3100   DCHECK(!frame_ || frame_ == target_frame);
3101
3102   if (!render_view_->is_swapped_out_)
3103     return false;
3104
3105   ViewMsg_PostMessage_Params params;
3106   params.is_data_raw_string = false;
3107   params.data = event.data().toString();
3108   params.source_origin = event.origin();
3109   if (!target_origin.isNull())
3110     params.target_origin = target_origin.toString();
3111
3112   blink::WebMessagePortChannelArray channels = event.releaseChannels();
3113   if (!channels.isEmpty()) {
3114     std::vector<int> message_port_ids(channels.size());
3115      // Extract the port IDs from the channel array.
3116      for (size_t i = 0; i < channels.size(); ++i) {
3117        WebMessagePortChannelImpl* webchannel =
3118            static_cast<WebMessagePortChannelImpl*>(channels[i]);
3119        message_port_ids[i] = webchannel->message_port_id();
3120        webchannel->QueueMessages();
3121        DCHECK_NE(message_port_ids[i], MSG_ROUTING_NONE);
3122      }
3123      params.message_port_ids = message_port_ids;
3124   }
3125
3126   // Include the routing ID for the source frame (if one exists), which the
3127   // browser process will translate into the routing ID for the equivalent
3128   // frame in the target process.
3129   params.source_routing_id = MSG_ROUTING_NONE;
3130   if (source_frame) {
3131     RenderViewImpl* source_view =
3132         RenderViewImpl::FromWebView(source_frame->view());
3133     if (source_view)
3134       params.source_routing_id = source_view->routing_id();
3135   }
3136
3137   Send(new ViewHostMsg_RouteMessageEvent(render_view_->routing_id_, params));
3138   return true;
3139 }
3140
3141 blink::WebString RenderFrameImpl::userAgentOverride(blink::WebLocalFrame* frame,
3142                                                     const blink::WebURL& url) {
3143   DCHECK(!frame_ || frame_ == frame);
3144   if (!render_view_->webview() || !render_view_->webview()->mainFrame() ||
3145       render_view_->renderer_preferences_.user_agent_override.empty()) {
3146     return blink::WebString();
3147   }
3148
3149   // If we're in the middle of committing a load, the data source we need
3150   // will still be provisional.
3151   WebFrame* main_frame = render_view_->webview()->mainFrame();
3152   WebDataSource* data_source = NULL;
3153   if (main_frame->provisionalDataSource())
3154     data_source = main_frame->provisionalDataSource();
3155   else
3156     data_source = main_frame->dataSource();
3157
3158   InternalDocumentStateData* internal_data = data_source ?
3159       InternalDocumentStateData::FromDataSource(data_source) : NULL;
3160   if (internal_data && internal_data->is_overriding_user_agent())
3161     return WebString::fromUTF8(
3162         render_view_->renderer_preferences_.user_agent_override);
3163   return blink::WebString();
3164 }
3165
3166 blink::WebString RenderFrameImpl::doNotTrackValue(blink::WebLocalFrame* frame) {
3167   DCHECK(!frame_ || frame_ == frame);
3168   if (render_view_->renderer_preferences_.enable_do_not_track)
3169     return WebString::fromUTF8("1");
3170   return WebString();
3171 }
3172
3173 bool RenderFrameImpl::allowWebGL(blink::WebLocalFrame* frame,
3174                                  bool default_value) {
3175   DCHECK(!frame_ || frame_ == frame);
3176   if (!default_value)
3177     return false;
3178
3179   bool blocked = true;
3180   render_view_->Send(new ViewHostMsg_Are3DAPIsBlocked(
3181       render_view_->GetRoutingID(),
3182       GURL(frame->top()->document().securityOrigin().toString()),
3183       THREE_D_API_TYPE_WEBGL,
3184       &blocked));
3185   return !blocked;
3186 }
3187
3188 void RenderFrameImpl::didLoseWebGLContext(blink::WebLocalFrame* frame,
3189                                           int arb_robustness_status_code) {
3190   DCHECK(!frame_ || frame_ == frame);
3191   render_view_->Send(new ViewHostMsg_DidLose3DContext(
3192       GURL(frame->top()->document().securityOrigin().toString()),
3193       THREE_D_API_TYPE_WEBGL,
3194       arb_robustness_status_code));
3195 }
3196
3197 void RenderFrameImpl::forwardInputEvent(const blink::WebInputEvent* event) {
3198   Send(new FrameHostMsg_ForwardInputEvent(routing_id_, event));
3199 }
3200
3201 blink::WebScreenOrientationClient*
3202     RenderFrameImpl::webScreenOrientationClient() {
3203   if (!screen_orientation_dispatcher_)
3204     screen_orientation_dispatcher_ = new ScreenOrientationDispatcher(this);
3205   return screen_orientation_dispatcher_;
3206 }
3207
3208 bool RenderFrameImpl::isControlledByServiceWorker() {
3209   // If we're in the middle of committing a load, the data source we need
3210   // will still be provisional.
3211   WebFrame* main_frame = render_view_->webview()->mainFrame();
3212   WebDataSource* data_source = NULL;
3213   if (main_frame->provisionalDataSource())
3214     data_source = main_frame->provisionalDataSource();
3215   else
3216     data_source = main_frame->dataSource();
3217   ServiceWorkerNetworkProvider* provider =
3218       ServiceWorkerNetworkProvider::FromDocumentState(
3219           DocumentState::FromDataSource(data_source));
3220   return provider->context()->controller_handle_id() !=
3221       kInvalidServiceWorkerHandleId;
3222 }
3223
3224 void RenderFrameImpl::postAccessibilityEvent(const blink::WebAXObject& obj,
3225                                              blink::WebAXEvent event) {
3226   HandleWebAccessibilityEvent(obj, event);
3227 }
3228
3229 void RenderFrameImpl::didChangeManifest(blink::WebLocalFrame* frame)
3230 {
3231   DCHECK(!frame_ || frame_ == frame);
3232
3233   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidChangeManifest());
3234 }
3235
3236 void RenderFrameImpl::DidPlay(blink::WebMediaPlayer* player) {
3237   Send(new FrameHostMsg_MediaPlayingNotification(
3238       routing_id_, reinterpret_cast<int64>(player), player->hasVideo(),
3239       player->hasAudio(), player->isRemote()));
3240 }
3241
3242 void RenderFrameImpl::DidPause(blink::WebMediaPlayer* player) {
3243   Send(new FrameHostMsg_MediaPausedNotification(
3244       routing_id_, reinterpret_cast<int64>(player)));
3245 }
3246
3247 void RenderFrameImpl::PlayerGone(blink::WebMediaPlayer* player) {
3248   DidPause(player);
3249 }
3250
3251 void RenderFrameImpl::AddObserver(RenderFrameObserver* observer) {
3252   observers_.AddObserver(observer);
3253 }
3254
3255 void RenderFrameImpl::RemoveObserver(RenderFrameObserver* observer) {
3256   observer->RenderFrameGone();
3257   observers_.RemoveObserver(observer);
3258 }
3259
3260 void RenderFrameImpl::OnStop() {
3261   DCHECK(frame_);
3262   frame_->stopLoading();
3263   if (!frame_->parent())
3264     FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers_, OnStop());
3265
3266   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, OnStop());
3267 }
3268
3269 void RenderFrameImpl::WasHidden() {
3270   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WasHidden());
3271 }
3272
3273 void RenderFrameImpl::WasShown() {
3274   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, WasShown());
3275 }
3276
3277 bool RenderFrameImpl::IsHidden() {
3278   return GetRenderWidget()->is_hidden();
3279 }
3280
3281 // Tell the embedding application that the URL of the active page has changed.
3282 void RenderFrameImpl::SendDidCommitProvisionalLoad(blink::WebFrame* frame) {
3283   DCHECK(!frame_ || frame_ == frame);
3284   WebDataSource* ds = frame->dataSource();
3285   DCHECK(ds);
3286
3287   const WebURLRequest& request = ds->request();
3288   const WebURLResponse& response = ds->response();
3289
3290   DocumentState* document_state = DocumentState::FromDataSource(ds);
3291   NavigationState* navigation_state = document_state->navigation_state();
3292   InternalDocumentStateData* internal_data =
3293       InternalDocumentStateData::FromDocumentState(document_state);
3294
3295   FrameHostMsg_DidCommitProvisionalLoad_Params params;
3296   params.http_status_code = response.httpStatusCode();
3297   params.url_is_unreachable = ds->hasUnreachableURL();
3298   params.is_post = false;
3299   params.post_id = -1;
3300   params.page_id = render_view_->page_id_;
3301   // We need to track the RenderViewHost routing_id because of downstream
3302   // dependencies (crbug.com/392171 DownloadRequestHandle, SaveFileManager,
3303   // ResourceDispatcherHostImpl, MediaStreamUIProxy,
3304   // SpeechRecognitionDispatcherHost and possibly others). They look up the view
3305   // based on the ID stored in the resource requests. Once those dependencies
3306   // are unwound or moved to RenderFrameHost (crbug.com/304341) we can move the
3307   // client to be based on the routing_id of the RenderFrameHost.
3308   params.render_view_routing_id = render_view_->routing_id();
3309   params.socket_address.set_host(response.remoteIPAddress().utf8());
3310   params.socket_address.set_port(response.remotePort());
3311   WebURLResponseExtraDataImpl* extra_data = GetExtraDataFromResponse(response);
3312   if (extra_data)
3313     params.was_fetched_via_proxy = extra_data->was_fetched_via_proxy();
3314   params.was_within_same_page = navigation_state->was_within_same_page();
3315   params.security_info = response.securityInfo();
3316
3317   // Set the URL to be displayed in the browser UI to the user.
3318   params.url = GetLoadingUrl();
3319   DCHECK(!is_swapped_out_ || params.url == GURL(kSwappedOutURL));
3320
3321   if (frame->document().baseURL() != params.url)
3322     params.base_url = frame->document().baseURL();
3323
3324   GetRedirectChain(ds, &params.redirects);
3325   params.should_update_history = !ds->hasUnreachableURL() &&
3326       !response.isMultipartPayload() && (response.httpStatusCode() != 404);
3327
3328   params.searchable_form_url = internal_data->searchable_form_url();
3329   params.searchable_form_encoding = internal_data->searchable_form_encoding();
3330
3331   params.gesture = render_view_->navigation_gesture_;
3332   render_view_->navigation_gesture_ = NavigationGestureUnknown;
3333
3334   // Make navigation state a part of the DidCommitProvisionalLoad message so
3335   // that commited entry has it at all times.
3336   HistoryEntry* entry = render_view_->history_controller()->GetCurrentEntry();
3337   if (entry)
3338     params.page_state = HistoryEntryToPageState(entry);
3339   else
3340     params.page_state = PageState::CreateFromURL(request.url());
3341
3342   if (!frame->parent()) {
3343     // Top-level navigation.
3344
3345     // Reset the zoom limits in case a plugin had changed them previously. This
3346     // will also call us back which will cause us to send a message to
3347     // update WebContentsImpl.
3348     render_view_->webview()->zoomLimitsChanged(
3349         ZoomFactorToZoomLevel(kMinimumZoomFactor),
3350         ZoomFactorToZoomLevel(kMaximumZoomFactor));
3351
3352     // Set zoom level, but don't do it for full-page plugin since they don't use
3353     // the same zoom settings.
3354     HostZoomLevels::iterator host_zoom =
3355         render_view_->host_zoom_levels_.find(GURL(request.url()));
3356     if (render_view_->webview()->mainFrame()->document().isPluginDocument()) {
3357       // Reset the zoom levels for plugins.
3358       render_view_->webview()->setZoomLevel(0);
3359     } else {
3360       if (host_zoom != render_view_->host_zoom_levels_.end())
3361         render_view_->webview()->setZoomLevel(host_zoom->second);
3362     }
3363
3364     if (host_zoom != render_view_->host_zoom_levels_.end()) {
3365       // This zoom level was merely recorded transiently for this load.  We can
3366       // erase it now.  If at some point we reload this page, the browser will
3367       // send us a new, up-to-date zoom level.
3368       render_view_->host_zoom_levels_.erase(host_zoom);
3369     }
3370
3371     // Update contents MIME type for main frame.
3372     params.contents_mime_type = ds->response().mimeType().utf8();
3373
3374     params.transition = navigation_state->transition_type();
3375     if (!ui::PageTransitionIsMainFrame(params.transition)) {
3376       // If the main frame does a load, it should not be reported as a subframe
3377       // navigation.  This can occur in the following case:
3378       // 1. You're on a site with frames.
3379       // 2. You do a subframe navigation.  This is stored with transition type
3380       //    MANUAL_SUBFRAME.
3381       // 3. You navigate to some non-frame site, say, google.com.
3382       // 4. You navigate back to the page from step 2.  Since it was initially
3383       //    MANUAL_SUBFRAME, it will be that same transition type here.
3384       // We don't want that, because any navigation that changes the toplevel
3385       // frame should be tracked as a toplevel navigation (this allows us to
3386       // update the URL bar, etc).
3387       params.transition = ui::PAGE_TRANSITION_LINK;
3388     }
3389
3390     // If the page contained a client redirect (meta refresh, document.loc...),
3391     // set the referrer and transition appropriately.
3392     if (ds->isClientRedirect()) {
3393       params.referrer =
3394           Referrer(params.redirects[0], ds->request().referrerPolicy());
3395       params.transition = ui::PageTransitionFromInt(
3396           params.transition | ui::PAGE_TRANSITION_CLIENT_REDIRECT);
3397     } else {
3398       params.referrer = RenderViewImpl::GetReferrerFromRequest(
3399           frame, ds->request());
3400     }
3401
3402     base::string16 method = request.httpMethod();
3403     if (EqualsASCII(method, "POST")) {
3404       params.is_post = true;
3405       params.post_id = ExtractPostId(entry->root());
3406     }
3407
3408     // Send the user agent override back.
3409     params.is_overriding_user_agent = internal_data->is_overriding_user_agent();
3410
3411     // Track the URL of the original request.  We use the first entry of the
3412     // redirect chain if it exists because the chain may have started in another
3413     // process.
3414     params.original_request_url = GetOriginalRequestURL(ds);
3415
3416     params.history_list_was_cleared =
3417         navigation_state->history_list_was_cleared();
3418
3419     // Save some histogram data so we can compute the average memory used per
3420     // page load of the glyphs.
3421     UMA_HISTOGRAM_COUNTS_10000("Memory.GlyphPagesPerLoad",
3422                                blink::WebGlyphCache::pageCount());
3423
3424     // This message needs to be sent before any of allowScripts(),
3425     // allowImages(), allowPlugins() is called for the new page, so that when
3426     // these functions send a ViewHostMsg_ContentBlocked message, it arrives
3427     // after the FrameHostMsg_DidCommitProvisionalLoad message.
3428     Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
3429   } else {
3430     // Subframe navigation: the type depends on whether this navigation
3431     // generated a new session history entry. When they do generate a session
3432     // history entry, it means the user initiated the navigation and we should
3433     // mark it as such. This test checks if this is the first time
3434     // SendDidCommitProvisionalLoad has been called since WillNavigateToURL was
3435     // called to initiate the load.
3436     if (render_view_->page_id_ > render_view_->last_page_id_sent_to_browser_)
3437       params.transition = ui::PAGE_TRANSITION_MANUAL_SUBFRAME;
3438     else
3439       params.transition = ui::PAGE_TRANSITION_AUTO_SUBFRAME;
3440
3441     DCHECK(!navigation_state->history_list_was_cleared());
3442     params.history_list_was_cleared = false;
3443
3444     // Don't send this message while the subframe is swapped out.
3445     if (!is_swapped_out())
3446       Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
3447   }
3448
3449   render_view_->last_page_id_sent_to_browser_ =
3450       std::max(render_view_->last_page_id_sent_to_browser_,
3451                render_view_->page_id_);
3452
3453   // If we end up reusing this WebRequest (for example, due to a #ref click),
3454   // we don't want the transition type to persist.  Just clear it.
3455   navigation_state->set_transition_type(ui::PAGE_TRANSITION_LINK);
3456 }
3457
3458 WebElement RenderFrameImpl::GetFocusedElement() {
3459   WebDocument doc = frame_->document();
3460   if (!doc.isNull())
3461     return doc.focusedElement();
3462
3463   return WebElement();
3464 }
3465
3466 void RenderFrameImpl::didStartLoading(bool to_different_document) {
3467   TRACE_EVENT1("navigation", "RenderFrameImpl::didStartLoading",
3468                "id", routing_id_);
3469   render_view_->FrameDidStartLoading(frame_);
3470   Send(new FrameHostMsg_DidStartLoading(routing_id_, to_different_document));
3471 }
3472
3473 void RenderFrameImpl::didStopLoading() {
3474   TRACE_EVENT1("navigation", "RenderFrameImpl::didStopLoading",
3475                "id", routing_id_);
3476   render_view_->FrameDidStopLoading(frame_);
3477   Send(new FrameHostMsg_DidStopLoading(routing_id_));
3478 }
3479
3480 void RenderFrameImpl::didChangeLoadProgress(double load_progress) {
3481   Send(new FrameHostMsg_DidChangeLoadProgress(routing_id_, load_progress));
3482 }
3483
3484 void RenderFrameImpl::HandleWebAccessibilityEvent(
3485     const blink::WebAXObject& obj, blink::WebAXEvent event) {
3486   if (renderer_accessibility_)
3487     renderer_accessibility_->HandleWebAccessibilityEvent(obj, event);
3488 }
3489
3490 void RenderFrameImpl::FocusedNodeChanged(const WebNode& node) {
3491   if (renderer_accessibility_)
3492     renderer_accessibility_->FocusedNodeChanged(node);
3493 }
3494
3495 WebNavigationPolicy RenderFrameImpl::DecidePolicyForNavigation(
3496     RenderFrame* render_frame,
3497     const NavigationPolicyInfo& info) {
3498 #ifdef OS_ANDROID
3499   // The handlenavigation API is deprecated and will be removed once
3500   // crbug.com/325351 is resolved.
3501   if (info.urlRequest.url() != GURL(kSwappedOutURL) &&
3502       GetContentClient()->renderer()->HandleNavigation(
3503           render_frame,
3504           static_cast<DocumentState*>(info.extraData),
3505           render_view_->opener_id_,
3506           info.frame,
3507           info.urlRequest,
3508           info.navigationType,
3509           info.defaultPolicy,
3510           info.isRedirect)) {
3511     return blink::WebNavigationPolicyIgnore;
3512   }
3513 #endif
3514
3515   Referrer referrer(RenderViewImpl::GetReferrerFromRequest(info.frame,
3516                                                            info.urlRequest));
3517   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
3518
3519   bool is_subframe = !!info.frame->parent();
3520
3521   if (command_line.HasSwitch(switches::kSitePerProcess) && is_subframe) {
3522     // There's no reason to ignore navigations on subframes, since the swap out
3523     // logic no longer applies.
3524   } else {
3525     if (is_swapped_out_ || render_view_->is_swapped_out()) {
3526       if (info.urlRequest.url() != GURL(kSwappedOutURL)) {
3527         // Targeted links may try to navigate a swapped out frame.  Allow the
3528         // browser process to navigate the tab instead.  Note that it is also
3529         // possible for non-targeted navigations (from this view) to arrive
3530         // here just after we are swapped out.  It's ok to send them to the
3531         // browser, as long as they're for the top level frame.
3532         // TODO(creis): Ensure this supports targeted form submissions when
3533         // fixing http://crbug.com/101395.
3534         if (info.frame->parent() == NULL) {
3535           OpenURL(info.frame, info.urlRequest.url(), referrer,
3536                   info.defaultPolicy);
3537           return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
3538         }
3539
3540         // We should otherwise ignore in-process iframe navigations, if they
3541         // arrive just after we are swapped out.
3542         return blink::WebNavigationPolicyIgnore;
3543       }
3544
3545       // Allow kSwappedOutURL to complete.
3546       return info.defaultPolicy;
3547     }
3548   }
3549
3550   // Webkit is asking whether to navigate to a new URL.
3551   // This is fine normally, except if we're showing UI from one security
3552   // context and they're trying to navigate to a different context.
3553   const GURL& url = info.urlRequest.url();
3554
3555   // A content initiated navigation may have originated from a link-click,
3556   // script, drag-n-drop operation, etc.
3557   bool is_content_initiated = static_cast<DocumentState*>(info.extraData)->
3558           navigation_state()->is_content_initiated();
3559
3560   // Experimental:
3561   // If --enable-strict-site-isolation or --site-per-process is enabled, send
3562   // all top-level navigations to the browser to let it swap processes when
3563   // crossing site boundaries.  This is currently expected to break some script
3564   // calls and navigations, such as form submissions.
3565   bool force_swap_due_to_flag =
3566       command_line.HasSwitch(switches::kEnableStrictSiteIsolation) ||
3567       command_line.HasSwitch(switches::kSitePerProcess);
3568   if (force_swap_due_to_flag &&
3569       !info.frame->parent() && (is_content_initiated || info.isRedirect)) {
3570     WebString origin_str = info.frame->document().securityOrigin().toString();
3571     GURL frame_url(origin_str.utf8().data());
3572     // TODO(cevans): revisit whether this site check is still necessary once
3573     // crbug.com/101395 is fixed.
3574     bool same_domain_or_host =
3575         net::registry_controlled_domains::SameDomainOrHost(
3576             frame_url,
3577             url,
3578             net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
3579     if (!same_domain_or_host || frame_url.scheme() != url.scheme()) {
3580       OpenURL(info.frame, url, referrer, info.defaultPolicy);
3581       return blink::WebNavigationPolicyIgnore;
3582     }
3583   }
3584
3585   // If the browser is interested, then give it a chance to look at the request.
3586   if (is_content_initiated) {
3587     bool is_form_post =
3588         ((info.navigationType == blink::WebNavigationTypeFormSubmitted) ||
3589             (info.navigationType == blink::WebNavigationTypeFormResubmitted)) &&
3590         EqualsASCII(info.urlRequest.httpMethod(), "POST");
3591     bool browser_handles_request =
3592         render_view_->renderer_preferences_
3593             .browser_handles_non_local_top_level_requests
3594         && IsNonLocalTopLevelNavigation(url, info.frame, info.navigationType,
3595                                         is_form_post);
3596     if (!browser_handles_request) {
3597       browser_handles_request = IsTopLevelNavigation(info.frame) &&
3598           render_view_->renderer_preferences_
3599               .browser_handles_all_top_level_requests;
3600     }
3601
3602     if (browser_handles_request) {
3603       OpenURL(info.frame, url, referrer, info.defaultPolicy);
3604       return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
3605     }
3606   }
3607
3608   // Use the frame's original request's URL rather than the document's URL for
3609   // subsequent checks.  For a popup, the document's URL may become the opener
3610   // window's URL if the opener has called document.write().
3611   // See http://crbug.com/93517.
3612   GURL old_url(info.frame->dataSource()->request().url());
3613
3614   // Detect when we're crossing a permission-based boundary (e.g. into or out of
3615   // an extension or app origin, leaving a WebUI page, etc). We only care about
3616   // top-level navigations (not iframes). But we sometimes navigate to
3617   // about:blank to clear a tab, and we want to still allow that.
3618   //
3619   // Note: this is known to break POST submissions when crossing process
3620   // boundaries until http://crbug.com/101395 is fixed.  This is better for
3621   // security than loading a WebUI, extension or app page in the wrong process.
3622   // POST requests don't work because this mechanism does not preserve form
3623   // POST data. We will need to send the request's httpBody data up to the
3624   // browser process, and issue a special POST navigation in WebKit (via
3625   // FrameLoader::loadFrameRequest). See ResourceDispatcher and WebURLLoaderImpl
3626   // for examples of how to send the httpBody data.
3627   if (!info.frame->parent() && is_content_initiated &&
3628       !url.SchemeIs(url::kAboutScheme)) {
3629     bool send_referrer = false;
3630
3631     // All navigations to or from WebUI URLs or within WebUI-enabled
3632     // RenderProcesses must be handled by the browser process so that the
3633     // correct bindings and data sources can be registered.
3634     // Similarly, navigations to view-source URLs or within ViewSource mode
3635     // must be handled by the browser process (except for reloads - those are
3636     // safe to leave within the renderer).
3637     // Lastly, access to file:// URLs from non-file:// URL pages must be
3638     // handled by the browser so that ordinary renderer processes don't get
3639     // blessed with file permissions.
3640     int cumulative_bindings = RenderProcess::current()->GetEnabledBindings();
3641     bool is_initial_navigation = render_view_->page_id_ == -1;
3642     bool should_fork = HasWebUIScheme(url) || HasWebUIScheme(old_url) ||
3643         (cumulative_bindings & BINDINGS_POLICY_WEB_UI) ||
3644         url.SchemeIs(kViewSourceScheme) ||
3645         (info.frame->isViewSourceModeEnabled() &&
3646             info.navigationType != blink::WebNavigationTypeReload);
3647
3648     if (!should_fork && url.SchemeIs(url::kFileScheme)) {
3649       // Fork non-file to file opens.  Check the opener URL if this is the
3650       // initial navigation in a newly opened window.
3651       GURL source_url(old_url);
3652       if (is_initial_navigation && source_url.is_empty() &&
3653           info.frame->opener())
3654         source_url = info.frame->opener()->top()->document().url();
3655       DCHECK(!source_url.is_empty());
3656       should_fork = !source_url.SchemeIs(url::kFileScheme);
3657     }
3658
3659     if (!should_fork) {
3660       // Give the embedder a chance.
3661       should_fork = GetContentClient()->renderer()->ShouldFork(
3662           info.frame, url, info.urlRequest.httpMethod().utf8(),
3663           is_initial_navigation, info.isRedirect, &send_referrer);
3664     }
3665
3666     if (should_fork) {
3667       OpenURL(info.frame, url, send_referrer ? referrer : Referrer(),
3668               info.defaultPolicy);
3669       return blink::WebNavigationPolicyIgnore;  // Suppress the load here.
3670     }
3671   }
3672
3673   // Detect when a page is "forking" a new tab that can be safely rendered in
3674   // its own process.  This is done by sites like Gmail that try to open links
3675   // in new windows without script connections back to the original page.  We
3676   // treat such cases as browser navigations (in which we will create a new
3677   // renderer for a cross-site navigation), rather than WebKit navigations.
3678   //
3679   // We use the following heuristic to decide whether to fork a new page in its
3680   // own process:
3681   // The parent page must open a new tab to about:blank, set the new tab's
3682   // window.opener to null, and then redirect the tab to a cross-site URL using
3683   // JavaScript.
3684   //
3685   // TODO(creis): Deprecate this logic once we can rely on rel=noreferrer
3686   // (see below).
3687   bool is_fork =
3688       // Must start from a tab showing about:blank, which is later redirected.
3689       old_url == GURL(url::kAboutBlankURL) &&
3690       // Must be the first real navigation of the tab.
3691       render_view_->historyBackListCount() < 1 &&
3692       render_view_->historyForwardListCount() < 1 &&
3693       // The parent page must have set the child's window.opener to null before
3694       // redirecting to the desired URL.
3695       info.frame->opener() == NULL &&
3696       // Must be a top-level frame.
3697       info.frame->parent() == NULL &&
3698       // Must not have issued the request from this page.
3699       is_content_initiated &&
3700       // Must be targeted at the current tab.
3701       info.defaultPolicy == blink::WebNavigationPolicyCurrentTab &&
3702       // Must be a JavaScript navigation, which appears as "other".
3703       info.navigationType == blink::WebNavigationTypeOther;
3704
3705   if (is_fork) {
3706     // Open the URL via the browser, not via WebKit.
3707     OpenURL(info.frame, url, Referrer(), info.defaultPolicy);
3708     return blink::WebNavigationPolicyIgnore;
3709   }
3710
3711   return info.defaultPolicy;
3712 }
3713
3714 void RenderFrameImpl::OpenURL(WebFrame* frame,
3715                               const GURL& url,
3716                               const Referrer& referrer,
3717                               WebNavigationPolicy policy) {
3718   DCHECK_EQ(frame_, frame);
3719
3720   FrameHostMsg_OpenURL_Params params;
3721   params.url = url;
3722   params.referrer = referrer;
3723   params.disposition = RenderViewImpl::NavigationPolicyToDisposition(policy);
3724   WebDataSource* ds = frame->provisionalDataSource();
3725   if (ds) {
3726     DocumentState* document_state = DocumentState::FromDataSource(ds);
3727     NavigationState* navigation_state = document_state->navigation_state();
3728     if (navigation_state->is_content_initiated()) {
3729       params.should_replace_current_entry = ds->replacesCurrentHistoryItem();
3730     } else {
3731       // This is necessary to preserve the should_replace_current_entry value on
3732       // cross-process redirects, in the event it was set by a previous process.
3733       //
3734       // TODO(davidben): Avoid this awkward duplication of state. See comment on
3735       // NavigationState::should_replace_current_entry().
3736       params.should_replace_current_entry =
3737           navigation_state->should_replace_current_entry();
3738     }
3739   } else {
3740     params.should_replace_current_entry = false;
3741   }
3742   params.user_gesture = WebUserGestureIndicator::isProcessingUserGesture();
3743   if (GetContentClient()->renderer()->AllowPopup())
3744     params.user_gesture = true;
3745
3746   if (policy == blink::WebNavigationPolicyNewBackgroundTab ||
3747       policy == blink::WebNavigationPolicyNewForegroundTab ||
3748       policy == blink::WebNavigationPolicyNewWindow ||
3749       policy == blink::WebNavigationPolicyNewPopup) {
3750     WebUserGestureIndicator::consumeUserGesture();
3751   }
3752
3753   Send(new FrameHostMsg_OpenURL(routing_id_, params));
3754 }
3755
3756 void RenderFrameImpl::UpdateEncoding(WebFrame* frame,
3757                                      const std::string& encoding_name) {
3758   // Only update main frame's encoding_name.
3759   if (!frame->parent())
3760     Send(new FrameHostMsg_UpdateEncoding(routing_id_, encoding_name));
3761 }
3762
3763 void RenderFrameImpl::SyncSelectionIfRequired() {
3764   base::string16 text;
3765   size_t offset;
3766   gfx::Range range;
3767 #if defined(ENABLE_PLUGINS)
3768   if (render_view_->focused_pepper_plugin_) {
3769     render_view_->focused_pepper_plugin_->GetSurroundingText(&text, &range);
3770     offset = 0;  // Pepper API does not support offset reporting.
3771     // TODO(kinaba): cut as needed.
3772   } else
3773 #endif
3774   {
3775     size_t location, length;
3776     if (!GetRenderWidget()->webwidget()->caretOrSelectionRange(
3777             &location, &length)) {
3778       return;
3779     }
3780
3781     range = gfx::Range(location, location + length);
3782
3783     if (GetRenderWidget()->webwidget()->textInputInfo().type !=
3784             blink::WebTextInputTypeNone) {
3785       // If current focused element is editable, we will send 100 more chars
3786       // before and after selection. It is for input method surrounding text
3787       // feature.
3788       if (location > kExtraCharsBeforeAndAfterSelection)
3789         offset = location - kExtraCharsBeforeAndAfterSelection;
3790       else
3791         offset = 0;
3792       length = location + length - offset + kExtraCharsBeforeAndAfterSelection;
3793       WebRange webrange = WebRange::fromDocumentRange(frame_, offset, length);
3794       if (!webrange.isNull())
3795         text = WebRange::fromDocumentRange(
3796             frame_, offset, length).toPlainText();
3797     } else {
3798       offset = location;
3799       text = frame_->selectionAsText();
3800       // http://crbug.com/101435
3801       // In some case, frame->selectionAsText() returned text's length is not
3802       // equal to the length returned from webwidget()->caretOrSelectionRange().
3803       // So we have to set the range according to text.length().
3804       range.set_end(range.start() + text.length());
3805     }
3806   }
3807
3808   // Sometimes we get repeated didChangeSelection calls from webkit when
3809   // the selection hasn't actually changed. We don't want to report these
3810   // because it will cause us to continually claim the X clipboard.
3811   if (selection_text_offset_ != offset ||
3812       selection_range_ != range ||
3813       selection_text_ != text) {
3814     selection_text_ = text;
3815     selection_text_offset_ = offset;
3816     selection_range_ = range;
3817     // This IPC is dispatched by RenderWidetHost, so use its routing ID.
3818     Send(new ViewHostMsg_SelectionChanged(
3819         GetRenderWidget()->routing_id(), text, offset, range));
3820   }
3821   GetRenderWidget()->UpdateSelectionBounds();
3822 }
3823
3824 void RenderFrameImpl::InitializeUserMediaClient() {
3825   if (!RenderThreadImpl::current())  // Will be NULL during unit tests.
3826     return;
3827
3828 #if defined(OS_ANDROID)
3829   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kDisableWebRTC))
3830     return;
3831 #endif
3832
3833 #if defined(ENABLE_WEBRTC)
3834   DCHECK(!web_user_media_client_);
3835   web_user_media_client_ = new UserMediaClientImpl(
3836       this,
3837       RenderThreadImpl::current()->GetPeerConnectionDependencyFactory(),
3838       make_scoped_ptr(new MediaStreamDispatcher(this)).Pass());
3839 #endif
3840 }
3841
3842 WebMediaPlayer* RenderFrameImpl::CreateWebMediaPlayerForMediaStream(
3843     const blink::WebURL& url,
3844     WebMediaPlayerClient* client) {
3845 #if defined(ENABLE_WEBRTC)
3846 #if defined(OS_ANDROID) && defined(ARCH_CPU_ARMEL)
3847   bool found_neon =
3848       (android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_NEON) != 0;
3849   UMA_HISTOGRAM_BOOLEAN("Platform.WebRtcNEONFound", found_neon);
3850 #endif  // defined(OS_ANDROID) && defined(ARCH_CPU_ARMEL)
3851   return new WebMediaPlayerMS(frame_, client, weak_factory_.GetWeakPtr(),
3852                               new RenderMediaLog(),
3853                               CreateRendererFactory());
3854 #else
3855   return NULL;
3856 #endif  // defined(ENABLE_WEBRTC)
3857 }
3858
3859 scoped_ptr<MediaStreamRendererFactory>
3860 RenderFrameImpl::CreateRendererFactory() {
3861 #if defined(ENABLE_WEBRTC)
3862   return scoped_ptr<MediaStreamRendererFactory>(
3863       new MediaStreamRendererFactory());
3864 #else
3865   return scoped_ptr<MediaStreamRendererFactory>(
3866       static_cast<MediaStreamRendererFactory*>(NULL));
3867 #endif
3868 }
3869
3870 GURL RenderFrameImpl::GetLoadingUrl() const {
3871   WebDataSource* ds = frame_->dataSource();
3872   if (ds->hasUnreachableURL())
3873     return ds->unreachableURL();
3874
3875   const WebURLRequest& request = ds->request();
3876   return request.url();
3877 }
3878
3879 #if defined(OS_ANDROID)
3880
3881 WebMediaPlayer* RenderFrameImpl::CreateAndroidWebMediaPlayer(
3882     const blink::WebURL& url,
3883     WebMediaPlayerClient* client,
3884     blink::WebContentDecryptionModule* initial_cdm) {
3885   GpuChannelHost* gpu_channel_host =
3886       RenderThreadImpl::current()->EstablishGpuChannelSync(
3887           CAUSE_FOR_GPU_LAUNCH_VIDEODECODEACCELERATOR_INITIALIZE);
3888   if (!gpu_channel_host) {
3889     LOG(ERROR) << "Failed to establish GPU channel for media player";
3890     return NULL;
3891   }
3892
3893   scoped_refptr<StreamTextureFactory> stream_texture_factory;
3894   if (SynchronousCompositorFactory* factory =
3895           SynchronousCompositorFactory::GetInstance()) {
3896     stream_texture_factory = factory->CreateStreamTextureFactory(routing_id_);
3897   } else {
3898     scoped_refptr<webkit::gpu::ContextProviderWebContext> context_provider =
3899         RenderThreadImpl::current()->SharedMainThreadContextProvider();
3900
3901     if (!context_provider.get()) {
3902       LOG(ERROR) << "Failed to get context3d for media player";
3903       return NULL;
3904     }
3905
3906     stream_texture_factory = StreamTextureFactoryImpl::Create(
3907         context_provider, gpu_channel_host, routing_id_);
3908   }
3909
3910   return new WebMediaPlayerAndroid(
3911       frame_,
3912       client,
3913       weak_factory_.GetWeakPtr(),
3914       GetMediaPlayerManager(),
3915       GetCdmManager(),
3916       initial_cdm,
3917       stream_texture_factory,
3918       RenderThreadImpl::current()->GetMediaThreadTaskRunner(),
3919       new RenderMediaLog());
3920 }
3921
3922 RendererMediaPlayerManager* RenderFrameImpl::GetMediaPlayerManager() {
3923   if (!media_player_manager_)
3924     media_player_manager_ = new RendererMediaPlayerManager(this);
3925   return media_player_manager_;
3926 }
3927
3928 #endif  // defined(OS_ANDROID)
3929
3930 #if defined(ENABLE_BROWSER_CDMS)
3931 RendererCdmManager* RenderFrameImpl::GetCdmManager() {
3932   if (!cdm_manager_)
3933     cdm_manager_ = new RendererCdmManager(this);
3934   return cdm_manager_;
3935 }
3936 #endif  // defined(ENABLE_BROWSER_CDMS)
3937
3938 }  // namespace content