render_frame_host_impl.cc revision 116680a4aac90f2aa7413d9095a592090648e557 
1// Copyright 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "content/browser/frame_host/render_frame_host_impl.h"
6
7#include "base/bind.h"
8#include "base/containers/hash_tables.h"
9#include "base/lazy_instance.h"
10#include "base/metrics/user_metrics_action.h"
11#include "base/time/time.h"
12#include "content/browser/accessibility/accessibility_mode_helper.h"
13#include "content/browser/accessibility/browser_accessibility_manager.h"
14#include "content/browser/accessibility/browser_accessibility_state_impl.h"
15#include "content/browser/child_process_security_policy_impl.h"
16#include "content/browser/frame_host/cross_process_frame_connector.h"
17#include "content/browser/frame_host/cross_site_transferring_request.h"
18#include "content/browser/frame_host/frame_tree.h"
19#include "content/browser/frame_host/frame_tree_node.h"
20#include "content/browser/frame_host/navigator.h"
21#include "content/browser/frame_host/render_frame_host_delegate.h"
22#include "content/browser/frame_host/render_frame_proxy_host.h"
23#include "content/browser/renderer_host/input/input_router.h"
24#include "content/browser/renderer_host/input/timeout_monitor.h"
25#include "content/browser/renderer_host/render_process_host_impl.h"
26#include "content/browser/renderer_host/render_view_host_impl.h"
27#include "content/browser/renderer_host/render_widget_host_impl.h"
28#include "content/browser/renderer_host/render_widget_host_view_base.h"
29#include "content/browser/transition_request_manager.h"
30#include "content/common/accessibility_messages.h"
31#include "content/common/desktop_notification_messages.h"
32#include "content/common/frame_messages.h"
33#include "content/common/input_messages.h"
34#include "content/common/inter_process_time_ticks_converter.h"
35#include "content/common/render_frame_setup.mojom.h"
36#include "content/common/swapped_out_messages.h"
37#include "content/public/browser/ax_event_notification_details.h"
38#include "content/public/browser/browser_accessibility_state.h"
39#include "content/public/browser/browser_thread.h"
40#include "content/public/browser/content_browser_client.h"
41#include "content/public/browser/desktop_notification_delegate.h"
42#include "content/public/browser/render_process_host.h"
43#include "content/public/browser/render_widget_host_view.h"
44#include "content/public/browser/user_metrics.h"
45#include "content/public/common/content_constants.h"
46#include "content/public/common/url_constants.h"
47#include "content/public/common/url_utils.h"
48#include "ui/accessibility/ax_tree.h"
49#include "url/gurl.h"
50
51using base::TimeDelta;
52
53namespace content {
54
55namespace {
56
57// The (process id, routing id) pair that identifies one RenderFrame.
58typedef std::pair<int32, int32> RenderFrameHostID;
59typedef base::hash_map<RenderFrameHostID, RenderFrameHostImpl*>
60    RoutingIDFrameMap;
61base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
62    LAZY_INSTANCE_INITIALIZER;
63
64class DesktopNotificationDelegateImpl : public DesktopNotificationDelegate {
65 public:
66  DesktopNotificationDelegateImpl(RenderFrameHost* render_frame_host,
67                                  int notification_id)
68      : render_process_id_(render_frame_host->GetProcess()->GetID()),
69        render_frame_id_(render_frame_host->GetRoutingID()),
70        notification_id_(notification_id) {}
71
72  virtual ~DesktopNotificationDelegateImpl() {}
73
74  virtual void NotificationDisplayed() OVERRIDE {
75    RenderFrameHost* rfh =
76        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
77    if (!rfh)
78      return;
79
80    rfh->Send(new DesktopNotificationMsg_PostDisplay(
81        rfh->GetRoutingID(), notification_id_));
82  }
83
84  virtual void NotificationError() OVERRIDE {
85    RenderFrameHost* rfh =
86        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
87    if (!rfh)
88      return;
89
90    rfh->Send(new DesktopNotificationMsg_PostError(
91        rfh->GetRoutingID(), notification_id_));
92    delete this;
93  }
94
95  virtual void NotificationClosed(bool by_user) OVERRIDE {
96    RenderFrameHost* rfh =
97        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
98    if (!rfh)
99      return;
100
101    rfh->Send(new DesktopNotificationMsg_PostClose(
102        rfh->GetRoutingID(), notification_id_, by_user));
103    static_cast<RenderFrameHostImpl*>(rfh)->NotificationClosed(
104        notification_id_);
105    delete this;
106  }
107
108  virtual void NotificationClick() OVERRIDE {
109    RenderFrameHost* rfh =
110        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
111    if (!rfh)
112      return;
113
114    rfh->Send(new DesktopNotificationMsg_PostClick(
115        rfh->GetRoutingID(), notification_id_));
116  }
117
118 private:
119  int render_process_id_;
120  int render_frame_id_;
121  int notification_id_;
122};
123
124// Translate a WebKit text direction into a base::i18n one.
125base::i18n::TextDirection WebTextDirectionToChromeTextDirection(
126    blink::WebTextDirection dir) {
127  switch (dir) {
128    case blink::WebTextDirectionLeftToRight:
129      return base::i18n::LEFT_TO_RIGHT;
130    case blink::WebTextDirectionRightToLeft:
131      return base::i18n::RIGHT_TO_LEFT;
132    default:
133      NOTREACHED();
134      return base::i18n::UNKNOWN_DIRECTION;
135  }
136}
137
138}  // namespace
139
140RenderFrameHost* RenderFrameHost::FromID(int render_process_id,
141                                         int render_frame_id) {
142  return RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
143}
144
145// static
146RenderFrameHostImpl* RenderFrameHostImpl::FromID(
147    int process_id, int routing_id) {
148  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
149  RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer();
150  RoutingIDFrameMap::iterator it = frames->find(
151      RenderFrameHostID(process_id, routing_id));
152  return it == frames->end() ? NULL : it->second;
153}
154
155RenderFrameHostImpl::RenderFrameHostImpl(
156    RenderViewHostImpl* render_view_host,
157    RenderFrameHostDelegate* delegate,
158    FrameTree* frame_tree,
159    FrameTreeNode* frame_tree_node,
160    int routing_id,
161    bool is_swapped_out)
162    : render_view_host_(render_view_host),
163      delegate_(delegate),
164      cross_process_frame_connector_(NULL),
165      render_frame_proxy_host_(NULL),
166      frame_tree_(frame_tree),
167      frame_tree_node_(frame_tree_node),
168      routing_id_(routing_id),
169      is_swapped_out_(is_swapped_out),
170      weak_ptr_factory_(this) {
171  frame_tree_->RegisterRenderFrameHost(this);
172  GetProcess()->AddRoute(routing_id_, this);
173  g_routing_id_frame_map.Get().insert(std::make_pair(
174      RenderFrameHostID(GetProcess()->GetID(), routing_id_),
175      this));
176
177  if (GetProcess()->GetServiceRegistry()) {
178    RenderFrameSetupPtr setup;
179    GetProcess()->GetServiceRegistry()->ConnectToRemoteService(&setup);
180    mojo::ServiceProviderPtr service_provider;
181    setup->GetServiceProviderForFrame(routing_id_,
182                                      mojo::Get(&service_provider));
183    service_registry_.BindRemoteServiceProvider(
184        service_provider.PassMessagePipe());
185  }
186}
187
188RenderFrameHostImpl::~RenderFrameHostImpl() {
189  GetProcess()->RemoveRoute(routing_id_);
190  g_routing_id_frame_map.Get().erase(
191      RenderFrameHostID(GetProcess()->GetID(), routing_id_));
192  if (delegate_)
193    delegate_->RenderFrameDeleted(this);
194
195  // Notify the FrameTree that this RFH is going away, allowing it to shut down
196  // the corresponding RenderViewHost if it is no longer needed.
197  frame_tree_->UnregisterRenderFrameHost(this);
198}
199
200int RenderFrameHostImpl::GetRoutingID() {
201  return routing_id_;
202}
203
204SiteInstance* RenderFrameHostImpl::GetSiteInstance() {
205  return render_view_host_->GetSiteInstance();
206}
207
208RenderProcessHost* RenderFrameHostImpl::GetProcess() {
209  // TODO(nasko): This should return its own process, once we have working
210  // cross-process navigation for subframes.
211  return render_view_host_->GetProcess();
212}
213
214RenderFrameHost* RenderFrameHostImpl::GetParent() {
215  FrameTreeNode* parent_node = frame_tree_node_->parent();
216  if (!parent_node)
217    return NULL;
218  return parent_node->current_frame_host();
219}
220
221const std::string& RenderFrameHostImpl::GetFrameName() {
222  return frame_tree_node_->frame_name();
223}
224
225bool RenderFrameHostImpl::IsCrossProcessSubframe() {
226  FrameTreeNode* parent_node = frame_tree_node_->parent();
227  if (!parent_node)
228    return false;
229  return GetSiteInstance() !=
230      parent_node->current_frame_host()->GetSiteInstance();
231}
232
233GURL RenderFrameHostImpl::GetLastCommittedURL() {
234  return frame_tree_node_->current_url();
235}
236
237gfx::NativeView RenderFrameHostImpl::GetNativeView() {
238  RenderWidgetHostView* view = render_view_host_->GetView();
239  if (!view)
240    return NULL;
241  return view->GetNativeView();
242}
243
244void RenderFrameHostImpl::ExecuteJavaScript(
245    const base::string16& javascript) {
246  Send(new FrameMsg_JavaScriptExecuteRequest(routing_id_,
247                                             javascript,
248                                             0, false));
249}
250
251void RenderFrameHostImpl::ExecuteJavaScript(
252     const base::string16& javascript,
253     const JavaScriptResultCallback& callback) {
254  static int next_id = 1;
255  int key = next_id++;
256  Send(new FrameMsg_JavaScriptExecuteRequest(routing_id_,
257                                             javascript,
258                                             key, true));
259  javascript_callbacks_.insert(std::make_pair(key, callback));
260}
261
262RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() {
263  return render_view_host_;
264}
265
266ServiceRegistry* RenderFrameHostImpl::GetServiceRegistry() {
267  static_cast<RenderProcessHostImpl*>(GetProcess())->EnsureMojoActivated();
268  return &service_registry_;
269}
270
271bool RenderFrameHostImpl::Send(IPC::Message* message) {
272  if (IPC_MESSAGE_ID_CLASS(message->type()) == InputMsgStart) {
273    return render_view_host_->input_router()->SendInput(
274        make_scoped_ptr(message));
275  }
276
277  if (render_view_host_->IsSwappedOut()) {
278    DCHECK(render_frame_proxy_host_);
279    return render_frame_proxy_host_->Send(message);
280  }
281
282  return GetProcess()->Send(message);
283}
284
285bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
286  // Filter out most IPC messages if this renderer is swapped out.
287  // We still want to handle certain ACKs to keep our state consistent.
288  // TODO(nasko): Only check RenderViewHost state, as this object's own state
289  // isn't yet properly updated. Transition this check once the swapped out
290  // state is correct in RenderFrameHost itself.
291  if (render_view_host_->IsSwappedOut()) {
292    if (!SwappedOutMessages::CanHandleWhileSwappedOut(msg)) {
293      // If this is a synchronous message and we decided not to handle it,
294      // we must send an error reply, or else the renderer will be stuck
295      // and won't respond to future requests.
296      if (msg.is_sync()) {
297        IPC::Message* reply = IPC::SyncMessage::GenerateReply(&msg);
298        reply->set_reply_error();
299        Send(reply);
300      }
301      // Don't continue looking for someone to handle it.
302      return true;
303    }
304  }
305
306  if (delegate_->OnMessageReceived(this, msg))
307    return true;
308
309  RenderFrameProxyHost* proxy =
310      frame_tree_node_->render_manager()->GetProxyToParent();
311  if (proxy && proxy->cross_process_frame_connector() &&
312      proxy->cross_process_frame_connector()->OnMessageReceived(msg))
313    return true;
314
315  bool handled = true;
316  IPC_BEGIN_MESSAGE_MAP(RenderFrameHostImpl, msg)
317    IPC_MESSAGE_HANDLER(FrameHostMsg_AddMessageToConsole, OnAddMessageToConsole)
318    IPC_MESSAGE_HANDLER(FrameHostMsg_Detach, OnDetach)
319    IPC_MESSAGE_HANDLER(FrameHostMsg_FrameFocused, OnFrameFocused)
320    IPC_MESSAGE_HANDLER(FrameHostMsg_DidStartProvisionalLoadForFrame,
321                        OnDidStartProvisionalLoadForFrame)
322    IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailProvisionalLoadWithError,
323                        OnDidFailProvisionalLoadWithError)
324    IPC_MESSAGE_HANDLER(FrameHostMsg_DidRedirectProvisionalLoad,
325                        OnDidRedirectProvisionalLoad)
326    IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailLoadWithError,
327                        OnDidFailLoadWithError)
328    IPC_MESSAGE_HANDLER_GENERIC(FrameHostMsg_DidCommitProvisionalLoad,
329                                OnNavigate(msg))
330    IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL)
331    IPC_MESSAGE_HANDLER(FrameHostMsg_DocumentOnLoadCompleted,
332                        OnDocumentOnLoadCompleted)
333    IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK)
334    IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK)
335    IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu)
336    IPC_MESSAGE_HANDLER(FrameHostMsg_JavaScriptExecuteResponse,
337                        OnJavaScriptExecuteResponse)
338    IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage,
339                                    OnRunJavaScriptMessage)
340    IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm,
341                                    OnRunBeforeUnloadConfirm)
342    IPC_MESSAGE_HANDLER(FrameHostMsg_DidAccessInitialDocument,
343                        OnDidAccessInitialDocument)
344    IPC_MESSAGE_HANDLER(FrameHostMsg_DidDisownOpener, OnDidDisownOpener)
345    IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateTitle, OnUpdateTitle)
346    IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateEncoding, OnUpdateEncoding)
347    IPC_MESSAGE_HANDLER(FrameHostMsg_BeginNavigation,
348                        OnBeginNavigation)
349    IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_RequestPermission,
350                        OnRequestDesktopNotificationPermission)
351    IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show,
352                        OnShowDesktopNotification)
353    IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel,
354                        OnCancelDesktopNotification)
355    IPC_MESSAGE_HANDLER(FrameHostMsg_TextSurroundingSelectionResponse,
356                        OnTextSurroundingSelectionResponse)
357    IPC_MESSAGE_HANDLER(AccessibilityHostMsg_Events, OnAccessibilityEvents)
358    IPC_MESSAGE_HANDLER(AccessibilityHostMsg_LocationChanges,
359                        OnAccessibilityLocationChanges)
360  IPC_END_MESSAGE_MAP()
361
362  return handled;
363}
364
365void RenderFrameHostImpl::AccessibilitySetFocus(int object_id) {
366  Send(new AccessibilityMsg_SetFocus(routing_id_, object_id));
367}
368
369void RenderFrameHostImpl::AccessibilityDoDefaultAction(int object_id) {
370  Send(new AccessibilityMsg_DoDefaultAction(routing_id_, object_id));
371}
372
373void RenderFrameHostImpl::AccessibilityShowMenu(
374    const gfx::Point& global_point) {
375  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
376      render_view_host_->GetView());
377  if (view)
378    view->AccessibilityShowMenu(global_point);
379}
380
381void RenderFrameHostImpl::AccessibilityScrollToMakeVisible(
382    int acc_obj_id, const gfx::Rect& subfocus) {
383  Send(new AccessibilityMsg_ScrollToMakeVisible(
384      routing_id_, acc_obj_id, subfocus));
385}
386
387void RenderFrameHostImpl::AccessibilityScrollToPoint(
388    int acc_obj_id, const gfx::Point& point) {
389  Send(new AccessibilityMsg_ScrollToPoint(
390      routing_id_, acc_obj_id, point));
391}
392
393void RenderFrameHostImpl::AccessibilitySetTextSelection(
394    int object_id, int start_offset, int end_offset) {
395  Send(new AccessibilityMsg_SetTextSelection(
396      routing_id_, object_id, start_offset, end_offset));
397}
398
399bool RenderFrameHostImpl::AccessibilityViewHasFocus() const {
400  RenderWidgetHostView* view = render_view_host_->GetView();
401  if (view)
402    return view->HasFocus();
403  return false;
404}
405
406gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
407  RenderWidgetHostView* view = render_view_host_->GetView();
408  if (view)
409    return view->GetViewBounds();
410  return gfx::Rect();
411}
412
413gfx::Point RenderFrameHostImpl::AccessibilityOriginInScreen(
414    const gfx::Rect& bounds) const {
415  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
416      render_view_host_->GetView());
417  if (view)
418    return view->AccessibilityOriginInScreen(bounds);
419  return gfx::Point();
420}
421
422void RenderFrameHostImpl::AccessibilityHitTest(const gfx::Point& point) {
423  Send(new AccessibilityMsg_HitTest(routing_id_, point));
424}
425
426void RenderFrameHostImpl::AccessibilityFatalError() {
427  Send(new AccessibilityMsg_FatalError(routing_id_));
428  browser_accessibility_manager_.reset(NULL);
429}
430
431void RenderFrameHostImpl::Init() {
432  GetProcess()->ResumeRequestsForView(routing_id_);
433}
434
435void RenderFrameHostImpl::OnAddMessageToConsole(
436    int32 level,
437    const base::string16& message,
438    int32 line_no,
439    const base::string16& source_id) {
440  if (delegate_->AddMessageToConsole(level, message, line_no, source_id))
441    return;
442
443  // Pass through log level only on WebUI pages to limit console spew.
444  int32 resolved_level =
445      HasWebUIScheme(delegate_->GetMainFrameLastCommittedURL()) ? level : 0;
446
447  if (resolved_level >= ::logging::GetMinLogLevel()) {
448    logging::LogMessage("CONSOLE", line_no, resolved_level).stream() << "\"" <<
449        message << "\", source: " << source_id << " (" << line_no << ")";
450  }
451}
452
453void RenderFrameHostImpl::OnCreateChildFrame(int new_routing_id,
454                                             const std::string& frame_name) {
455  RenderFrameHostImpl* new_frame = frame_tree_->AddFrame(
456      frame_tree_node_, new_routing_id, frame_name);
457  if (delegate_)
458    delegate_->RenderFrameCreated(new_frame);
459}
460
461void RenderFrameHostImpl::OnDetach() {
462  frame_tree_->RemoveFrame(frame_tree_node_);
463}
464
465void RenderFrameHostImpl::OnFrameFocused() {
466  frame_tree_->SetFocusedFrame(frame_tree_node_);
467}
468
469void RenderFrameHostImpl::OnOpenURL(
470    const FrameHostMsg_OpenURL_Params& params) {
471  GURL validated_url(params.url);
472  GetProcess()->FilterURL(false, &validated_url);
473
474  frame_tree_node_->navigator()->RequestOpenURL(
475      this, validated_url, params.referrer, params.disposition,
476      params.should_replace_current_entry, params.user_gesture);
477}
478
479void RenderFrameHostImpl::OnDocumentOnLoadCompleted() {
480  // This message is only sent for top-level frames. TODO(avi): when frame tree
481  // mirroring works correctly, add a check here to enforce it.
482  delegate_->DocumentOnLoadCompleted(this);
483}
484
485void RenderFrameHostImpl::OnDidStartProvisionalLoadForFrame(
486    const GURL& url) {
487  frame_tree_node_->navigator()->DidStartProvisionalLoad(this, url);
488}
489
490void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
491    const FrameHostMsg_DidFailProvisionalLoadWithError_Params& params) {
492  frame_tree_node_->navigator()->DidFailProvisionalLoadWithError(this, params);
493}
494
495void RenderFrameHostImpl::OnDidFailLoadWithError(
496    const GURL& url,
497    int error_code,
498    const base::string16& error_description) {
499  GURL validated_url(url);
500  GetProcess()->FilterURL(false, &validated_url);
501
502  frame_tree_node_->navigator()->DidFailLoadWithError(
503      this, validated_url, error_code, error_description);
504}
505
506void RenderFrameHostImpl::OnDidRedirectProvisionalLoad(
507    int32 page_id,
508    const GURL& source_url,
509    const GURL& target_url) {
510  frame_tree_node_->navigator()->DidRedirectProvisionalLoad(
511      this, page_id, source_url, target_url);
512}
513
514// Called when the renderer navigates.  For every frame loaded, we'll get this
515// notification containing parameters identifying the navigation.
516//
517// Subframes are identified by the page transition type.  For subframes loaded
518// as part of a wider page load, the page_id will be the same as for the top
519// level frame.  If the user explicitly requests a subframe navigation, we will
520// get a new page_id because we need to create a new navigation entry for that
521// action.
522void RenderFrameHostImpl::OnNavigate(const IPC::Message& msg) {
523  // Read the parameters out of the IPC message directly to avoid making another
524  // copy when we filter the URLs.
525  PickleIterator iter(msg);
526  FrameHostMsg_DidCommitProvisionalLoad_Params validated_params;
527  if (!IPC::ParamTraits<FrameHostMsg_DidCommitProvisionalLoad_Params>::
528      Read(&msg, &iter, &validated_params))
529    return;
530
531  // If we're waiting for a cross-site beforeunload ack from this renderer and
532  // we receive a Navigate message from the main frame, then the renderer was
533  // navigating already and sent it before hearing the ViewMsg_Stop message.
534  // We do not want to cancel the pending navigation in this case, since the
535  // old page will soon be stopped.  Instead, treat this as a beforeunload ack
536  // to allow the pending navigation to continue.
537  if (render_view_host_->is_waiting_for_beforeunload_ack_ &&
538      render_view_host_->unload_ack_is_for_cross_site_transition_ &&
539      PageTransitionIsMainFrame(validated_params.transition)) {
540    OnBeforeUnloadACK(true, send_before_unload_start_time_,
541                      base::TimeTicks::Now());
542    return;
543  }
544
545  // If we're waiting for an unload ack from this renderer and we receive a
546  // Navigate message, then the renderer was navigating before it received the
547  // unload request.  It will either respond to the unload request soon or our
548  // timer will expire.  Either way, we should ignore this message, because we
549  // have already committed to closing this renderer.
550  if (render_view_host_->IsWaitingForUnloadACK())
551    return;
552
553  RenderProcessHost* process = GetProcess();
554
555  // Attempts to commit certain off-limits URL should be caught more strictly
556  // than our FilterURL checks below.  If a renderer violates this policy, it
557  // should be killed.
558  if (!CanCommitURL(validated_params.url)) {
559    VLOG(1) << "Blocked URL " << validated_params.url.spec();
560    validated_params.url = GURL(url::kAboutBlankURL);
561    RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled"));
562    // Kills the process.
563    process->ReceivedBadMessage();
564  }
565
566  // Without this check, an evil renderer can trick the browser into creating
567  // a navigation entry for a banned URL.  If the user clicks the back button
568  // followed by the forward button (or clicks reload, or round-trips through
569  // session restore, etc), we'll think that the browser commanded the
570  // renderer to load the URL and grant the renderer the privileges to request
571  // the URL.  To prevent this attack, we block the renderer from inserting
572  // banned URLs into the navigation controller in the first place.
573  process->FilterURL(false, &validated_params.url);
574  process->FilterURL(true, &validated_params.referrer.url);
575  for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
576      it != validated_params.redirects.end(); ++it) {
577    process->FilterURL(false, &(*it));
578  }
579  process->FilterURL(true, &validated_params.searchable_form_url);
580
581  // Without this check, the renderer can trick the browser into using
582  // filenames it can't access in a future session restore.
583  if (!render_view_host_->CanAccessFilesOfPageState(
584          validated_params.page_state)) {
585    GetProcess()->ReceivedBadMessage();
586    return;
587  }
588
589  frame_tree_node()->navigator()->DidNavigate(this, validated_params);
590}
591
592RenderWidgetHostImpl* RenderFrameHostImpl::GetRenderWidgetHost() {
593  return static_cast<RenderWidgetHostImpl*>(render_view_host_);
594}
595
596int RenderFrameHostImpl::GetEnabledBindings() {
597  return render_view_host_->GetEnabledBindings();
598}
599
600void RenderFrameHostImpl::OnCrossSiteResponse(
601    const GlobalRequestID& global_request_id,
602    scoped_ptr<CrossSiteTransferringRequest> cross_site_transferring_request,
603    const std::vector<GURL>& transfer_url_chain,
604    const Referrer& referrer,
605    PageTransition page_transition,
606    bool should_replace_current_entry) {
607  frame_tree_node_->render_manager()->OnCrossSiteResponse(
608      this, global_request_id, cross_site_transferring_request.Pass(),
609      transfer_url_chain, referrer, page_transition,
610      should_replace_current_entry);
611}
612
613void RenderFrameHostImpl::OnDeferredAfterResponseStarted(
614    const GlobalRequestID& global_request_id) {
615  frame_tree_node_->render_manager()->OnDeferredAfterResponseStarted(
616      global_request_id, this);
617
618  if (GetParent() || !delegate_->WillHandleDeferAfterResponseStarted())
619    frame_tree_node_->render_manager()->ResumeResponseDeferredAtStart();
620  else
621    delegate_->DidDeferAfterResponseStarted();
622}
623
624void RenderFrameHostImpl::SwapOut(RenderFrameProxyHost* proxy) {
625  // TODO(creis): Move swapped out state to RFH.  Until then, only update it
626  // when swapping out the main frame.
627  if (!GetParent()) {
628    // If this RenderViewHost is not in the default state, it must have already
629    // gone through this, therefore just return.
630    if (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT)
631      return;
632
633    render_view_host_->SetState(
634        RenderViewHostImpl::STATE_WAITING_FOR_UNLOAD_ACK);
635    render_view_host_->unload_event_monitor_timeout_->Start(
636        base::TimeDelta::FromMilliseconds(
637            RenderViewHostImpl::kUnloadTimeoutMS));
638  }
639
640  set_render_frame_proxy_host(proxy);
641
642  if (render_view_host_->IsRenderViewLive())
643    Send(new FrameMsg_SwapOut(routing_id_, proxy->GetRoutingID()));
644
645  if (!GetParent())
646    delegate_->SwappedOut(this);
647
648  // Allow the navigation to proceed.
649  frame_tree_node_->render_manager()->SwappedOut(this);
650}
651
652void RenderFrameHostImpl::OnBeforeUnloadACK(
653    bool proceed,
654    const base::TimeTicks& renderer_before_unload_start_time,
655    const base::TimeTicks& renderer_before_unload_end_time) {
656  // TODO(creis): Support properly beforeunload on subframes. For now just
657  // pretend that the handler ran and allowed the navigation to proceed.
658  if (GetParent()) {
659    render_view_host_->is_waiting_for_beforeunload_ack_ = false;
660    frame_tree_node_->render_manager()->OnBeforeUnloadACK(
661        render_view_host_->unload_ack_is_for_cross_site_transition_, proceed,
662        renderer_before_unload_end_time);
663    return;
664  }
665
666  render_view_host_->decrement_in_flight_event_count();
667  render_view_host_->StopHangMonitorTimeout();
668  // If this renderer navigated while the beforeunload request was in flight, we
669  // may have cleared this state in OnNavigate, in which case we can ignore
670  // this message.
671  // However renderer might also be swapped out but we still want to proceed
672  // with navigation, otherwise it would block future navigations. This can
673  // happen when pending cross-site navigation is canceled by a second one just
674  // before OnNavigate while current RVH is waiting for commit but second
675  // navigation is started from the beginning.
676  if (!render_view_host_->is_waiting_for_beforeunload_ack_) {
677    return;
678  }
679
680  render_view_host_->is_waiting_for_beforeunload_ack_ = false;
681
682  base::TimeTicks before_unload_end_time;
683  if (!send_before_unload_start_time_.is_null() &&
684      !renderer_before_unload_start_time.is_null() &&
685      !renderer_before_unload_end_time.is_null()) {
686    // When passing TimeTicks across process boundaries, we need to compensate
687    // for any skew between the processes. Here we are converting the
688    // renderer's notion of before_unload_end_time to TimeTicks in the browser
689    // process. See comments in inter_process_time_ticks_converter.h for more.
690    InterProcessTimeTicksConverter converter(
691        LocalTimeTicks::FromTimeTicks(send_before_unload_start_time_),
692        LocalTimeTicks::FromTimeTicks(base::TimeTicks::Now()),
693        RemoteTimeTicks::FromTimeTicks(renderer_before_unload_start_time),
694        RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
695    LocalTimeTicks browser_before_unload_end_time =
696        converter.ToLocalTimeTicks(
697            RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
698    before_unload_end_time = browser_before_unload_end_time.ToTimeTicks();
699  }
700  frame_tree_node_->render_manager()->OnBeforeUnloadACK(
701      render_view_host_->unload_ack_is_for_cross_site_transition_, proceed,
702      before_unload_end_time);
703
704  // If canceled, notify the delegate to cancel its pending navigation entry.
705  if (!proceed)
706    render_view_host_->GetDelegate()->DidCancelLoading();
707}
708
709void RenderFrameHostImpl::OnSwapOutACK() {
710  OnSwappedOut(false);
711}
712
713void RenderFrameHostImpl::OnSwappedOut(bool timed_out) {
714  // For now, we only need to update the RVH state machine for top-level swaps.
715  // Subframe swaps (in --site-per-process) can just continue via RFHM.
716  if (!GetParent())
717    render_view_host_->OnSwappedOut(timed_out);
718  else
719    frame_tree_node_->render_manager()->SwappedOut(this);
720}
721
722void RenderFrameHostImpl::OnContextMenu(const ContextMenuParams& params) {
723  // Validate the URLs in |params|.  If the renderer can't request the URLs
724  // directly, don't show them in the context menu.
725  ContextMenuParams validated_params(params);
726  RenderProcessHost* process = GetProcess();
727
728  // We don't validate |unfiltered_link_url| so that this field can be used
729  // when users want to copy the original link URL.
730  process->FilterURL(true, &validated_params.link_url);
731  process->FilterURL(true, &validated_params.src_url);
732  process->FilterURL(false, &validated_params.page_url);
733  process->FilterURL(true, &validated_params.frame_url);
734
735  delegate_->ShowContextMenu(this, validated_params);
736}
737
738void RenderFrameHostImpl::OnJavaScriptExecuteResponse(
739    int id, const base::ListValue& result) {
740  const base::Value* result_value;
741  if (!result.Get(0, &result_value)) {
742    // Programming error or rogue renderer.
743    NOTREACHED() << "Got bad arguments for OnJavaScriptExecuteResponse";
744    return;
745  }
746
747  std::map<int, JavaScriptResultCallback>::iterator it =
748      javascript_callbacks_.find(id);
749  if (it != javascript_callbacks_.end()) {
750    it->second.Run(result_value);
751    javascript_callbacks_.erase(it);
752  } else {
753    NOTREACHED() << "Received script response for unknown request";
754  }
755}
756
757void RenderFrameHostImpl::OnRunJavaScriptMessage(
758    const base::string16& message,
759    const base::string16& default_prompt,
760    const GURL& frame_url,
761    JavaScriptMessageType type,
762    IPC::Message* reply_msg) {
763  // While a JS message dialog is showing, tabs in the same process shouldn't
764  // process input events.
765  GetProcess()->SetIgnoreInputEvents(true);
766  render_view_host_->StopHangMonitorTimeout();
767  delegate_->RunJavaScriptMessage(this, message, default_prompt,
768                                  frame_url, type, reply_msg);
769}
770
771void RenderFrameHostImpl::OnRunBeforeUnloadConfirm(
772    const GURL& frame_url,
773    const base::string16& message,
774    bool is_reload,
775    IPC::Message* reply_msg) {
776  // While a JS before unload dialog is showing, tabs in the same process
777  // shouldn't process input events.
778  GetProcess()->SetIgnoreInputEvents(true);
779  render_view_host_->StopHangMonitorTimeout();
780  delegate_->RunBeforeUnloadConfirm(this, message, is_reload, reply_msg);
781}
782
783void RenderFrameHostImpl::OnRequestDesktopNotificationPermission(
784    const GURL& source_origin, int callback_context) {
785  base::Closure done_callback = base::Bind(
786      &RenderFrameHostImpl::DesktopNotificationPermissionRequestDone,
787      weak_ptr_factory_.GetWeakPtr(), callback_context);
788  GetContentClient()->browser()->RequestDesktopNotificationPermission(
789      source_origin, this, done_callback);
790}
791
792void RenderFrameHostImpl::OnShowDesktopNotification(
793    int notification_id,
794    const ShowDesktopNotificationHostMsgParams& params) {
795  base::Closure cancel_callback;
796  GetContentClient()->browser()->ShowDesktopNotification(
797      params, this,
798      new DesktopNotificationDelegateImpl(this, notification_id),
799      &cancel_callback);
800  cancel_notification_callbacks_[notification_id] = cancel_callback;
801}
802
803void RenderFrameHostImpl::OnCancelDesktopNotification(int notification_id) {
804  if (!cancel_notification_callbacks_.count(notification_id)) {
805    NOTREACHED();
806    return;
807  }
808  cancel_notification_callbacks_[notification_id].Run();
809  cancel_notification_callbacks_.erase(notification_id);
810}
811
812void RenderFrameHostImpl::OnTextSurroundingSelectionResponse(
813    const base::string16& content,
814    size_t start_offset,
815    size_t end_offset) {
816  render_view_host_->OnTextSurroundingSelectionResponse(
817      content, start_offset, end_offset);
818}
819
820void RenderFrameHostImpl::OnDidAccessInitialDocument() {
821  delegate_->DidAccessInitialDocument();
822}
823
824void RenderFrameHostImpl::OnDidDisownOpener() {
825  // This message is only sent for top-level frames. TODO(avi): when frame tree
826  // mirroring works correctly, add a check here to enforce it.
827  delegate_->DidDisownOpener(this);
828}
829
830void RenderFrameHostImpl::OnUpdateTitle(
831    int32 page_id,
832    const base::string16& title,
833    blink::WebTextDirection title_direction) {
834  // This message is only sent for top-level frames. TODO(avi): when frame tree
835  // mirroring works correctly, add a check here to enforce it.
836  if (title.length() > kMaxTitleChars) {
837    NOTREACHED() << "Renderer sent too many characters in title.";
838    return;
839  }
840
841  delegate_->UpdateTitle(this, page_id, title,
842                         WebTextDirectionToChromeTextDirection(
843                             title_direction));
844}
845
846void RenderFrameHostImpl::OnUpdateEncoding(const std::string& encoding_name) {
847  // This message is only sent for top-level frames. TODO(avi): when frame tree
848  // mirroring works correctly, add a check here to enforce it.
849  delegate_->UpdateEncoding(this, encoding_name);
850}
851
852
853void RenderFrameHostImpl::OnBeginNavigation(
854    const FrameHostMsg_BeginNavigation_Params& params) {
855#if defined(USE_BROWSER_SIDE_NAVIGATION)
856  frame_tree_node()->render_manager()->OnBeginNavigation(params);
857#endif
858}
859
860void RenderFrameHostImpl::OnAccessibilityEvents(
861    const std::vector<AccessibilityHostMsg_EventParams>& params) {
862  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
863      render_view_host_->GetView());
864
865
866  AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
867  if ((accessibility_mode != AccessibilityModeOff) && view &&
868      RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
869    if (accessibility_mode & AccessibilityModeFlagPlatform) {
870      GetOrCreateBrowserAccessibilityManager();
871      if (browser_accessibility_manager_)
872        browser_accessibility_manager_->OnAccessibilityEvents(params);
873    }
874
875    std::vector<AXEventNotificationDetails> details;
876    details.reserve(params.size());
877    for (size_t i = 0; i < params.size(); ++i) {
878      const AccessibilityHostMsg_EventParams& param = params[i];
879      AXEventNotificationDetails detail(param.update.node_id_to_clear,
880                                        param.update.nodes,
881                                        param.event_type,
882                                        param.id,
883                                        GetProcess()->GetID(),
884                                        routing_id_);
885      details.push_back(detail);
886    }
887
888    delegate_->AccessibilityEventReceived(details);
889  }
890
891  // Always send an ACK or the renderer can be in a bad state.
892  Send(new AccessibilityMsg_Events_ACK(routing_id_));
893
894  // The rest of this code is just for testing; bail out if we're not
895  // in that mode.
896  if (accessibility_testing_callback_.is_null())
897    return;
898
899  for (size_t i = 0; i < params.size(); i++) {
900    const AccessibilityHostMsg_EventParams& param = params[i];
901    if (static_cast<int>(param.event_type) < 0)
902      continue;
903    if (!ax_tree_for_testing_) {
904      ax_tree_for_testing_.reset(new ui::AXTree(param.update));
905    } else {
906      CHECK(ax_tree_for_testing_->Unserialize(param.update))
907          << ax_tree_for_testing_->error();
908    }
909    accessibility_testing_callback_.Run(param.event_type, param.id);
910  }
911}
912
913void RenderFrameHostImpl::OnAccessibilityLocationChanges(
914    const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
915  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
916      render_view_host_->GetView());
917  if (view &&
918      RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
919    AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
920    if (accessibility_mode & AccessibilityModeFlagPlatform) {
921      if (!browser_accessibility_manager_) {
922        browser_accessibility_manager_.reset(
923            view->CreateBrowserAccessibilityManager(this));
924      }
925      if (browser_accessibility_manager_)
926        browser_accessibility_manager_->OnLocationChanges(params);
927    }
928    // TODO(aboxhall): send location change events to web contents observers too
929  }
930}
931
932void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) {
933  render_view_host_->SetPendingShutdown(on_swap_out);
934}
935
936bool RenderFrameHostImpl::CanCommitURL(const GURL& url) {
937  // TODO(creis): We should also check for WebUI pages here.  Also, when the
938  // out-of-process iframes implementation is ready, we should check for
939  // cross-site URLs that are not allowed to commit in this process.
940
941  // Give the client a chance to disallow URLs from committing.
942  return GetContentClient()->browser()->CanCommitURL(GetProcess(), url);
943}
944
945void RenderFrameHostImpl::Navigate(const FrameMsg_Navigate_Params& params) {
946  TRACE_EVENT0("frame_host", "RenderFrameHostImpl::Navigate");
947  // Browser plugin guests are not allowed to navigate outside web-safe schemes,
948  // so do not grant them the ability to request additional URLs.
949  if (!GetProcess()->IsIsolatedGuest()) {
950    ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
951        GetProcess()->GetID(), params.url);
952    if (params.url.SchemeIs(url::kDataScheme) &&
953        params.base_url_for_data_url.SchemeIs(url::kFileScheme)) {
954      // If 'data:' is used, and we have a 'file:' base url, grant access to
955      // local files.
956      ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
957          GetProcess()->GetID(), params.base_url_for_data_url);
958    }
959  }
960
961  // Only send the message if we aren't suspended at the start of a cross-site
962  // request.
963  if (render_view_host_->navigations_suspended_) {
964    // Shouldn't be possible to have a second navigation while suspended, since
965    // navigations will only be suspended during a cross-site request.  If a
966    // second navigation occurs, RenderFrameHostManager will cancel this pending
967    // RFH and create a new pending RFH.
968    DCHECK(!render_view_host_->suspended_nav_params_.get());
969    render_view_host_->suspended_nav_params_.reset(
970        new FrameMsg_Navigate_Params(params));
971  } else {
972    // Get back to a clean state, in case we start a new navigation without
973    // completing a RVH swap or unload handler.
974    render_view_host_->SetState(RenderViewHostImpl::STATE_DEFAULT);
975
976    Send(new FrameMsg_Navigate(routing_id_, params));
977  }
978
979  // Force the throbber to start. We do this because Blink's "started
980  // loading" message will be received asynchronously from the UI of the
981  // browser. But we want to keep the throbber in sync with what's happening
982  // in the UI. For example, we want to start throbbing immediately when the
983  // user naivgates even if the renderer is delayed. There is also an issue
984  // with the throbber starting because the WebUI (which controls whether the
985  // favicon is displayed) happens synchronously. If the start loading
986  // messages was asynchronous, then the default favicon would flash in.
987  //
988  // Blink doesn't send throb notifications for JavaScript URLs, so we
989  // don't want to either.
990  if (!params.url.SchemeIs(url::kJavaScriptScheme))
991    delegate_->DidStartLoading(this, true);
992}
993
994void RenderFrameHostImpl::NavigateToURL(const GURL& url) {
995  FrameMsg_Navigate_Params params;
996  params.page_id = -1;
997  params.pending_history_list_offset = -1;
998  params.current_history_list_offset = -1;
999  params.current_history_list_length = 0;
1000  params.url = url;
1001  params.transition = PAGE_TRANSITION_LINK;
1002  params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
1003  params.browser_navigation_start = base::TimeTicks::Now();
1004  Navigate(params);
1005}
1006
1007void RenderFrameHostImpl::DispatchBeforeUnload(bool for_cross_site_transition) {
1008  // TODO(creis): Support subframes.
1009  if (!render_view_host_->IsRenderViewLive() || GetParent()) {
1010    // We don't have a live renderer, so just skip running beforeunload.
1011    render_view_host_->is_waiting_for_beforeunload_ack_ = true;
1012    render_view_host_->unload_ack_is_for_cross_site_transition_ =
1013        for_cross_site_transition;
1014    base::TimeTicks now = base::TimeTicks::Now();
1015    OnBeforeUnloadACK(true, now, now);
1016    return;
1017  }
1018
1019  // This may be called more than once (if the user clicks the tab close button
1020  // several times, or if she clicks the tab close button then the browser close
1021  // button), and we only send the message once.
1022  if (render_view_host_->is_waiting_for_beforeunload_ack_) {
1023    // Some of our close messages could be for the tab, others for cross-site
1024    // transitions. We always want to think it's for closing the tab if any
1025    // of the messages were, since otherwise it might be impossible to close
1026    // (if there was a cross-site "close" request pending when the user clicked
1027    // the close button). We want to keep the "for cross site" flag only if
1028    // both the old and the new ones are also for cross site.
1029    render_view_host_->unload_ack_is_for_cross_site_transition_ =
1030        render_view_host_->unload_ack_is_for_cross_site_transition_ &&
1031        for_cross_site_transition;
1032  } else {
1033    // Start the hang monitor in case the renderer hangs in the beforeunload
1034    // handler.
1035    render_view_host_->is_waiting_for_beforeunload_ack_ = true;
1036    render_view_host_->unload_ack_is_for_cross_site_transition_ =
1037        for_cross_site_transition;
1038    // Increment the in-flight event count, to ensure that input events won't
1039    // cancel the timeout timer.
1040    render_view_host_->increment_in_flight_event_count();
1041    render_view_host_->StartHangMonitorTimeout(
1042        TimeDelta::FromMilliseconds(RenderViewHostImpl::kUnloadTimeoutMS));
1043    send_before_unload_start_time_ = base::TimeTicks::Now();
1044    Send(new FrameMsg_BeforeUnload(routing_id_));
1045  }
1046}
1047
1048void RenderFrameHostImpl::ExtendSelectionAndDelete(size_t before,
1049                                                   size_t after) {
1050  Send(new InputMsg_ExtendSelectionAndDelete(routing_id_, before, after));
1051}
1052
1053void RenderFrameHostImpl::JavaScriptDialogClosed(
1054    IPC::Message* reply_msg,
1055    bool success,
1056    const base::string16& user_input,
1057    bool dialog_was_suppressed) {
1058  GetProcess()->SetIgnoreInputEvents(false);
1059  bool is_waiting = render_view_host_->is_waiting_for_beforeunload_ack() ||
1060                    render_view_host_->IsWaitingForUnloadACK();
1061
1062  // If we are executing as part of (before)unload event handling, we don't
1063  // want to use the regular hung_renderer_delay_ms_ if the user has agreed to
1064  // leave the current page. In this case, use the regular timeout value used
1065  // during the (before)unload handling.
1066  if (is_waiting) {
1067    render_view_host_->StartHangMonitorTimeout(TimeDelta::FromMilliseconds(
1068        success ? RenderViewHostImpl::kUnloadTimeoutMS
1069                : render_view_host_->hung_renderer_delay_ms_));
1070  }
1071
1072  FrameHostMsg_RunJavaScriptMessage::WriteReplyParams(reply_msg,
1073                                                      success, user_input);
1074  Send(reply_msg);
1075
1076  // If we are waiting for an unload or beforeunload ack and the user has
1077  // suppressed messages, kill the tab immediately; a page that's spamming
1078  // alerts in onbeforeunload is presumably malicious, so there's no point in
1079  // continuing to run its script and dragging out the process.
1080  // This must be done after sending the reply since RenderView can't close
1081  // correctly while waiting for a response.
1082  if (is_waiting && dialog_was_suppressed)
1083    render_view_host_->delegate_->RendererUnresponsive(
1084        render_view_host_,
1085        render_view_host_->is_waiting_for_beforeunload_ack(),
1086        render_view_host_->IsWaitingForUnloadACK());
1087}
1088
1089void RenderFrameHostImpl::NotificationClosed(int notification_id) {
1090  cancel_notification_callbacks_.erase(notification_id);
1091}
1092
1093void RenderFrameHostImpl::DesktopNotificationPermissionRequestDone(
1094    int callback_context) {
1095  Send(new DesktopNotificationMsg_PermissionRequestDone(
1096      routing_id_, callback_context));
1097}
1098
1099void RenderFrameHostImpl::SetAccessibilityMode(AccessibilityMode mode) {
1100  Send(new FrameMsg_SetAccessibilityMode(routing_id_, mode));
1101}
1102
1103void RenderFrameHostImpl::SetAccessibilityCallbackForTesting(
1104    const base::Callback<void(ui::AXEvent, int)>& callback) {
1105  accessibility_testing_callback_ = callback;
1106}
1107
1108const ui::AXTree* RenderFrameHostImpl::GetAXTreeForTesting() {
1109  return ax_tree_for_testing_.get();
1110}
1111
1112BrowserAccessibilityManager*
1113    RenderFrameHostImpl::GetOrCreateBrowserAccessibilityManager() {
1114  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
1115      render_view_host_->GetView());
1116  if (view &&
1117      !browser_accessibility_manager_) {
1118    browser_accessibility_manager_.reset(
1119        view->CreateBrowserAccessibilityManager(this));
1120  }
1121  return browser_accessibility_manager_.get();
1122}
1123
1124#if defined(OS_WIN)
1125void RenderFrameHostImpl::SetParentNativeViewAccessible(
1126    gfx::NativeViewAccessible accessible_parent) {
1127  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
1128      render_view_host_->GetView());
1129  if (view)
1130    view->SetParentNativeViewAccessible(accessible_parent);
1131}
1132
1133gfx::NativeViewAccessible
1134RenderFrameHostImpl::GetParentNativeViewAccessible() const {
1135  return delegate_->GetParentNativeViewAccessible();
1136}
1137#endif  // defined(OS_WIN)
1138
1139void RenderFrameHostImpl::SetHasPendingTransitionRequest(
1140    bool has_pending_request) {
1141  BrowserThread::PostTask(
1142      BrowserThread::IO,
1143      FROM_HERE,
1144      base::Bind(
1145          &TransitionRequestManager::SetHasPendingTransitionRequest,
1146          base::Unretained(TransitionRequestManager::GetInstance()),
1147          GetProcess()->GetID(),
1148          routing_id_,
1149          has_pending_request));
1150}
1151
1152}  // namespace content
1153