render_frame_host_impl.cc revision 5f1c94371a64b3196d4be9466099bb892df9b88e 
1// Copyright 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "content/browser/frame_host/render_frame_host_impl.h"
6
7#include "base/bind.h"
8#include "base/containers/hash_tables.h"
9#include "base/lazy_instance.h"
10#include "base/metrics/user_metrics_action.h"
11#include "base/time/time.h"
12#include "content/browser/accessibility/accessibility_mode_helper.h"
13#include "content/browser/accessibility/browser_accessibility_manager.h"
14#include "content/browser/accessibility/browser_accessibility_state_impl.h"
15#include "content/browser/child_process_security_policy_impl.h"
16#include "content/browser/frame_host/cross_process_frame_connector.h"
17#include "content/browser/frame_host/cross_site_transferring_request.h"
18#include "content/browser/frame_host/frame_tree.h"
19#include "content/browser/frame_host/frame_tree_node.h"
20#include "content/browser/frame_host/navigator.h"
21#include "content/browser/frame_host/render_frame_host_delegate.h"
22#include "content/browser/frame_host/render_frame_proxy_host.h"
23#include "content/browser/renderer_host/input/input_router.h"
24#include "content/browser/renderer_host/input/timeout_monitor.h"
25#include "content/browser/renderer_host/render_process_host_impl.h"
26#include "content/browser/renderer_host/render_view_host_impl.h"
27#include "content/browser/renderer_host/render_widget_host_impl.h"
28#include "content/browser/renderer_host/render_widget_host_view_base.h"
29#include "content/browser/transition_request_manager.h"
30#include "content/common/accessibility_messages.h"
31#include "content/common/desktop_notification_messages.h"
32#include "content/common/frame_messages.h"
33#include "content/common/input_messages.h"
34#include "content/common/inter_process_time_ticks_converter.h"
35#include "content/common/platform_notification_messages.h"
36#include "content/common/render_frame_setup.mojom.h"
37#include "content/common/swapped_out_messages.h"
38#include "content/public/browser/ax_event_notification_details.h"
39#include "content/public/browser/browser_accessibility_state.h"
40#include "content/public/browser/browser_thread.h"
41#include "content/public/browser/content_browser_client.h"
42#include "content/public/browser/desktop_notification_delegate.h"
43#include "content/public/browser/render_process_host.h"
44#include "content/public/browser/render_widget_host_view.h"
45#include "content/public/browser/user_metrics.h"
46#include "content/public/common/content_constants.h"
47#include "content/public/common/url_constants.h"
48#include "content/public/common/url_utils.h"
49#include "ui/accessibility/ax_tree.h"
50#include "url/gurl.h"
51
52using base::TimeDelta;
53
54namespace content {
55
56namespace {
57
58// The (process id, routing id) pair that identifies one RenderFrame.
59typedef std::pair<int32, int32> RenderFrameHostID;
60typedef base::hash_map<RenderFrameHostID, RenderFrameHostImpl*>
61    RoutingIDFrameMap;
62base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
63    LAZY_INSTANCE_INITIALIZER;
64
65class DesktopNotificationDelegateImpl : public DesktopNotificationDelegate {
66 public:
67  DesktopNotificationDelegateImpl(RenderFrameHost* render_frame_host,
68                                  int notification_id)
69      : render_process_id_(render_frame_host->GetProcess()->GetID()),
70        render_frame_id_(render_frame_host->GetRoutingID()),
71        notification_id_(notification_id) {}
72
73  virtual ~DesktopNotificationDelegateImpl() {}
74
75  virtual void NotificationDisplayed() OVERRIDE {
76    RenderFrameHost* rfh =
77        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
78    if (!rfh)
79      return;
80
81    rfh->Send(new DesktopNotificationMsg_PostDisplay(
82        rfh->GetRoutingID(), notification_id_));
83  }
84
85  virtual void NotificationError() OVERRIDE {
86    RenderFrameHost* rfh =
87        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
88    if (!rfh)
89      return;
90
91    rfh->Send(new DesktopNotificationMsg_PostError(
92        rfh->GetRoutingID(), notification_id_));
93  }
94
95  virtual void NotificationClosed(bool by_user) OVERRIDE {
96    RenderFrameHost* rfh =
97        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
98    if (!rfh)
99      return;
100
101    rfh->Send(new DesktopNotificationMsg_PostClose(
102        rfh->GetRoutingID(), notification_id_, by_user));
103    static_cast<RenderFrameHostImpl*>(rfh)->NotificationClosed(
104        notification_id_);
105  }
106
107  virtual void NotificationClick() OVERRIDE {
108    RenderFrameHost* rfh =
109        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
110    if (!rfh)
111      return;
112
113    rfh->Send(new DesktopNotificationMsg_PostClick(
114        rfh->GetRoutingID(), notification_id_));
115  }
116
117 private:
118  int render_process_id_;
119  int render_frame_id_;
120  int notification_id_;
121};
122
123// Translate a WebKit text direction into a base::i18n one.
124base::i18n::TextDirection WebTextDirectionToChromeTextDirection(
125    blink::WebTextDirection dir) {
126  switch (dir) {
127    case blink::WebTextDirectionLeftToRight:
128      return base::i18n::LEFT_TO_RIGHT;
129    case blink::WebTextDirectionRightToLeft:
130      return base::i18n::RIGHT_TO_LEFT;
131    default:
132      NOTREACHED();
133      return base::i18n::UNKNOWN_DIRECTION;
134  }
135}
136
137}  // namespace
138
139RenderFrameHost* RenderFrameHost::FromID(int render_process_id,
140                                         int render_frame_id) {
141  return RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
142}
143
144// static
145RenderFrameHostImpl* RenderFrameHostImpl::FromID(int process_id,
146                                                 int routing_id) {
147  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
148  RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer();
149  RoutingIDFrameMap::iterator it = frames->find(
150      RenderFrameHostID(process_id, routing_id));
151  return it == frames->end() ? NULL : it->second;
152}
153
154RenderFrameHostImpl::RenderFrameHostImpl(RenderViewHostImpl* render_view_host,
155                                         RenderFrameHostDelegate* delegate,
156                                         FrameTree* frame_tree,
157                                         FrameTreeNode* frame_tree_node,
158                                         int routing_id,
159                                         bool is_swapped_out)
160    : render_view_host_(render_view_host),
161      delegate_(delegate),
162      cross_process_frame_connector_(NULL),
163      render_frame_proxy_host_(NULL),
164      frame_tree_(frame_tree),
165      frame_tree_node_(frame_tree_node),
166      routing_id_(routing_id),
167      is_swapped_out_(is_swapped_out),
168      renderer_initialized_(false),
169      weak_ptr_factory_(this) {
170  frame_tree_->RegisterRenderFrameHost(this);
171  GetProcess()->AddRoute(routing_id_, this);
172  g_routing_id_frame_map.Get().insert(std::make_pair(
173      RenderFrameHostID(GetProcess()->GetID(), routing_id_),
174      this));
175
176  if (GetProcess()->GetServiceRegistry()) {
177    RenderFrameSetupPtr setup;
178    GetProcess()->GetServiceRegistry()->ConnectToRemoteService(&setup);
179    mojo::ServiceProviderPtr service_provider;
180    setup->GetServiceProviderForFrame(routing_id_,
181                                      mojo::Get(&service_provider));
182    service_registry_.BindRemoteServiceProvider(
183        service_provider.PassMessagePipe());
184  }
185}
186
187RenderFrameHostImpl::~RenderFrameHostImpl() {
188  GetProcess()->RemoveRoute(routing_id_);
189  g_routing_id_frame_map.Get().erase(
190      RenderFrameHostID(GetProcess()->GetID(), routing_id_));
191  if (delegate_)
192    delegate_->RenderFrameDeleted(this);
193
194  // Notify the FrameTree that this RFH is going away, allowing it to shut down
195  // the corresponding RenderViewHost if it is no longer needed.
196  frame_tree_->UnregisterRenderFrameHost(this);
197}
198
199int RenderFrameHostImpl::GetRoutingID() {
200  return routing_id_;
201}
202
203SiteInstance* RenderFrameHostImpl::GetSiteInstance() {
204  return render_view_host_->GetSiteInstance();
205}
206
207RenderProcessHost* RenderFrameHostImpl::GetProcess() {
208  // TODO(nasko): This should return its own process, once we have working
209  // cross-process navigation for subframes.
210  return render_view_host_->GetProcess();
211}
212
213RenderFrameHost* RenderFrameHostImpl::GetParent() {
214  FrameTreeNode* parent_node = frame_tree_node_->parent();
215  if (!parent_node)
216    return NULL;
217  return parent_node->current_frame_host();
218}
219
220const std::string& RenderFrameHostImpl::GetFrameName() {
221  return frame_tree_node_->frame_name();
222}
223
224bool RenderFrameHostImpl::IsCrossProcessSubframe() {
225  FrameTreeNode* parent_node = frame_tree_node_->parent();
226  if (!parent_node)
227    return false;
228  return GetSiteInstance() !=
229      parent_node->current_frame_host()->GetSiteInstance();
230}
231
232GURL RenderFrameHostImpl::GetLastCommittedURL() {
233  return frame_tree_node_->current_url();
234}
235
236gfx::NativeView RenderFrameHostImpl::GetNativeView() {
237  RenderWidgetHostView* view = render_view_host_->GetView();
238  if (!view)
239    return NULL;
240  return view->GetNativeView();
241}
242
243void RenderFrameHostImpl::ExecuteJavaScript(
244    const base::string16& javascript) {
245  Send(new FrameMsg_JavaScriptExecuteRequest(routing_id_,
246                                             javascript,
247                                             0, false));
248}
249
250void RenderFrameHostImpl::ExecuteJavaScript(
251     const base::string16& javascript,
252     const JavaScriptResultCallback& callback) {
253  static int next_id = 1;
254  int key = next_id++;
255  Send(new FrameMsg_JavaScriptExecuteRequest(routing_id_,
256                                             javascript,
257                                             key, true));
258  javascript_callbacks_.insert(std::make_pair(key, callback));
259}
260
261RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() {
262  return render_view_host_;
263}
264
265ServiceRegistry* RenderFrameHostImpl::GetServiceRegistry() {
266  static_cast<RenderProcessHostImpl*>(GetProcess())->EnsureMojoActivated();
267  return &service_registry_;
268}
269
270bool RenderFrameHostImpl::Send(IPC::Message* message) {
271  if (IPC_MESSAGE_ID_CLASS(message->type()) == InputMsgStart) {
272    return render_view_host_->input_router()->SendInput(
273        make_scoped_ptr(message));
274  }
275
276  // Route IPCs through the RenderFrameProxyHost when in swapped out state.
277  // Note: For subframes in --site-per-process mode, we don't use swapped out
278  // RenderFrameHosts.
279  if (frame_tree_node_->IsMainFrame() && render_view_host_->IsSwappedOut()) {
280    DCHECK(render_frame_proxy_host_);
281    return render_frame_proxy_host_->Send(message);
282  }
283
284  return GetProcess()->Send(message);
285}
286
287bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
288  // Filter out most IPC messages if this renderer is swapped out.
289  // We still want to handle certain ACKs to keep our state consistent.
290  // TODO(nasko): Only check RenderViewHost state, as this object's own state
291  // isn't yet properly updated. Transition this check once the swapped out
292  // state is correct in RenderFrameHost itself.
293  if (render_view_host_->IsSwappedOut()) {
294    if (!SwappedOutMessages::CanHandleWhileSwappedOut(msg)) {
295      // If this is a synchronous message and we decided not to handle it,
296      // we must send an error reply, or else the renderer will be stuck
297      // and won't respond to future requests.
298      if (msg.is_sync()) {
299        IPC::Message* reply = IPC::SyncMessage::GenerateReply(&msg);
300        reply->set_reply_error();
301        Send(reply);
302      }
303      // Don't continue looking for someone to handle it.
304      return true;
305    }
306  }
307
308  if (delegate_->OnMessageReceived(this, msg))
309    return true;
310
311  RenderFrameProxyHost* proxy =
312      frame_tree_node_->render_manager()->GetProxyToParent();
313  if (proxy && proxy->cross_process_frame_connector() &&
314      proxy->cross_process_frame_connector()->OnMessageReceived(msg))
315    return true;
316
317  bool handled = true;
318  IPC_BEGIN_MESSAGE_MAP(RenderFrameHostImpl, msg)
319    IPC_MESSAGE_HANDLER(FrameHostMsg_AddMessageToConsole, OnAddMessageToConsole)
320    IPC_MESSAGE_HANDLER(FrameHostMsg_Detach, OnDetach)
321    IPC_MESSAGE_HANDLER(FrameHostMsg_FrameFocused, OnFrameFocused)
322    IPC_MESSAGE_HANDLER(FrameHostMsg_DidStartProvisionalLoadForFrame,
323                        OnDidStartProvisionalLoadForFrame)
324    IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailProvisionalLoadWithError,
325                        OnDidFailProvisionalLoadWithError)
326    IPC_MESSAGE_HANDLER(FrameHostMsg_DidRedirectProvisionalLoad,
327                        OnDidRedirectProvisionalLoad)
328    IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailLoadWithError,
329                        OnDidFailLoadWithError)
330    IPC_MESSAGE_HANDLER_GENERIC(FrameHostMsg_DidCommitProvisionalLoad,
331                                OnNavigate(msg))
332    IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL)
333    IPC_MESSAGE_HANDLER(FrameHostMsg_DocumentOnLoadCompleted,
334                        OnDocumentOnLoadCompleted)
335    IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK)
336    IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK)
337    IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu)
338    IPC_MESSAGE_HANDLER(FrameHostMsg_JavaScriptExecuteResponse,
339                        OnJavaScriptExecuteResponse)
340    IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage,
341                                    OnRunJavaScriptMessage)
342    IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm,
343                                    OnRunBeforeUnloadConfirm)
344    IPC_MESSAGE_HANDLER(FrameHostMsg_DidAccessInitialDocument,
345                        OnDidAccessInitialDocument)
346    IPC_MESSAGE_HANDLER(FrameHostMsg_DidDisownOpener, OnDidDisownOpener)
347    IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateTitle, OnUpdateTitle)
348    IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateEncoding, OnUpdateEncoding)
349    IPC_MESSAGE_HANDLER(FrameHostMsg_BeginNavigation,
350                        OnBeginNavigation)
351    IPC_MESSAGE_HANDLER(PlatformNotificationHostMsg_RequestPermission,
352                        OnRequestPlatformNotificationPermission)
353    IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show,
354                        OnShowDesktopNotification)
355    IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel,
356                        OnCancelDesktopNotification)
357    IPC_MESSAGE_HANDLER(FrameHostMsg_TextSurroundingSelectionResponse,
358                        OnTextSurroundingSelectionResponse)
359    IPC_MESSAGE_HANDLER(AccessibilityHostMsg_Events, OnAccessibilityEvents)
360    IPC_MESSAGE_HANDLER(AccessibilityHostMsg_LocationChanges,
361                        OnAccessibilityLocationChanges)
362  IPC_END_MESSAGE_MAP()
363
364  return handled;
365}
366
367void RenderFrameHostImpl::AccessibilitySetFocus(int object_id) {
368  Send(new AccessibilityMsg_SetFocus(routing_id_, object_id));
369}
370
371void RenderFrameHostImpl::AccessibilityDoDefaultAction(int object_id) {
372  Send(new AccessibilityMsg_DoDefaultAction(routing_id_, object_id));
373}
374
375void RenderFrameHostImpl::AccessibilityShowMenu(
376    const gfx::Point& global_point) {
377  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
378      render_view_host_->GetView());
379  if (view)
380    view->AccessibilityShowMenu(global_point);
381}
382
383void RenderFrameHostImpl::AccessibilityScrollToMakeVisible(
384    int acc_obj_id, const gfx::Rect& subfocus) {
385  Send(new AccessibilityMsg_ScrollToMakeVisible(
386      routing_id_, acc_obj_id, subfocus));
387}
388
389void RenderFrameHostImpl::AccessibilityScrollToPoint(
390    int acc_obj_id, const gfx::Point& point) {
391  Send(new AccessibilityMsg_ScrollToPoint(
392      routing_id_, acc_obj_id, point));
393}
394
395void RenderFrameHostImpl::AccessibilitySetTextSelection(
396    int object_id, int start_offset, int end_offset) {
397  Send(new AccessibilityMsg_SetTextSelection(
398      routing_id_, object_id, start_offset, end_offset));
399}
400
401bool RenderFrameHostImpl::AccessibilityViewHasFocus() const {
402  RenderWidgetHostView* view = render_view_host_->GetView();
403  if (view)
404    return view->HasFocus();
405  return false;
406}
407
408gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
409  RenderWidgetHostView* view = render_view_host_->GetView();
410  if (view)
411    return view->GetViewBounds();
412  return gfx::Rect();
413}
414
415gfx::Point RenderFrameHostImpl::AccessibilityOriginInScreen(
416    const gfx::Rect& bounds) const {
417  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
418      render_view_host_->GetView());
419  if (view)
420    return view->AccessibilityOriginInScreen(bounds);
421  return gfx::Point();
422}
423
424void RenderFrameHostImpl::AccessibilityHitTest(const gfx::Point& point) {
425  Send(new AccessibilityMsg_HitTest(routing_id_, point));
426}
427
428void RenderFrameHostImpl::AccessibilityFatalError() {
429  Send(new AccessibilityMsg_FatalError(routing_id_));
430  browser_accessibility_manager_.reset(NULL);
431}
432
433gfx::AcceleratedWidget
434    RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
435  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
436      render_view_host_->GetView());
437  if (view)
438    return view->AccessibilityGetAcceleratedWidget();
439  return gfx::kNullAcceleratedWidget;
440}
441
442gfx::NativeViewAccessible
443    RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
444  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
445      render_view_host_->GetView());
446  if (view)
447    return view->AccessibilityGetNativeViewAccessible();
448  return NULL;
449}
450
451bool RenderFrameHostImpl::CreateRenderFrame(int parent_routing_id) {
452  TRACE_EVENT0("frame_host", "RenderFrameHostImpl::CreateRenderFrame");
453  DCHECK(!IsRenderFrameLive()) << "Creating frame twice";
454
455  // The process may (if we're sharing a process with another host that already
456  // initialized it) or may not (we have our own process or the old process
457  // crashed) have been initialized. Calling Init multiple times will be
458  // ignored, so this is safe.
459  if (!GetProcess()->Init())
460    return false;
461
462  DCHECK(GetProcess()->HasConnection());
463
464  renderer_initialized_ = true;
465  Send(new FrameMsg_NewFrame(routing_id_, parent_routing_id));
466
467  return true;
468}
469
470bool RenderFrameHostImpl::IsRenderFrameLive() {
471  return GetProcess()->HasConnection() && renderer_initialized_;
472}
473
474void RenderFrameHostImpl::Init() {
475  GetProcess()->ResumeRequestsForView(routing_id_);
476}
477
478void RenderFrameHostImpl::OnAddMessageToConsole(
479    int32 level,
480    const base::string16& message,
481    int32 line_no,
482    const base::string16& source_id) {
483  if (delegate_->AddMessageToConsole(level, message, line_no, source_id))
484    return;
485
486  // Pass through log level only on WebUI pages to limit console spew.
487  int32 resolved_level =
488      HasWebUIScheme(delegate_->GetMainFrameLastCommittedURL()) ? level : 0;
489
490  if (resolved_level >= ::logging::GetMinLogLevel()) {
491    logging::LogMessage("CONSOLE", line_no, resolved_level).stream() << "\"" <<
492        message << "\", source: " << source_id << " (" << line_no << ")";
493  }
494}
495
496void RenderFrameHostImpl::OnCreateChildFrame(int new_routing_id,
497                                             const std::string& frame_name) {
498  RenderFrameHostImpl* new_frame = frame_tree_->AddFrame(
499      frame_tree_node_, new_routing_id, frame_name);
500  if (delegate_)
501    delegate_->RenderFrameCreated(new_frame);
502}
503
504void RenderFrameHostImpl::OnDetach() {
505  frame_tree_->RemoveFrame(frame_tree_node_);
506}
507
508void RenderFrameHostImpl::OnFrameFocused() {
509  frame_tree_->SetFocusedFrame(frame_tree_node_);
510}
511
512void RenderFrameHostImpl::OnOpenURL(
513    const FrameHostMsg_OpenURL_Params& params) {
514  GURL validated_url(params.url);
515  GetProcess()->FilterURL(false, &validated_url);
516
517  frame_tree_node_->navigator()->RequestOpenURL(
518      this, validated_url, params.referrer, params.disposition,
519      params.should_replace_current_entry, params.user_gesture);
520}
521
522void RenderFrameHostImpl::OnDocumentOnLoadCompleted() {
523  // This message is only sent for top-level frames. TODO(avi): when frame tree
524  // mirroring works correctly, add a check here to enforce it.
525  delegate_->DocumentOnLoadCompleted(this);
526}
527
528void RenderFrameHostImpl::OnDidStartProvisionalLoadForFrame(
529    const GURL& url,
530    bool is_transition_navigation) {
531  frame_tree_node_->navigator()->DidStartProvisionalLoad(
532      this, url, is_transition_navigation);
533}
534
535void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
536    const FrameHostMsg_DidFailProvisionalLoadWithError_Params& params) {
537  frame_tree_node_->navigator()->DidFailProvisionalLoadWithError(this, params);
538}
539
540void RenderFrameHostImpl::OnDidFailLoadWithError(
541    const GURL& url,
542    int error_code,
543    const base::string16& error_description) {
544  GURL validated_url(url);
545  GetProcess()->FilterURL(false, &validated_url);
546
547  frame_tree_node_->navigator()->DidFailLoadWithError(
548      this, validated_url, error_code, error_description);
549}
550
551void RenderFrameHostImpl::OnDidRedirectProvisionalLoad(
552    int32 page_id,
553    const GURL& source_url,
554    const GURL& target_url) {
555  frame_tree_node_->navigator()->DidRedirectProvisionalLoad(
556      this, page_id, source_url, target_url);
557}
558
559// Called when the renderer navigates.  For every frame loaded, we'll get this
560// notification containing parameters identifying the navigation.
561//
562// Subframes are identified by the page transition type.  For subframes loaded
563// as part of a wider page load, the page_id will be the same as for the top
564// level frame.  If the user explicitly requests a subframe navigation, we will
565// get a new page_id because we need to create a new navigation entry for that
566// action.
567void RenderFrameHostImpl::OnNavigate(const IPC::Message& msg) {
568  // Read the parameters out of the IPC message directly to avoid making another
569  // copy when we filter the URLs.
570  PickleIterator iter(msg);
571  FrameHostMsg_DidCommitProvisionalLoad_Params validated_params;
572  if (!IPC::ParamTraits<FrameHostMsg_DidCommitProvisionalLoad_Params>::
573      Read(&msg, &iter, &validated_params))
574    return;
575
576  // If we're waiting for a cross-site beforeunload ack from this renderer and
577  // we receive a Navigate message from the main frame, then the renderer was
578  // navigating already and sent it before hearing the ViewMsg_Stop message.
579  // We do not want to cancel the pending navigation in this case, since the
580  // old page will soon be stopped.  Instead, treat this as a beforeunload ack
581  // to allow the pending navigation to continue.
582  if (render_view_host_->is_waiting_for_beforeunload_ack_ &&
583      render_view_host_->unload_ack_is_for_cross_site_transition_ &&
584      PageTransitionIsMainFrame(validated_params.transition)) {
585    OnBeforeUnloadACK(true, send_before_unload_start_time_,
586                      base::TimeTicks::Now());
587    return;
588  }
589
590  // If we're waiting for an unload ack from this renderer and we receive a
591  // Navigate message, then the renderer was navigating before it received the
592  // unload request.  It will either respond to the unload request soon or our
593  // timer will expire.  Either way, we should ignore this message, because we
594  // have already committed to closing this renderer.
595  if (render_view_host_->IsWaitingForUnloadACK())
596    return;
597
598  RenderProcessHost* process = GetProcess();
599
600  // Attempts to commit certain off-limits URL should be caught more strictly
601  // than our FilterURL checks below.  If a renderer violates this policy, it
602  // should be killed.
603  if (!CanCommitURL(validated_params.url)) {
604    VLOG(1) << "Blocked URL " << validated_params.url.spec();
605    validated_params.url = GURL(url::kAboutBlankURL);
606    RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled"));
607    // Kills the process.
608    process->ReceivedBadMessage();
609  }
610
611  // Without this check, an evil renderer can trick the browser into creating
612  // a navigation entry for a banned URL.  If the user clicks the back button
613  // followed by the forward button (or clicks reload, or round-trips through
614  // session restore, etc), we'll think that the browser commanded the
615  // renderer to load the URL and grant the renderer the privileges to request
616  // the URL.  To prevent this attack, we block the renderer from inserting
617  // banned URLs into the navigation controller in the first place.
618  process->FilterURL(false, &validated_params.url);
619  process->FilterURL(true, &validated_params.referrer.url);
620  for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
621      it != validated_params.redirects.end(); ++it) {
622    process->FilterURL(false, &(*it));
623  }
624  process->FilterURL(true, &validated_params.searchable_form_url);
625
626  // Without this check, the renderer can trick the browser into using
627  // filenames it can't access in a future session restore.
628  if (!render_view_host_->CanAccessFilesOfPageState(
629          validated_params.page_state)) {
630    GetProcess()->ReceivedBadMessage();
631    return;
632  }
633
634  frame_tree_node()->navigator()->DidNavigate(this, validated_params);
635}
636
637RenderWidgetHostImpl* RenderFrameHostImpl::GetRenderWidgetHost() {
638  return static_cast<RenderWidgetHostImpl*>(render_view_host_);
639}
640
641int RenderFrameHostImpl::GetEnabledBindings() {
642  return render_view_host_->GetEnabledBindings();
643}
644
645void RenderFrameHostImpl::OnCrossSiteResponse(
646    const GlobalRequestID& global_request_id,
647    scoped_ptr<CrossSiteTransferringRequest> cross_site_transferring_request,
648    const std::vector<GURL>& transfer_url_chain,
649    const Referrer& referrer,
650    PageTransition page_transition,
651    bool should_replace_current_entry) {
652  frame_tree_node_->render_manager()->OnCrossSiteResponse(
653      this, global_request_id, cross_site_transferring_request.Pass(),
654      transfer_url_chain, referrer, page_transition,
655      should_replace_current_entry);
656}
657
658void RenderFrameHostImpl::OnDeferredAfterResponseStarted(
659    const GlobalRequestID& global_request_id,
660    const scoped_refptr<net::HttpResponseHeaders>& headers,
661    const GURL& url) {
662  frame_tree_node_->render_manager()->OnDeferredAfterResponseStarted(
663      global_request_id, this);
664
665  if (GetParent() || !delegate_->WillHandleDeferAfterResponseStarted())
666    frame_tree_node_->render_manager()->ResumeResponseDeferredAtStart();
667  else
668    delegate_->DidDeferAfterResponseStarted(headers, url);
669}
670
671void RenderFrameHostImpl::SwapOut(RenderFrameProxyHost* proxy) {
672  // TODO(creis): Move swapped out state to RFH.  Until then, only update it
673  // when swapping out the main frame.
674  if (!GetParent()) {
675    // If this RenderViewHost is not in the default state, it must have already
676    // gone through this, therefore just return.
677    if (render_view_host_->rvh_state_ != RenderViewHostImpl::STATE_DEFAULT)
678      return;
679
680    render_view_host_->SetState(
681        RenderViewHostImpl::STATE_WAITING_FOR_UNLOAD_ACK);
682    render_view_host_->unload_event_monitor_timeout_->Start(
683        base::TimeDelta::FromMilliseconds(
684            RenderViewHostImpl::kUnloadTimeoutMS));
685  }
686
687  set_render_frame_proxy_host(proxy);
688
689  if (render_view_host_->IsRenderViewLive())
690    Send(new FrameMsg_SwapOut(routing_id_, proxy->GetRoutingID()));
691
692  if (!GetParent())
693    delegate_->SwappedOut(this);
694
695  // Allow the navigation to proceed.
696  frame_tree_node_->render_manager()->SwappedOut(this);
697}
698
699void RenderFrameHostImpl::OnBeforeUnloadACK(
700    bool proceed,
701    const base::TimeTicks& renderer_before_unload_start_time,
702    const base::TimeTicks& renderer_before_unload_end_time) {
703  // TODO(creis): Support properly beforeunload on subframes. For now just
704  // pretend that the handler ran and allowed the navigation to proceed.
705  if (GetParent()) {
706    render_view_host_->is_waiting_for_beforeunload_ack_ = false;
707    frame_tree_node_->render_manager()->OnBeforeUnloadACK(
708        render_view_host_->unload_ack_is_for_cross_site_transition_, proceed,
709        renderer_before_unload_end_time);
710    return;
711  }
712
713  render_view_host_->decrement_in_flight_event_count();
714  render_view_host_->StopHangMonitorTimeout();
715  // If this renderer navigated while the beforeunload request was in flight, we
716  // may have cleared this state in OnNavigate, in which case we can ignore
717  // this message.
718  // However renderer might also be swapped out but we still want to proceed
719  // with navigation, otherwise it would block future navigations. This can
720  // happen when pending cross-site navigation is canceled by a second one just
721  // before OnNavigate while current RVH is waiting for commit but second
722  // navigation is started from the beginning.
723  if (!render_view_host_->is_waiting_for_beforeunload_ack_) {
724    return;
725  }
726
727  render_view_host_->is_waiting_for_beforeunload_ack_ = false;
728
729  base::TimeTicks before_unload_end_time;
730  if (!send_before_unload_start_time_.is_null() &&
731      !renderer_before_unload_start_time.is_null() &&
732      !renderer_before_unload_end_time.is_null()) {
733    // When passing TimeTicks across process boundaries, we need to compensate
734    // for any skew between the processes. Here we are converting the
735    // renderer's notion of before_unload_end_time to TimeTicks in the browser
736    // process. See comments in inter_process_time_ticks_converter.h for more.
737    InterProcessTimeTicksConverter converter(
738        LocalTimeTicks::FromTimeTicks(send_before_unload_start_time_),
739        LocalTimeTicks::FromTimeTicks(base::TimeTicks::Now()),
740        RemoteTimeTicks::FromTimeTicks(renderer_before_unload_start_time),
741        RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
742    LocalTimeTicks browser_before_unload_end_time =
743        converter.ToLocalTimeTicks(
744            RemoteTimeTicks::FromTimeTicks(renderer_before_unload_end_time));
745    before_unload_end_time = browser_before_unload_end_time.ToTimeTicks();
746  }
747  frame_tree_node_->render_manager()->OnBeforeUnloadACK(
748      render_view_host_->unload_ack_is_for_cross_site_transition_, proceed,
749      before_unload_end_time);
750
751  // If canceled, notify the delegate to cancel its pending navigation entry.
752  if (!proceed)
753    render_view_host_->GetDelegate()->DidCancelLoading();
754}
755
756void RenderFrameHostImpl::OnSwapOutACK() {
757  OnSwappedOut(false);
758}
759
760void RenderFrameHostImpl::OnSwappedOut(bool timed_out) {
761  // For now, we only need to update the RVH state machine for top-level swaps.
762  // Subframe swaps (in --site-per-process) can just continue via RFHM.
763  if (!GetParent())
764    render_view_host_->OnSwappedOut(timed_out);
765  else
766    frame_tree_node_->render_manager()->SwappedOut(this);
767}
768
769void RenderFrameHostImpl::OnContextMenu(const ContextMenuParams& params) {
770  // Validate the URLs in |params|.  If the renderer can't request the URLs
771  // directly, don't show them in the context menu.
772  ContextMenuParams validated_params(params);
773  RenderProcessHost* process = GetProcess();
774
775  // We don't validate |unfiltered_link_url| so that this field can be used
776  // when users want to copy the original link URL.
777  process->FilterURL(true, &validated_params.link_url);
778  process->FilterURL(true, &validated_params.src_url);
779  process->FilterURL(false, &validated_params.page_url);
780  process->FilterURL(true, &validated_params.frame_url);
781
782  delegate_->ShowContextMenu(this, validated_params);
783}
784
785void RenderFrameHostImpl::OnJavaScriptExecuteResponse(
786    int id, const base::ListValue& result) {
787  const base::Value* result_value;
788  if (!result.Get(0, &result_value)) {
789    // Programming error or rogue renderer.
790    NOTREACHED() << "Got bad arguments for OnJavaScriptExecuteResponse";
791    return;
792  }
793
794  std::map<int, JavaScriptResultCallback>::iterator it =
795      javascript_callbacks_.find(id);
796  if (it != javascript_callbacks_.end()) {
797    it->second.Run(result_value);
798    javascript_callbacks_.erase(it);
799  } else {
800    NOTREACHED() << "Received script response for unknown request";
801  }
802}
803
804void RenderFrameHostImpl::OnRunJavaScriptMessage(
805    const base::string16& message,
806    const base::string16& default_prompt,
807    const GURL& frame_url,
808    JavaScriptMessageType type,
809    IPC::Message* reply_msg) {
810  // While a JS message dialog is showing, tabs in the same process shouldn't
811  // process input events.
812  GetProcess()->SetIgnoreInputEvents(true);
813  render_view_host_->StopHangMonitorTimeout();
814  delegate_->RunJavaScriptMessage(this, message, default_prompt,
815                                  frame_url, type, reply_msg);
816}
817
818void RenderFrameHostImpl::OnRunBeforeUnloadConfirm(
819    const GURL& frame_url,
820    const base::string16& message,
821    bool is_reload,
822    IPC::Message* reply_msg) {
823  // While a JS before unload dialog is showing, tabs in the same process
824  // shouldn't process input events.
825  GetProcess()->SetIgnoreInputEvents(true);
826  render_view_host_->StopHangMonitorTimeout();
827  delegate_->RunBeforeUnloadConfirm(this, message, is_reload, reply_msg);
828}
829
830void RenderFrameHostImpl::OnRequestPlatformNotificationPermission(
831    const GURL& origin, int request_id) {
832  base::Callback<void(blink::WebNotificationPermission)> done_callback =
833      base::Bind(
834          &RenderFrameHostImpl::PlatformNotificationPermissionRequestDone,
835          weak_ptr_factory_.GetWeakPtr(),
836          request_id);
837
838  GetContentClient()->browser()->RequestDesktopNotificationPermission(
839      origin, this, done_callback);
840}
841
842void RenderFrameHostImpl::OnShowDesktopNotification(
843    int notification_id,
844    const ShowDesktopNotificationHostMsgParams& params) {
845  scoped_ptr<DesktopNotificationDelegateImpl> delegate(
846      new DesktopNotificationDelegateImpl(this, notification_id));
847
848  base::Closure cancel_callback;
849  GetContentClient()->browser()->ShowDesktopNotification(
850      params,
851      this,
852      delegate.PassAs<DesktopNotificationDelegate>(),
853      &cancel_callback);
854  cancel_notification_callbacks_[notification_id] = cancel_callback;
855}
856
857void RenderFrameHostImpl::OnCancelDesktopNotification(int notification_id) {
858  if (!cancel_notification_callbacks_.count(notification_id)) {
859    NOTREACHED();
860    return;
861  }
862  cancel_notification_callbacks_[notification_id].Run();
863  cancel_notification_callbacks_.erase(notification_id);
864}
865
866void RenderFrameHostImpl::OnTextSurroundingSelectionResponse(
867    const base::string16& content,
868    size_t start_offset,
869    size_t end_offset) {
870  render_view_host_->OnTextSurroundingSelectionResponse(
871      content, start_offset, end_offset);
872}
873
874void RenderFrameHostImpl::OnDidAccessInitialDocument() {
875  delegate_->DidAccessInitialDocument();
876}
877
878void RenderFrameHostImpl::OnDidDisownOpener() {
879  // This message is only sent for top-level frames. TODO(avi): when frame tree
880  // mirroring works correctly, add a check here to enforce it.
881  delegate_->DidDisownOpener(this);
882}
883
884void RenderFrameHostImpl::OnUpdateTitle(
885    int32 page_id,
886    const base::string16& title,
887    blink::WebTextDirection title_direction) {
888  // This message is only sent for top-level frames. TODO(avi): when frame tree
889  // mirroring works correctly, add a check here to enforce it.
890  if (title.length() > kMaxTitleChars) {
891    NOTREACHED() << "Renderer sent too many characters in title.";
892    return;
893  }
894
895  delegate_->UpdateTitle(this, page_id, title,
896                         WebTextDirectionToChromeTextDirection(
897                             title_direction));
898}
899
900void RenderFrameHostImpl::OnUpdateEncoding(const std::string& encoding_name) {
901  // This message is only sent for top-level frames. TODO(avi): when frame tree
902  // mirroring works correctly, add a check here to enforce it.
903  delegate_->UpdateEncoding(this, encoding_name);
904}
905
906void RenderFrameHostImpl::OnBeginNavigation(
907    const FrameHostMsg_BeginNavigation_Params& params) {
908#if defined(USE_BROWSER_SIDE_NAVIGATION)
909  frame_tree_node()->render_manager()->OnBeginNavigation(params);
910#endif
911}
912
913void RenderFrameHostImpl::OnAccessibilityEvents(
914    const std::vector<AccessibilityHostMsg_EventParams>& params) {
915  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
916      render_view_host_->GetView());
917
918  AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
919  if ((accessibility_mode != AccessibilityModeOff) && view &&
920      RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
921    if (accessibility_mode & AccessibilityModeFlagPlatform) {
922      GetOrCreateBrowserAccessibilityManager();
923      if (browser_accessibility_manager_)
924        browser_accessibility_manager_->OnAccessibilityEvents(params);
925    }
926
927    std::vector<AXEventNotificationDetails> details;
928    details.reserve(params.size());
929    for (size_t i = 0; i < params.size(); ++i) {
930      const AccessibilityHostMsg_EventParams& param = params[i];
931      AXEventNotificationDetails detail(param.update.node_id_to_clear,
932                                        param.update.nodes,
933                                        param.event_type,
934                                        param.id,
935                                        GetProcess()->GetID(),
936                                        routing_id_);
937      details.push_back(detail);
938    }
939
940    delegate_->AccessibilityEventReceived(details);
941  }
942
943  // Always send an ACK or the renderer can be in a bad state.
944  Send(new AccessibilityMsg_Events_ACK(routing_id_));
945
946  // The rest of this code is just for testing; bail out if we're not
947  // in that mode.
948  if (accessibility_testing_callback_.is_null())
949    return;
950
951  for (size_t i = 0; i < params.size(); i++) {
952    const AccessibilityHostMsg_EventParams& param = params[i];
953    if (static_cast<int>(param.event_type) < 0)
954      continue;
955    if (!ax_tree_for_testing_) {
956      ax_tree_for_testing_.reset(new ui::AXTree(param.update));
957    } else {
958      CHECK(ax_tree_for_testing_->Unserialize(param.update))
959          << ax_tree_for_testing_->error();
960    }
961    accessibility_testing_callback_.Run(param.event_type, param.id);
962  }
963}
964
965void RenderFrameHostImpl::OnAccessibilityLocationChanges(
966    const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
967  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
968      render_view_host_->GetView());
969  if (view &&
970      RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
971    AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
972    if (accessibility_mode & AccessibilityModeFlagPlatform) {
973      if (!browser_accessibility_manager_) {
974        browser_accessibility_manager_.reset(
975            view->CreateBrowserAccessibilityManager(this));
976      }
977      if (browser_accessibility_manager_)
978        browser_accessibility_manager_->OnLocationChanges(params);
979    }
980    // TODO(aboxhall): send location change events to web contents observers too
981  }
982}
983
984void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) {
985  render_view_host_->SetPendingShutdown(on_swap_out);
986}
987
988bool RenderFrameHostImpl::CanCommitURL(const GURL& url) {
989  // TODO(creis): We should also check for WebUI pages here.  Also, when the
990  // out-of-process iframes implementation is ready, we should check for
991  // cross-site URLs that are not allowed to commit in this process.
992
993  // Give the client a chance to disallow URLs from committing.
994  return GetContentClient()->browser()->CanCommitURL(GetProcess(), url);
995}
996
997void RenderFrameHostImpl::Navigate(const FrameMsg_Navigate_Params& params) {
998  TRACE_EVENT0("frame_host", "RenderFrameHostImpl::Navigate");
999  // Browser plugin guests are not allowed to navigate outside web-safe schemes,
1000  // so do not grant them the ability to request additional URLs.
1001  if (!GetProcess()->IsIsolatedGuest()) {
1002    ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
1003        GetProcess()->GetID(), params.url);
1004    if (params.url.SchemeIs(url::kDataScheme) &&
1005        params.base_url_for_data_url.SchemeIs(url::kFileScheme)) {
1006      // If 'data:' is used, and we have a 'file:' base url, grant access to
1007      // local files.
1008      ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
1009          GetProcess()->GetID(), params.base_url_for_data_url);
1010    }
1011  }
1012
1013  // Only send the message if we aren't suspended at the start of a cross-site
1014  // request.
1015  if (render_view_host_->navigations_suspended_) {
1016    // Shouldn't be possible to have a second navigation while suspended, since
1017    // navigations will only be suspended during a cross-site request.  If a
1018    // second navigation occurs, RenderFrameHostManager will cancel this pending
1019    // RFH and create a new pending RFH.
1020    DCHECK(!render_view_host_->suspended_nav_params_.get());
1021    render_view_host_->suspended_nav_params_.reset(
1022        new FrameMsg_Navigate_Params(params));
1023  } else {
1024    // Get back to a clean state, in case we start a new navigation without
1025    // completing a RVH swap or unload handler.
1026    render_view_host_->SetState(RenderViewHostImpl::STATE_DEFAULT);
1027
1028    Send(new FrameMsg_Navigate(routing_id_, params));
1029  }
1030
1031  // Force the throbber to start. We do this because Blink's "started
1032  // loading" message will be received asynchronously from the UI of the
1033  // browser. But we want to keep the throbber in sync with what's happening
1034  // in the UI. For example, we want to start throbbing immediately when the
1035  // user naivgates even if the renderer is delayed. There is also an issue
1036  // with the throbber starting because the WebUI (which controls whether the
1037  // favicon is displayed) happens synchronously. If the start loading
1038  // messages was asynchronous, then the default favicon would flash in.
1039  //
1040  // Blink doesn't send throb notifications for JavaScript URLs, so we
1041  // don't want to either.
1042  if (!params.url.SchemeIs(url::kJavaScriptScheme))
1043    delegate_->DidStartLoading(this, true);
1044}
1045
1046void RenderFrameHostImpl::NavigateToURL(const GURL& url) {
1047  FrameMsg_Navigate_Params params;
1048  params.page_id = -1;
1049  params.pending_history_list_offset = -1;
1050  params.current_history_list_offset = -1;
1051  params.current_history_list_length = 0;
1052  params.url = url;
1053  params.transition = PAGE_TRANSITION_LINK;
1054  params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
1055  params.browser_navigation_start = base::TimeTicks::Now();
1056  Navigate(params);
1057}
1058
1059void RenderFrameHostImpl::DispatchBeforeUnload(bool for_cross_site_transition) {
1060  // TODO(creis): Support subframes.
1061  if (!render_view_host_->IsRenderViewLive() || GetParent()) {
1062    // We don't have a live renderer, so just skip running beforeunload.
1063    render_view_host_->is_waiting_for_beforeunload_ack_ = true;
1064    render_view_host_->unload_ack_is_for_cross_site_transition_ =
1065        for_cross_site_transition;
1066    base::TimeTicks now = base::TimeTicks::Now();
1067    OnBeforeUnloadACK(true, now, now);
1068    return;
1069  }
1070
1071  // This may be called more than once (if the user clicks the tab close button
1072  // several times, or if she clicks the tab close button then the browser close
1073  // button), and we only send the message once.
1074  if (render_view_host_->is_waiting_for_beforeunload_ack_) {
1075    // Some of our close messages could be for the tab, others for cross-site
1076    // transitions. We always want to think it's for closing the tab if any
1077    // of the messages were, since otherwise it might be impossible to close
1078    // (if there was a cross-site "close" request pending when the user clicked
1079    // the close button). We want to keep the "for cross site" flag only if
1080    // both the old and the new ones are also for cross site.
1081    render_view_host_->unload_ack_is_for_cross_site_transition_ =
1082        render_view_host_->unload_ack_is_for_cross_site_transition_ &&
1083        for_cross_site_transition;
1084  } else {
1085    // Start the hang monitor in case the renderer hangs in the beforeunload
1086    // handler.
1087    render_view_host_->is_waiting_for_beforeunload_ack_ = true;
1088    render_view_host_->unload_ack_is_for_cross_site_transition_ =
1089        for_cross_site_transition;
1090    // Increment the in-flight event count, to ensure that input events won't
1091    // cancel the timeout timer.
1092    render_view_host_->increment_in_flight_event_count();
1093    render_view_host_->StartHangMonitorTimeout(
1094        TimeDelta::FromMilliseconds(RenderViewHostImpl::kUnloadTimeoutMS));
1095    send_before_unload_start_time_ = base::TimeTicks::Now();
1096    Send(new FrameMsg_BeforeUnload(routing_id_));
1097  }
1098}
1099
1100void RenderFrameHostImpl::ExtendSelectionAndDelete(size_t before,
1101                                                   size_t after) {
1102  Send(new InputMsg_ExtendSelectionAndDelete(routing_id_, before, after));
1103}
1104
1105void RenderFrameHostImpl::JavaScriptDialogClosed(
1106    IPC::Message* reply_msg,
1107    bool success,
1108    const base::string16& user_input,
1109    bool dialog_was_suppressed) {
1110  GetProcess()->SetIgnoreInputEvents(false);
1111  bool is_waiting = render_view_host_->is_waiting_for_beforeunload_ack() ||
1112                    render_view_host_->IsWaitingForUnloadACK();
1113
1114  // If we are executing as part of (before)unload event handling, we don't
1115  // want to use the regular hung_renderer_delay_ms_ if the user has agreed to
1116  // leave the current page. In this case, use the regular timeout value used
1117  // during the (before)unload handling.
1118  if (is_waiting) {
1119    render_view_host_->StartHangMonitorTimeout(TimeDelta::FromMilliseconds(
1120        success ? RenderViewHostImpl::kUnloadTimeoutMS
1121                : render_view_host_->hung_renderer_delay_ms_));
1122  }
1123
1124  FrameHostMsg_RunJavaScriptMessage::WriteReplyParams(reply_msg,
1125                                                      success, user_input);
1126  Send(reply_msg);
1127
1128  // If we are waiting for an unload or beforeunload ack and the user has
1129  // suppressed messages, kill the tab immediately; a page that's spamming
1130  // alerts in onbeforeunload is presumably malicious, so there's no point in
1131  // continuing to run its script and dragging out the process.
1132  // This must be done after sending the reply since RenderView can't close
1133  // correctly while waiting for a response.
1134  if (is_waiting && dialog_was_suppressed)
1135    render_view_host_->delegate_->RendererUnresponsive(
1136        render_view_host_,
1137        render_view_host_->is_waiting_for_beforeunload_ack(),
1138        render_view_host_->IsWaitingForUnloadACK());
1139}
1140
1141void RenderFrameHostImpl::NotificationClosed(int notification_id) {
1142  cancel_notification_callbacks_.erase(notification_id);
1143}
1144
1145void RenderFrameHostImpl::PlatformNotificationPermissionRequestDone(
1146    int request_id, blink::WebNotificationPermission permission) {
1147  Send(new PlatformNotificationMsg_PermissionRequestComplete(
1148      routing_id_, request_id, permission));
1149}
1150
1151void RenderFrameHostImpl::SetAccessibilityMode(AccessibilityMode mode) {
1152  Send(new FrameMsg_SetAccessibilityMode(routing_id_, mode));
1153}
1154
1155void RenderFrameHostImpl::SetAccessibilityCallbackForTesting(
1156    const base::Callback<void(ui::AXEvent, int)>& callback) {
1157  accessibility_testing_callback_ = callback;
1158}
1159
1160const ui::AXTree* RenderFrameHostImpl::GetAXTreeForTesting() {
1161  return ax_tree_for_testing_.get();
1162}
1163
1164BrowserAccessibilityManager*
1165    RenderFrameHostImpl::GetOrCreateBrowserAccessibilityManager() {
1166  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
1167      render_view_host_->GetView());
1168  if (view &&
1169      !browser_accessibility_manager_) {
1170    browser_accessibility_manager_.reset(
1171        view->CreateBrowserAccessibilityManager(this));
1172  }
1173  return browser_accessibility_manager_.get();
1174}
1175
1176#if defined(OS_WIN)
1177void RenderFrameHostImpl::SetParentNativeViewAccessible(
1178    gfx::NativeViewAccessible accessible_parent) {
1179  RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
1180      render_view_host_->GetView());
1181  if (view)
1182    view->SetParentNativeViewAccessible(accessible_parent);
1183}
1184
1185gfx::NativeViewAccessible
1186RenderFrameHostImpl::GetParentNativeViewAccessible() const {
1187  return delegate_->GetParentNativeViewAccessible();
1188}
1189#endif  // defined(OS_WIN)
1190
1191void RenderFrameHostImpl::SetHasPendingTransitionRequest(
1192    bool has_pending_request) {
1193  BrowserThread::PostTask(
1194      BrowserThread::IO,
1195      FROM_HERE,
1196      base::Bind(
1197          &TransitionRequestManager::SetHasPendingTransitionRequest,
1198          base::Unretained(TransitionRequestManager::GetInstance()),
1199          GetProcess()->GetID(),
1200          routing_id_,
1201          has_pending_request));
1202}
1203
1204}  // namespace content
1205