// Copyright 2013 The Chromium Authors // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "content/browser/renderer_host/render_frame_host_impl.h" #include #include #include #include #include #include #include #include #include #include #include #include "base/check.h" #include "base/check_op.h" #include "base/command_line.h" #include "base/containers/flat_set.h" #include "base/containers/span_reader.h" #include "base/debug/crash_logging.h" #include "base/debug/dump_without_crashing.h" #include "base/feature_list.h" #include "base/functional/bind.h" #include "base/functional/callback_helpers.h" #include "base/json/json_reader.h" #include "base/lazy_instance.h" #include "base/memory/ptr_util.h" #include "base/memory/raw_ptr.h" #include "base/memory_coordinator/traits.h" #include "base/memory_coordinator/utils.h" #include "base/metrics/field_trial_params.h" #include "base/metrics/histogram_functions.h" #include "base/metrics/histogram_macros.h" #include "base/metrics/metrics_hashes.h" #include "base/metrics/user_metrics.h" #include "base/no_destructor.h" #include "base/notimplemented.h" #include "base/notreached.h" #include "base/numerics/safe_conversions.h" #include "base/process/kill.h" #include "base/rand_util.h" #include "base/state_transitions.h" #include "base/strings/escape.h" #include "base/strings/strcat.h" #include "base/strings/string_number_conversions.h" #include "base/strings/string_util.h" #include "base/strings/to_string.h" #include "base/strings/utf_string_conversions.h" #include "base/syslog_logging.h" #include "base/task/sequenced_task_runner.h" #include "base/task/single_thread_task_runner.h" #include "base/task/thread_pool.h" #include "base/threading/sequence_bound.h" #include "base/time/time.h" #include "base/timer/elapsed_timer.h" #include "base/timer/timer.h" #include "base/trace_event/named_trigger.h" #include "base/trace_event/optional_trace_event.h" #include "base/trace_event/trace_event.h" #include "base/trace_event/trace_id_helper.h" #include "base/types/expected_macros.h" #include "base/types/optional_util.h" #include "base/uuid.h" #include "build/build_config.h" #include "components/download/public/common/download_url_parameters.h" #include "components/history/core/browser/features.h" #include "components/input/input_router.h" #include "components/input/timeout_monitor.h" #include "components/input/utils.h" #include "components/tracing/common/tracing_switches.h" #include "components/viz/common/features.h" #include "components/webauthn/core/browser/remote_validation.h" #include "content/browser/about_url_loader_factory.h" #include "content/browser/accessibility/render_accessibility_host.h" #include "content/browser/back_forward_cache/back_forward_cache_disable.h" #include "content/browser/back_forward_cache/back_forward_cache_impl.h" #include "content/browser/bad_message.h" #include "content/browser/blob_storage/file_backed_blob_factory_frame_impl.h" #include "content/browser/bluetooth/web_bluetooth_service_impl.h" #include "content/browser/broadcast_channel/broadcast_channel_provider.h" #include "content/browser/broadcast_channel/broadcast_channel_service.h" #include "content/browser/browser_context_impl.h" #include "content/browser/browser_main_loop.h" #include "content/browser/can_commit_status.h" #include "content/browser/closewatcher/close_listener_host.h" #include "content/browser/code_cache/generated_code_cache_context.h" #include "content/browser/data_url_loader_factory.h" #include "content/browser/declarative_performance_observer/declarative_performance_observer.h" #include "content/browser/devtools/devtools_instrumentation.h" #include "content/browser/digital_credentials/digital_identity_request_impl.h" #include "content/browser/dom_storage/dom_storage_context_wrapper.h" #include "content/browser/download/data_url_blob_reader.h" #include "content/browser/feature_observer.h" #include "content/browser/fenced_frame/automatic_beacon_info.h" #include "content/browser/fenced_frame/fenced_document_data.h" #include "content/browser/fenced_frame/fenced_frame.h" #include "content/browser/fenced_frame/fenced_frame_reporter.h" #include "content/browser/fenced_frame/fenced_frame_url_mapping.h" #include "content/browser/file_system/file_system_manager_impl.h" #include "content/browser/file_system/file_system_url_loader_factory.h" #include "content/browser/file_system_access/file_system_access_manager_impl.h" #include "content/browser/font_access/font_access_manager.h" #include "content/browser/generic_sensor/frame_sensor_provider_proxy.h" #include "content/browser/geolocation/geolocation_service_impl.h" #include "content/browser/guest_page_holder_impl.h" #include "content/browser/hid/hid_service.h" #include "content/browser/idle/idle_manager_impl.h" #include "content/browser/installedapp/installed_app_provider_impl.h" #include "content/browser/loader/file_url_loader_factory.h" #include "content/browser/loader/keep_alive_url_loader_service.h" #include "content/browser/loader/navigation_early_hints_manager.h" #include "content/browser/loader/subresource_proxying_url_loader_service.h" #include "content/browser/loader/url_loader_factory_utils.h" #include "content/browser/log_console_message.h" #include "content/browser/media/key_system_support_impl.h" #include "content/browser/media/media_devices_util.h" #include "content/browser/media/media_interface_proxy.h" #include "content/browser/media/webaudio/audio_context_manager_impl.h" #include "content/browser/navigation_or_document_handle.h" #include "content/browser/network/cross_origin_embedder_policy_reporter.h" #include "content/browser/permissions/permission_controller_impl.h" #include "content/browser/permissions/permission_service_context.h" #include "content/browser/permissions/permission_util.h" #include "content/browser/preloading/preloading_decider.h" #include "content/browser/preloading/prerender/prerender_final_status.h" #include "content/browser/preloading/prerender/prerender_host_registry.h" #include "content/browser/preloading/prerender/prerender_metrics.h" #include "content/browser/presentation/presentation_service_impl.h" #include "content/browser/process_lock.h" #include "content/browser/push_messaging/push_messaging_manager.h" #include "content/browser/renderer_host/agent_scheduling_group_host.h" #include "content/browser/renderer_host/clipboard_host_impl.h" #include "content/browser/renderer_host/code_cache_host_impl.h" #include "content/browser/renderer_host/cookie_utils.h" #include "content/browser/renderer_host/cross_process_frame_connector.h" #include "content/browser/renderer_host/dip_util.h" #include "content/browser/renderer_host/frame_tree.h" #include "content/browser/renderer_host/frame_tree_node.h" #include "content/browser/renderer_host/initiator_navigation_state_impl.h" #include "content/browser/renderer_host/input/input_injector_impl.h" #include "content/browser/renderer_host/ipc_utils.h" #include "content/browser/renderer_host/local_network_access_util.h" #include "content/browser/renderer_host/media/peer_connection_tracker_host.h" #include "content/browser/renderer_host/mixed_content_checker.h" #include "content/browser/renderer_host/model_context_user_data.h" #include "content/browser/renderer_host/navigation_controller_impl.h" #include "content/browser/renderer_host/navigation_entry_impl.h" #include "content/browser/renderer_host/navigation_metrics_utils.h" #include "content/browser/renderer_host/navigation_request.h" #include "content/browser/renderer_host/navigation_state_keep_alive.h" #include "content/browser/renderer_host/navigator.h" #include "content/browser/renderer_host/page_delegate.h" #include "content/browser/renderer_host/policy_container_host.h" #include "content/browser/renderer_host/randomized_confidence_utils.h" #include "content/browser/renderer_host/render_frame_host_delegate.h" #include "content/browser/renderer_host/render_frame_host_owner.h" #include "content/browser/renderer_host/render_frame_proxy_host.h" #include "content/browser/renderer_host/render_process_host_impl.h" #include "content/browser/renderer_host/render_view_host_delegate.h" #include "content/browser/renderer_host/render_view_host_impl.h" #include "content/browser/renderer_host/render_widget_host_factory.h" #include "content/browser/renderer_host/render_widget_host_impl.h" #include "content/browser/renderer_host/render_widget_host_view_base.h" #include "content/browser/renderer_host/render_widget_host_view_child_frame.h" #include "content/browser/renderer_host/text_input_manager.h" #include "content/browser/renderer_host/unbounded_surface_window.h" #include "content/browser/renderer_host/view_transition_opt_in_state.h" #include "content/browser/sandboxed_opaque_origin_creator.h" #include "content/browser/scoped_active_url.h" #include "content/browser/security/coop/cross_origin_opener_policy_reporter.h" #include "content/browser/security/cpsp/child_process_security_policy_impl.h" #include "content/browser/serial/serial_service.h" #include "content/browser/service_worker/service_worker_client.h" #include "content/browser/site_info.h" #include "content/browser/sms/webotp_service.h" #include "content/browser/speech/speech_synthesis_impl.h" #include "content/browser/storage_access/storage_access_handle.h" #include "content/browser/storage_partition_impl.h" #include "content/browser/url_loader_factory_params_helper.h" #include "content/browser/usb/web_usb_service_impl.h" #include "content/browser/web_exposed_isolation_info.h" #include "content/browser/web_package/prefetched_signed_exchange_cache.h" #include "content/browser/webauth/authenticator_impl.h" #include "content/browser/webauth/webauth_request_security_checker_impl.h" #include "content/browser/webid/flags.h" #include "content/browser/webid/request_service.h" #include "content/browser/websockets/websocket_connector_impl.h" #include "content/browser/webtransport/web_transport_connector_impl.h" #include "content/browser/webui/url_data_manager_backend.h" #include "content/browser/webui/web_ui_controller_factory_registry.h" #include "content/browser/worker_host/dedicated_worker_host.h" #include "content/browser/worker_host/dedicated_worker_host_factory_impl.h" #include "content/browser/worker_host/dedicated_worker_hosts_for_document.h" #include "content/browser/worker_host/shared_worker_service_impl.h" #include "content/common/associated_interfaces.mojom.h" #include "content/common/content_navigation_policy.h" #include "content/common/debug_utils.h" #include "content/common/features.h" #include "content/common/frame.mojom.h" #include "content/common/frame_messages.mojom.h" #include "content/common/lazy_shared_url_loader_factory.h" #include "content/common/navigation_client.mojom.h" #include "content/common/navigation_params_utils.h" #include "content/public/browser/active_url_message_filter.h" #include "content/public/browser/browser_context.h" #include "content/public/browser/clipboard_types.h" #include "content/public/browser/content_browser_client.h" #include "content/public/browser/context_menu_params.h" #include "content/public/browser/cookie_access_details.h" #include "content/public/browser/devtools_agent_host.h" #include "content/public/browser/disallow_activation_reason.h" #include "content/public/browser/document_ref.h" #include "content/public/browser/document_service_internal.h" #include "content/public/browser/download_manager.h" #include "content/public/browser/error_navigation_trigger.h" #include "content/public/browser/feature_observer_client.h" #include "content/public/browser/global_dom_node_id.h" #include "content/public/browser/global_routing_id.h" #include "content/public/browser/media_device_id.h" #include "content/public/browser/network_service_util.h" #include "content/public/browser/permission_descriptor_util.h" #include "content/public/browser/render_process_host.h" #include "content/public/browser/render_widget_host_view.h" #include "content/public/browser/runtime_feature_state/runtime_feature_state_document_data.h" #include "content/public/browser/secure_payment_confirmation_utils.h" #include "content/public/browser/shared_cors_origin_access_list.h" #include "content/public/browser/site_isolation_policy.h" #include "content/public/browser/sms_fetcher.h" #include "content/public/browser/storage_partition.h" #include "content/public/browser/surface_embed_connector.h" #include "content/public/browser/tracing_support.h" #include "content/public/browser/weak_document_ptr.h" #include "content/public/browser/web_ui_url_loader_factory.h" #include "content/public/common/alternative_error_page_override_info.mojom.h" #include "content/public/common/bindings_policy.h" #include "content/public/common/child_process_id_util.h" #include "content/public/common/content_client.h" #include "content/public/common/content_features.h" #include "content/public/common/content_switches.h" #include "content/public/common/extra_mojo_js_features.mojom.h" #include "content/public/common/isolated_world_ids.h" #include "content/public/common/origin_util.h" #include "content/public/common/page_visibility_state.h" #include "content/public/common/referrer.h" #include "content/public/common/referrer_type_converters.h" #include "content/public/common/url_constants.h" #include "content/public/common/url_utils.h" #include "ipc/constants.mojom.h" #include "media/base/media_switches.h" #include "media/media_buildflags.h" #include "media/mojo/mojom/remoting.mojom.h" #include "media/mojo/services/media_metrics_provider.h" #include "media/mojo/services/video_decode_perf_history.h" #include "mojo/public/cpp/bindings/message.h" #include "mojo/public/cpp/bindings/self_owned_receiver.h" #include "mojo/public/cpp/bindings/struct_ptr.h" #include "mojo/public/cpp/bindings/urgent_message_scope.h" #include "mojo/public/cpp/system/data_pipe.h" #include "net/base/isolation_info.h" #include "net/base/registry_controlled_domains/registry_controlled_domain.h" #include "net/base/schemeful_site.h" #include "net/cert/cert_status_flags.h" #include "net/cookies/cookie_change_dispatcher.h" #include "net/cookies/cookie_setting_override.h" #include "net/http/http_util.h" #include "net/net_buildflags.h" #include "services/metrics/public/cpp/ukm_builders.h" #include "services/metrics/public/cpp/ukm_source_id.h" #include "services/network/public/cpp/connection_allowlist.h" #include "services/network/public/cpp/constants.h" #include "services/network/public/cpp/cors/origin_access_list.h" #include "services/network/public/cpp/features.h" #include "services/network/public/cpp/is_potentially_trustworthy.h" #include "services/network/public/cpp/network_service_buildflags.h" #include "services/network/public/cpp/not_implemented_url_loader_factory.h" #include "services/network/public/cpp/permissions_policy/permissions_policy.h" #include "services/network/public/cpp/permissions_policy/permissions_policy_declaration.h" #include "services/network/public/cpp/resource_request.h" #include "services/network/public/cpp/simple_url_loader.h" #include "services/network/public/cpp/web_sandbox_flags.h" #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h" #include "services/network/public/mojom/cookie_access_observer.mojom.h" #include "services/network/public/mojom/permissions_policy/permissions_policy_feature.mojom-shared.h" #include "services/network/public/mojom/url_loader_factory.mojom.h" #include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h" #include "services/service_manager/public/cpp/interface_provider.h" #include "storage/browser/blob/blob_url_store_impl.h" #include "third_party/abseil-cpp/absl/container/flat_hash_map.h" #include "third_party/abseil-cpp/absl/container/flat_hash_set.h" #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h" #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h" #include "third_party/blink/public/common/chrome_debug_urls.h" #include "third_party/blink/public/common/features.h" #include "third_party/blink/public/common/fenced_frame/fenced_frame_utils.h" #include "third_party/blink/public/common/frame/fenced_frame_sandbox_flags.h" #include "third_party/blink/public/common/frame/frame_owner_element_type.h" #include "third_party/blink/public/common/frame/frame_policy.h" #include "third_party/blink/public/common/loader/inter_process_time_ticks_converter.h" #include "third_party/blink/public/common/loader/resource_type_util.h" #include "third_party/blink/public/common/messaging/transferable_message.h" #include "third_party/blink/public/common/navigation/navigation_params_mojom_traits.h" #include "third_party/blink/public/common/page_state/page_state_serialization.h" #include "third_party/blink/public/common/permissions/permission_utils.h" #include "third_party/blink/public/common/permissions_policy/document_policy.h" #include "third_party/blink/public/common/permissions_policy/policy_helper_public.h" #include "third_party/blink/public/common/runtime_feature_state/runtime_feature_state_context.h" #include "third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h" #include "third_party/blink/public/common/storage_key/storage_key.h" #include "third_party/blink/public/mojom/back_forward_cache_not_restored_reasons.mojom.h" #include "third_party/blink/public/mojom/broadcastchannel/broadcast_channel.mojom.h" #include "third_party/blink/public/mojom/confidence_level.mojom.h" #include "third_party/blink/public/mojom/devtools/inspector_issue.mojom.h" #include "third_party/blink/public/mojom/frame/frame.mojom.h" #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h" #include "third_party/blink/public/mojom/frame/fullscreen.mojom.h" #include "third_party/blink/public/mojom/frame/media_player_action.mojom.h" #include "third_party/blink/public/mojom/loader/local_resource_loader_config.mojom.h" #include "third_party/blink/public/mojom/loader/resource_load_info.mojom.h" #include "third_party/blink/public/mojom/loader/transferrable_url_loader.mojom.h" #include "third_party/blink/public/mojom/navigation/navigation_params.mojom.h" #include "third_party/blink/public/mojom/navigation/renderer_eviction_reason.mojom.h" #include "third_party/blink/public/mojom/opengraph/metadata.mojom.h" #include "third_party/blink/public/mojom/page/draggable_region.mojom.h" #include "third_party/blink/public/mojom/scroll/scroll_into_view_params.mojom.h" #include "third_party/blink/public/mojom/storage_key/ancestor_chain_bit.mojom.h" #include "third_party/blink/public/mojom/timing/resource_timing.mojom.h" #include "third_party/blink/public/mojom/window_features/window_features.mojom.h" #include "third_party/perfetto/include/perfetto/tracing/track.h" #include "third_party/perfetto/include/perfetto/tracing/track_event_args.h" #include "ui/accessibility/accessibility_features.h" #include "ui/accessibility/ax_action_handler_registry.h" #include "ui/accessibility/ax_common.h" #include "ui/accessibility/ax_location_and_scroll_updates.h" #include "ui/accessibility/ax_node_id_forward.h" #include "ui/accessibility/ax_tree_update.h" #include "ui/accessibility/ax_updates_and_events.h" #include "ui/accessibility/platform/browser_accessibility_manager.h" #include "ui/base/clipboard/clipboard_metadata.h" #include "ui/base/ime/mojom/text_input_state.mojom.h" #include "ui/base/ime/text_input_client.h" #include "ui/base/ime/text_input_flags.h" #include "ui/base/ime/text_input_type.h" #include "ui/base/window_open_disposition.h" #include "ui/display/screen.h" #include "ui/events/event_constants.h" #include "ui/gfx/geometry/rect_conversions.h" #include "url/gurl.h" #include "url/origin.h" #include "url/url_constants.h" #if BUILDFLAG(IS_ANDROID) #include "base/android/scoped_service_binding_batch.h" #include "content/browser/accessibility/browser_accessibility_manager_android.h" #include "content/browser/android/content_url_loader_factory.h" #include "content/browser/android/java_interfaces_impl.h" #include "content/browser/renderer_host/navigation_transitions/navigation_transition_utils.h" #include "content/browser/renderer_host/render_frame_host_android.h" #include "content/browser/renderer_host/render_widget_host_view_android.h" #include "content/public/browser/android/java_interfaces.h" #include "content/public/browser/authenticator_request_client_delegate.h" #else #include "content/browser/host_zoom_map_impl.h" #endif #if BUILDFLAG(IS_CHROMEOS) #include "content/browser/smart_card/smart_card_service.h" #endif #if BUILDFLAG(IS_MAC) #include "content/browser/renderer_host/popup_menu_helper_mac.h" #endif #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU) #include "content/browser/renderer_host/render_view_host_delegate_view.h" #endif #if AX_FAIL_FAST_BUILD() #include "content/public/browser/ax_inspect_factory.h" #include "ui/accessibility/accessibility_switches.h" #endif namespace features { BASE_FEATURE(kDoNotEvictOnAXLocationChange, base::FEATURE_ENABLED_BY_DEFAULT); // When enabled, RenderFrameHost::IsFocused() treats the main frame as focused // by default when the top-level widget has OS focus but FrameTree does not yet // have a focused subframe (e.g., in newly opened windows or tabs). BASE_FEATURE(kDefaultToMainFrameFocusWhenNoSubframeFocused, base::FEATURE_ENABLED_BY_DEFAULT); BASE_FEATURE(kEnforceUserActivationForBeforeUnload, base::FEATURE_ENABLED_BY_DEFAULT); } // namespace features namespace content { class RenderFrameHostOrProxy { public: RenderFrameHostOrProxy(RenderFrameHostImpl* frame, RenderFrameProxyHost* proxy) { CHECK(!frame || !proxy) << "Both frame and proxy can't be non-null at the same time"; if (proxy) { frame_or_proxy_ = proxy; return; } if (frame) { frame_or_proxy_ = frame; return; } } explicit operator bool() { return frame_or_proxy_.index() > 0; } FrameTreeNode* GetFrameTreeNode() { if (auto* proxy = GetProxy()) { return proxy->frame_tree_node(); } else if (auto* frame = GetFrame()) { return frame->frame_tree_node(); } return nullptr; } RenderFrameHostImpl* GetCurrentFrameHost() { if (auto* proxy = GetProxy()) { return proxy->frame_tree_node()->current_frame_host(); } else if (auto* frame = GetFrame()) { return frame; } return nullptr; } private: RenderFrameProxyHost* GetProxy() { if (auto* proxy = std::get_if>(&frame_or_proxy_)) { return *proxy; } return nullptr; } RenderFrameHostImpl* GetFrame() { if (auto* frame = std::get_if>(&frame_or_proxy_)) { return *frame; } return nullptr; } std::variant, raw_ptr> frame_or_proxy_; }; namespace { // Maximum amount of time to wait for beforeunload/unload handlers to be // processed by the renderer process. constexpr base::TimeDelta kUnloadTimeout = base::Milliseconds(500); constexpr base::TimeDelta kSubframeProcessShutdownDelay = base::Seconds(2); static_assert(kSubframeProcessShutdownDelay + kUnloadTimeout < RenderProcessHostImpl::kKeepAliveHandleFactoryTimeout, "The maximum process shutdown delay should not exceed the " "keepalive timeout. This has security implications, see " "https://crbug.com/1177674."); #if BUILDFLAG(IS_ANDROID) const void* const kRenderFrameHostAndroidKey = &kRenderFrameHostAndroidKey; #endif // BUILDFLAG(IS_ANDROID) const void* const kDiscardedRFHProcessHelperKey = &kDiscardedRFHProcessHelperKey; // The next value to use for the accessibility reset token. uint32_t g_accessibility_reset_token = 0; // Whether to allow injecting javascript into any kind of frame, for Android // WebView, Fuchsia web.ContextProvider and CastOS content shell. bool g_allow_injecting_javascript = false; const char kDotGoogleDotCom[] = ".google.com"; const char kCrashReportingGroupName[] = "crash-reporting"; using RoutingIDFrameMap = absl::flat_hash_map; base::LazyInstance::DestructorAtExit g_routing_id_frame_map = LAZY_INSTANCE_INITIALIZER; // A global set of all sandboxed RenderFrameHosts that could be isolated from // the rest of their SiteInstance. using RoutingIDIsolatableSandboxedIframesSet = absl::flat_hash_set; base::LazyInstance::DestructorAtExit g_routing_id_isolatable_sandboxed_iframes_set = LAZY_INSTANCE_INITIALIZER; using TokenFrameMap = absl::flat_hash_map; TokenFrameMap& GetTokenFrameMap() { static base::NoDestructor token_frame_map; return *token_frame_map; } BackForwardCacheMetrics::NotRestoredReason RendererEvictionReasonToNotRestoredReason( blink::mojom::RendererEvictionReason reason) { switch (reason) { case blink::mojom::RendererEvictionReason::kJavaScriptExecution: return BackForwardCacheMetrics::NotRestoredReason::kJavaScriptExecution; case blink::mojom::RendererEvictionReason:: kNetworkRequestDatapipeDrainedAsBytesConsumer: return BackForwardCacheMetrics::NotRestoredReason:: kNetworkRequestDatapipeDrainedAsBytesConsumer; case blink::mojom::RendererEvictionReason::kNetworkRequestRedirected: return BackForwardCacheMetrics::NotRestoredReason:: kNetworkRequestRedirected; case blink::mojom::RendererEvictionReason::kNetworkRequestTimeout: return BackForwardCacheMetrics::NotRestoredReason::kNetworkRequestTimeout; case blink::mojom::RendererEvictionReason::kNetworkExceedsBufferLimit: return BackForwardCacheMetrics::NotRestoredReason:: kNetworkExceedsBufferLimit; case blink::mojom::RendererEvictionReason::kBroadcastChannelOnMessage: return BackForwardCacheMetrics::NotRestoredReason:: kBroadcastChannelOnMessage; case blink::mojom::RendererEvictionReason::kSharedWorkerMessage: return BackForwardCacheMetrics::NotRestoredReason::kSharedWorkerMessage; } NOTREACHED(); } bool CanApplyFrameReplicationUpdate( RenderFrameHostImpl* rfh, BackForwardCacheMetrics::NotRestoredReason eviction_reason) { // These updates apply to the BrowsingContextState that this RenderFrameHost // shares with the FrameTreeNode's current document, so only accept them once // this RenderFrameHost has been (or is about to be) swapped in (kActive, // kPendingCommit, or kPrerendering): // - kPendingCommit: Accepted because the renderer sends updates (e.g. ad // tagging) while committing the new document and before the browser has // processed the corresponding DidCommitNavigation message. // TODO(crbug.com/547754865): Consider sending replication state at // DidCommitNavigation time so updates during kPendingCommit can be avoided. // - kPrerendering: Accepted because prerendered pages run in a completely // isolated FrameTree that has never seen any active RenderFrameHost before // activation. Their updates only mutate their own isolated // BrowsingContextState, and prerendered pages actively load and can // legitimately update state (e.g. CSP headers, ad tags). // TODO(crbug.com/547754865): Investigate if any replication updates in // prerendering should be deferred until activation. if (rfh->lifecycle_state() == RenderFrameHostImpl::LifecycleStateImpl::kActive || rfh->lifecycle_state() == RenderFrameHostImpl::LifecycleStateImpl::kPendingCommit || rfh->lifecycle_state() == RenderFrameHostImpl::LifecycleStateImpl::kPrerendering) { return true; } if (rfh->IsInBackForwardCache()) { rfh->EvictFromBackForwardCacheWithReason(eviction_reason); } return false; } // Ensure that we reset nav_entry_id_ in DidCommitProvisionalLoad if any of // the validations fail and lead to an early return. Call disable() once we // know the commit will be successful. Resetting nav_entry_id_ avoids acting on // any UpdateState or UpdateTitle messages after an ignored commit. class ScopedCommitStateResetter { public: explicit ScopedCommitStateResetter(RenderFrameHostImpl* render_frame_host) : render_frame_host_(render_frame_host) {} ~ScopedCommitStateResetter() { if (!disabled_) { render_frame_host_->set_nav_entry_id(0); } } void disable() { disabled_ = true; } private: raw_ptr render_frame_host_; bool disabled_ = false; }; void GrantFileAccess(ChildProcessId child_id, const std::vector& file_paths) { ChildProcessSecurityPolicyImpl* policy = ChildProcessSecurityPolicyImpl::GetInstance(); for (const auto& file : file_paths) { if (!policy->CanReadFile(child_id, file)) { policy->GrantReadFile(child_id, file); } } } #if BUILDFLAG(ENABLE_MEDIA_REMOTING) // RemoterFactory that delegates Create() calls to the ContentBrowserClient. // // Since Create() could be called at any time, perhaps by a stray task being run // after a RenderFrameHost has been destroyed, the RemoterFactoryImpl uses the // process/routing IDs as a weak reference to the RenderFrameHostImpl. class RemoterFactoryImpl final : public media::mojom::RemoterFactory { public: RemoterFactoryImpl(int process_id, int routing_id) : process_id_(process_id), routing_id_(routing_id) {} RemoterFactoryImpl(const RemoterFactoryImpl&) = delete; RemoterFactoryImpl& operator=(const RemoterFactoryImpl&) = delete; private: void Create(mojo::PendingRemote source, mojo::PendingReceiver receiver) final { if (auto* host = RenderFrameHostImpl::FromID(process_id_, routing_id_)) { GetContentClient()->browser()->CreateMediaRemoter(host, std::move(source), std::move(receiver)); } } const int process_id_; const int routing_id_; }; #endif // BUILDFLAG(ENABLE_MEDIA_REMOTING) RenderFrameHostOrProxy LookupRenderFrameHostOrProxy(int process_id, int routing_id) { RenderFrameHostImpl* rfh = RenderFrameHostImpl::FromID(process_id, routing_id); RenderFrameProxyHost* proxy = nullptr; if (!rfh) { proxy = RenderFrameProxyHost::FromID(process_id, routing_id); } return RenderFrameHostOrProxy(rfh, proxy); } RenderFrameHostOrProxy LookupRenderFrameHostOrProxy( int process_id, const blink::FrameToken& frame_token) { if (frame_token.Is()) { auto it = GetTokenFrameMap().find(frame_token.GetAs()); // The check against |process_id| isn't strictly necessary, but represents // an extra level of protection against a renderer trying to force a frame // token. if (it == GetTokenFrameMap().end() || process_id != it->second->GetProcess()->GetDeprecatedID()) { return RenderFrameHostOrProxy(nullptr, nullptr); } return RenderFrameHostOrProxy(it->second, nullptr); } CHECK(frame_token.Is()); return RenderFrameHostOrProxy( nullptr, RenderFrameProxyHost::FromFrameToken( process_id, frame_token.GetAs())); } // Set crash keys that will help understand the circumstances of a renderer // kill. Note that the commit URL is already reported in a crash key, and // additional keys are logged in RenderProcessHostImpl::ShutdownForBadMessage. void LogRendererKillCrashKeys(const SiteInfo& site_info) { static auto* const site_info_key = base::debug::AllocateCrashKeyString( "current_site_info", base::debug::CrashKeySize::Size256); base::debug::SetCrashKeyString(site_info_key, site_info.GetDebugString()); } void LogCanCommitOriginAndUrlFailureReason(std::string_view failure_reason) { static auto* const failure_reason_key = base::debug::AllocateCrashKeyString( "rfhi_can_commit_failure_reason", base::debug::CrashKeySize::Size64); base::debug::SetCrashKeyString(failure_reason_key, failure_reason); } std::unique_ptr CloneFactoryBundle( scoped_refptr bundle) { return base::WrapUnique(static_cast( bundle->Clone().release())); } // Helper method to download a URL on UI thread. void StartDownload( std::unique_ptr parameters, scoped_refptr blob_url_loader_factory) { CHECK_CURRENTLY_ON(BrowserThread::UI); RenderProcessHost* render_process_host = RenderProcessHost::FromID(parameters->render_process_host_id()); if (!render_process_host) { return; } BrowserContext* browser_context = render_process_host->GetBrowserContext(); DownloadManager* download_manager = browser_context->GetDownloadManager(); parameters->set_download_source(download::DownloadSource::FROM_RENDERER); download_manager->DownloadUrl(std::move(parameters), std::move(blob_url_loader_factory)); } // Called on the UI thread when the data URL in the BlobDataHandle // is read. void OnDataURLRetrieved( std::unique_ptr parameters, GURL data_url) { CHECK_CURRENTLY_ON(BrowserThread::UI); if (!data_url.is_valid()) { return; } parameters->set_url(std::move(data_url)); StartDownload(std::move(parameters), nullptr); } // Analyzes trusted sources of a frame's private-state-token-redemption // Permissions Policy feature to see if the feature is definitely disabled or // potentially enabled. // // This information will be bound to a URLLoaderFactory; if the answer is // "definitely disabled," the network service will report a bad message if it // receives a request from the renderer to execute a Trust Tokens redemption or // signing operation in the frame. // // A return value of kForbid denotes that the feature is disabled for the // frame. A return value of kPotentiallyPermit means that all trusted // information sources say that the policy is enabled. network::mojom::TrustTokenOperationPolicyVerdict DetermineWhetherToForbidTrustTokenOperation( const RenderFrameHostImpl* frame, const blink::mojom::CommitNavigationParams& commit_params, const url::Origin& subframe_origin, const network::mojom::TrustTokenOperationType& operation) { std::unique_ptr subframe_policy; // TODO(crbug.com/40263106): Add WPT to test how TrustTokens behave in // a FencedFrame's subframe. if (frame->IsFencedFrameRoot()) { const std::optional& fenced_frame_properties = frame->frame_tree_node()->GetFencedFrameProperties(); if (!fenced_frame_properties) { // Without fenced frame properties, there won't be a list of // effective enabled permissions or information about the embedder's // permissions policies, so we create a permissions policy with every // permission disabled. subframe_policy = network::PermissionsPolicy::CreateFixedForFencedFrame( subframe_origin, /*header_policy=*/{}, {}); } else if (fenced_frame_properties->parent_permissions_info().has_value()) { // Fenced frames with flexible permissions are allowed to inherit certain // permissions from their parent's permissions policy. const network::PermissionsPolicy* parent_policy = frame->GetParentOrOuterDocument()->GetPermissionsPolicy(); network::ParsedPermissionsPolicy container_policy = commit_params.frame_policy.container_policy; subframe_policy = network::PermissionsPolicy::CreateFlexibleForFencedFrame( parent_policy, /*header_policy=*/{}, container_policy, subframe_origin); } else { // Fenced frames with fixed permissions have a list of required permission // policies to load and can't be granted extra policies, so use the // required policies instead of inheriting from its parent. Note that the // parent policies must allow the required policies, which is checked // separately in // NavigationRequest::CheckPermissionsPoliciesForFencedFrames. subframe_policy = network::PermissionsPolicy::CreateFixedForFencedFrame( subframe_origin, /*header_policy=*/{}, fenced_frame_properties->effective_enabled_permissions()); } } else { // For main frame loads, the frame's permissions policy is determined // entirely by response headers, which are provided by the renderer. if (!frame->GetParent()) { return network::mojom::TrustTokenOperationPolicyVerdict:: kPotentiallyPermit; } const network::PermissionsPolicy* parent_policy = frame->GetParent()->GetPermissionsPolicy(); network::ParsedPermissionsPolicy container_policy = commit_params.frame_policy.container_policy; subframe_policy = network::PermissionsPolicy::CreateFromParentPolicy( parent_policy, /*header_policy=*/{}, container_policy, subframe_origin); } switch (operation) { case network::mojom::TrustTokenOperationType::kRedemption: case network::mojom::TrustTokenOperationType::kSigning: if (subframe_policy->IsFeatureEnabled( network::mojom::PermissionsPolicyFeature:: kTrustTokenRedemption)) { return network::mojom::TrustTokenOperationPolicyVerdict:: kPotentiallyPermit; } return network::mojom::TrustTokenOperationPolicyVerdict::kForbid; case network::mojom::TrustTokenOperationType::kIssuance: if (subframe_policy->IsFeatureEnabled( network::mojom::PermissionsPolicyFeature:: kPrivateStateTokenIssuance)) { return network::mojom::TrustTokenOperationPolicyVerdict:: kPotentiallyPermit; } return network::mojom::TrustTokenOperationPolicyVerdict::kForbid; } return network::mojom::TrustTokenOperationPolicyVerdict::kForbid; } // When a frame creates its initial subresource loaders, it needs to know // whether the private-state-token-redemption Permissions Policy feature will be // enabled after the commit finishes, which is a little involved (see // DetermineWhetherToForbidTrustTokenOperation). In contrast, if it needs to // make this decision once the frame has committted---for instance, to create // more loaders after the network service crashes---it can directly consult the // current Permissions Policy state to determine whether the feature is enabled. network::mojom::TrustTokenOperationPolicyVerdict DetermineAfterCommitWhetherToForbidTrustTokenOperation( RenderFrameHostImpl& impl, const network::mojom::TrustTokenOperationType& operation) { switch (operation) { case network::mojom::TrustTokenOperationType::kRedemption: case network::mojom::TrustTokenOperationType::kSigning: if (impl.IsFeatureEnabled(network::mojom::PermissionsPolicyFeature:: kTrustTokenRedemption)) { return network::mojom::TrustTokenOperationPolicyVerdict:: kPotentiallyPermit; } return network::mojom::TrustTokenOperationPolicyVerdict::kForbid; case network::mojom::TrustTokenOperationType::kIssuance: if (impl.IsFeatureEnabled(network::mojom::PermissionsPolicyFeature:: kPrivateStateTokenIssuance)) { return network::mojom::TrustTokenOperationPolicyVerdict:: kPotentiallyPermit; } return network::mojom::TrustTokenOperationPolicyVerdict::kForbid; } return network::mojom::TrustTokenOperationPolicyVerdict::kForbid; } bool IsOriginSandboxedWithAllowSameSiteNoneCookiesValue( network::mojom::WebSandboxFlags sandbox_flags) { if (sandbox_flags == network::mojom::WebSandboxFlags::kNone) { return false; } if ((sandbox_flags & network::mojom::WebSandboxFlags::kOrigin) == network::mojom::WebSandboxFlags::kNone) { return false; } return (sandbox_flags & network::mojom::WebSandboxFlags::kAllowSameSiteNoneCookies) == network::mojom::WebSandboxFlags::kNone; } // A simplified version of Blink's WebFrameLoadType, used to simulate renderer // calculations. See CalculateRendererLoadType() further below. // TODO(crbug.com/40150370): This should only be here temporarily. // Remove this once the renderer behavior at commit time is more consistent with // what the browser instructed it to do (e.g. reloads will always be classified // as kReload). enum class RendererLoadType { kStandard, kBackForward, kReload, kReplaceCurrentItem, }; bool ValidateIframeAttributeHeaderValue(const std::string& value) { // The `csp` and `connectionallowlist` iframe attributes are re-emitted // verbatim as the `Sec-Required-CSP` / `Sec-Required-Connection-Allowlist` // HTTP request headers, so their values must be valid HTTP header values. A // well-behaved renderer never delivers an invalid value. static const size_t kMaxLengthIframeAttributeHeaderValue = 4096; if (!base::IsStringASCII(value) || !net::HttpUtil::IsValidHeaderValue(value) || value.length() > kMaxLengthIframeAttributeHeaderValue) { return false; } return true; } perfetto::protos::pbzero::FrameDeleteIntention FrameDeleteIntentionToProto( mojom::FrameDeleteIntention intent) { using ProtoLevel = perfetto::protos::pbzero::FrameDeleteIntention; switch (intent) { case mojom::FrameDeleteIntention::kNotMainFrame: return ProtoLevel::FRAME_DELETE_INTENTION_NOT_MAIN_FRAME; case mojom::FrameDeleteIntention::kSpeculativeMainFrameForShutdown: return ProtoLevel:: FRAME_DELETE_INTENTION_SPECULATIVE_MAIN_FRAME_FOR_SHUTDOWN; case mojom::FrameDeleteIntention:: kSpeculativeMainFrameForNavigationCancelled: return ProtoLevel:: FRAME_DELETE_INTENTION_SPECULATIVE_MAIN_FRAME_FOR_NAVIGATION_CANCELLED; } // All cases should've been handled by the switch case above. NOTREACHED(); } void WriteRenderFrameImplDeletion(perfetto::EventContext& ctx, RenderFrameHostImpl* rfh, mojom::FrameDeleteIntention intent) { auto* event = ctx.event(); auto* data = event->set_render_frame_impl_deletion(); data->set_has_pending_commit(rfh->HasPendingCommitNavigation()); data->set_has_pending_cross_document_commit( rfh->HasPendingCommitForCrossDocumentNavigation()); data->set_frame_tree_node_id(rfh->GetFrameTreeNodeId().value()); data->set_intent(FrameDeleteIntentionToProto(intent)); } // Returns the amount of time to keep subframe processes alive in case they can // be reused. Returns zero if under memory pressure, as memory should be freed // up as soon as possible if it's limited. base::TimeDelta GetSubframeProcessShutdownDelay(BrowserContext* browser_context, int memory_limit) { static constexpr base::TimeDelta kZeroDelay; if (!RenderProcessHostImpl::ShouldDelayProcessShutdown()) { return kZeroDelay; } // Don't delay process shutdown under memory pressure. Does not cancel // existing shutdown delays for processes already in delayed-shutdown state. if (memory_limit <= base::kModerateMemoryPressureThreshold) { return kZeroDelay; } if (base::FeatureList::IsEnabled(features::kSubframeProcessShutdownDelay)) { return base::Seconds(features::kSubframeProcessShutdownDelaySeconds.Get()); } return kSubframeProcessShutdownDelay; } // Returns the "document" URL used for a navigation, which might be different // than the commit URL (CommonNavigationParam's URL) for certain cases such as // error document and loadDataWithBaseURL() commits. GURL GetLastDocumentURL( NavigationRequest* request, const mojom::DidCommitProvisionalLoadParams& params, bool last_document_is_error_document, const RenderFrameHostImpl::RendererURLInfo& renderer_url_info) { if (request->DidEncounterError() || (request->IsSameDocument() && last_document_is_error_document)) { // If the navigation happens on an error document, the document URL is set // to kUnreachableWebDataURL. Note that if a same-document navigation // happens in an error document it's possible for the document URL to have // changed, but the browser has no way of knowing that URL since it isn't // exposed in any way. Additionally, all current known ways to do a // same-document navigation on an error document // (history.pushState/replaceState without changing the URL) won't change // the URL, so it's probably OK to keep using kUnreachableWebDataURL here. return GURL(kUnreachableWebDataURL); } if (request->IsLoadDataWithBaseURL()) { // loadDataWithBaseURL() navigation can set its own "base URL", which is // also used by the renderer as the document URL unless the navigation // failed (which is already accounted for in the error document case above). return request->common_params().base_url_for_data_url; } if (renderer_url_info.was_loaded_from_load_data_with_base_url && request->IsSameDocument()) { // If this is a same-document navigation on a document loaded from // loadDataWithBaseURL(), it is not currently possible to figure out the // document URL. This is because the renderer can navigate to any // same-document URL, but that URL will not be used for // DidCommitProvisionalLoadParams' `url` if the loading URL for the document // is set to the data: URL. In this case, just return the last document URL, // since at least it will have the correct origin. return renderer_url_info.last_document_url; } // For all other navigations, the document URL should be the same as the URL // that is used to commit. return params.url; } // Return true when `mode` is enabled for kAvoidUnnecessaryBeforeUnloadCheckSync // feature (see: https://crbug.com/396998476). bool IsAvoidUnnecessaryBeforeUnloadCheckSyncEnabledFor( features::AvoidUnnecessaryBeforeUnloadCheckSyncMode mode) { if (!GetContentClient() ->browser() ->SupportsAvoidUnnecessaryBeforeUnloadCheckSync()) { return false; } if (!base::FeatureList::IsEnabled( features::kAvoidUnnecessaryBeforeUnloadCheckSync)) { return false; } return features::kAvoidUnnecessaryBeforeUnloadCheckSyncMode.Get() == mode; } // Returns true if `host` has the Window Management permission granted. bool IsWindowManagementGranted(RenderFrameHost* host) { content::PermissionController* permission_controller = host->GetBrowserContext()->GetPermissionController(); CHECK(permission_controller); return permission_controller->GetPermissionStatusForCurrentDocument( content::PermissionDescriptorUtil:: CreatePermissionDescriptorForPermissionType( blink::PermissionType::WINDOW_MANAGEMENT), host) == blink::mojom::PermissionStatus::GRANTED; } bool IsOpenGraphMetadataValid(const blink::mojom::OpenGraphMetadata* metadata) { return !metadata->image || metadata->image->SchemeIsHTTPOrHTTPS(); } void ForwardOpenGraphMetadataIfValid( base::OnceCallback callback, blink::mojom::OpenGraphMetadataPtr metadata) { if (IsOpenGraphMetadataValid(metadata.get())) { std::move(callback).Run(std::move(metadata)); } else { std::move(callback).Run({}); } } // Creates a JavaScriptExecuteRequestForTestsCallback callback that delegates // to the given JavaScriptResultCallback. blink::mojom::LocalFrame::JavaScriptExecuteRequestForTestsCallback CreateJavaScriptExecuteRequestForTestsCallback( RenderFrameHost::JavaScriptResultCallback callback) { if (!callback) { return base::NullCallback(); } return base::BindOnce( [](RenderFrameHost::JavaScriptResultCallback callback, blink::mojom::JavaScriptExecutionResultType type, base::Value value) { if (type == blink::mojom::JavaScriptExecutionResultType::kSuccess) { std::move(callback).Run(value.Clone()); } else { std::move(callback).Run(base::Value()); } }, std::move(callback)); } bool ValidateUnfencedTopNavigation( RenderFrameHostImpl* render_frame_host, GURL& url, int initiator_process_id, const scoped_refptr& post_body, bool user_gesture) { // Validate and modify `url` as needed. render_frame_host->GetSiteInstance()->GetProcess()->FilterURL( /*empty_allowed=*/false, &url); if (!render_frame_host->IsNestedWithinFencedFrame() || render_frame_host->IsSandboxed( network::mojom::WebSandboxFlags::kTopNavigationByUserActivation)) { // If either of these conditions are true, then assume a compromised // renderer. bad_message::ReceivedBadMessage( initiator_process_id, bad_message::RFHI_UNFENCED_TOP_IPC_OUTSIDE_FENCED_FRAME); return false; } // Perform checks that normally would be performed in // `blink::CanNavigate` but that we skipped because the target // frame wasn't available in the renderer. // TODO(crbug.com/40053214): Change these checks to send a BadMessage // when the renderer-side refactor is complete. // Javascript URLs are not allowed, because they can be used to // communicate from the fenced frame to the embedder. // TODO(crbug.com/40221940): It does not seem possible to reach this code // with an uncompromised renderer, because javascript URLs don't reach // the same IPC; instead they run inside the fenced frame as _self. // It also seems that Javascript URLs would be caught earlier in this // particular code path by VerifyOpenURLParams(). // In this code's final IPC resting place after the factor, make sure // to check whether this code is redundant. if (url.SchemeIs(url::kJavaScriptScheme)) { render_frame_host->AddMessageToConsole( blink::mojom::ConsoleMessageLevel::kError, "The frame attempting navigation must be in the same fenced " "frame tree as the target if navigating to a javascript: url"); return false; } // Blob URLs are not allowed, because you should not be able to exfiltrate // arbitrary amounts of information from a fenced frame. if (url.SchemeIs(url::kBlobScheme)) { render_frame_host->AddMessageToConsole( blink::mojom::ConsoleMessageLevel::kError, "_unfencedTop may not be used with a blob: url"); return false; } // POST requests are not allowed, because they are asynchronous and more // difficult to account for in privacy budgets. if (post_body) { render_frame_host->AddMessageToConsole( blink::mojom::ConsoleMessageLevel::kError, "_unfencedTop may not be used to send POST requests"); return false; } // User activation is required, because fenced frames use the sandbox // flag `allow-top-navigation-by-user-activation`. // It would be better to instead check // `render_frame_host->HasTransientUserActivation()`, // but it has already been consumed at this point. // TODO(crbug.com/40091540): use the browser's source of truth for user // activation here (and elsewhere in this file) rather than trust the // renderer. if (!user_gesture) { render_frame_host->AddMessageToConsole( blink::mojom::ConsoleMessageLevel::kError, "The frame attempting navigation of the top-level window is " "sandboxed with the 'allow-top-navigation-by-user-activation' " "flag, but has no user activation (aka gesture). See " "https://www.chromestatus.com/feature/5629582019395584."); return false; } return true; } bool IsOpenerSameOriginFrame(const RenderFrameHostImpl* opener) { return opener->GetLastCommittedOrigin() == opener->GetMainFrame()->GetLastCommittedOrigin(); } // See https://html.spec.whatwg.org/C/#browsing-context-names (step 8) // ``` // If current's top-level browsing context's active document's // cross-origin opener policy's value is "same-origin" or // "same-origin-plus-COEP", then [...] set noopener to true, name to // "_blank", and windowType to "new with no opener". // ``` bool CoopSuppressOpener(const RenderFrameHostImpl* opener) { // Those values are explicitly listed here, to force creator of new // values to make an explicit decision in the future. // See regression: https://crbug.com/1181673 switch (opener->GetMainFrame()->cross_origin_opener_policy().value) { case network::mojom::CrossOriginOpenerPolicyValue::kUnsafeNone: case network::mojom::CrossOriginOpenerPolicyValue::kSameOriginAllowPopups: case network::mojom::CrossOriginOpenerPolicyValue::kNoopenerAllowPopups: return false; case network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin: case network::mojom::CrossOriginOpenerPolicyValue::kSameOriginPlusCoep: return !IsOpenerSameOriginFrame(opener); } } // Traverse up a frame tree, starting at `rfh`, until finding a RFH whose // associated fenced document data matches the expected criteria. Namely, it // must contain automatic beacon data for the provided `event_type`, and if // `is_same_origin` is set to false (i.e. the frame initiating an automatic // beacon is cross-origin to the mapped URL of the root frame's fenced frame // config), the data must be marked as cross-origin exposed. FencedDocumentData* GetFencedDocumentData( RenderFrameHostImpl* rfh, blink::mojom::AutomaticBeaconType event_type, bool is_same_origin) { // Traverse up to but not past a URN iframe root. for (; rfh; rfh = rfh->frame_tree_node()->HasFencedFrameProperties() ? nullptr : rfh->GetParent()) { FencedDocumentData* fenced_document_data = FencedDocumentData::GetForCurrentDocument(rfh); if (!fenced_document_data) { continue; } const std::optional beacon_info = fenced_document_data->GetAutomaticBeaconInfo(event_type); if (!beacon_info) { continue; } // Check if the beacon data is usable based on whether the data needs to be // cross-origin exposed. If the feature flag is not enabled, unconditionally // return the document data, even if it means returning non-cross origin // exposed data for a cross-origin automatic beacon (which would result in // no data being sent). if (is_same_origin || beacon_info->cross_origin_exposed || !base::FeatureList::IsEnabled( blink::features::kFencedFramesCrossOriginAutomaticBeaconData)) { return fenced_document_data; } } return nullptr; } bool FencedFrameAutomaticBeaconsAllowed(RenderFrameHostImpl* rfh) { if (!rfh->GetLastResponseHead() || !rfh->GetLastResponseHead()->headers) { return false; } std::optional allow = rfh->GetLastResponseHead()->headers->GetNormalizedHeader( "Allow-Fenced-Frame-Automatic-Beacons"); return allow && base::EqualsCaseInsensitiveASCII(*allow, "true"); } // Check if the document is loaded without URLLoaderClient. bool IsDocumentLoadedWithoutUrlLoaderClient( NavigationRequest* navigation_request, GURL url, bool is_same_document, bool is_mhtml_subframe) { #if BUILDFLAG(IS_ANDROID) if (navigation_request->GetUrlInfo().embedder_isolation_info.is_pdf()) { return true; } #endif // BUILDFLAG(IS_ANDROID) return is_mhtml_subframe || is_same_document || url.SchemeIs(url::kDataScheme) || !IsURLHandledByNetworkStack(url) || // Initial WebUI navigations loads the body internally within the // renderer process, so there is no need to create and send // URLLoaderClient from the browser process. navigation_request->IsInitialWebUINavigation(); } std::vector GetTargetUrlsOfBoostRenderProcessForLoading() { std::optional json_value = base::JSONReader::Read( base::UnescapeURLComponent( blink::features::kBoostRenderProcessForLoadingTargetUrls.Get(), base::UnescapeRule::SPACES), base::JSON_PARSE_CHROMIUM_EXTENSIONS); if (!json_value) { return {}; } base::ListValue* entries = json_value->GetIfList(); if (!entries) { return {}; } std::vector result; result.reserve(entries->size()); for (const base::Value& entry : *entries) { const std::string* target_url = entry.GetIfString(); if (target_url) { GURL url(*target_url); if (url.is_valid()) { result.emplace_back(std::move(url)); } } } return result; } bool ShouldBoostRenderProcessForLoading( RenderFrameHostImpl::LifecycleStateImpl lifecycle_state, bool is_prerendering) { if (blink::features::kBoostRenderProcessForLoadingPrioritizePrerenderingOnly .Get()) { return is_prerendering; } switch (lifecycle_state) { case RenderFrameHostImpl::LifecycleStateImpl::kSpeculative: case RenderFrameHostImpl::LifecycleStateImpl::kPendingCommit: case RenderFrameHostImpl::LifecycleStateImpl::kActive: return true; case RenderFrameHostImpl::LifecycleStateImpl::kPrerendering: return blink::features:: kBoostRenderProcessForLoadingPrioritizePrerendering.Get(); case RenderFrameHostImpl::LifecycleStateImpl::kInBackForwardCache: case RenderFrameHostImpl::LifecycleStateImpl::kRunningUnloadHandlers: case RenderFrameHostImpl::LifecycleStateImpl::kReadyToBeDeleted: return false; } } bool BoostRendererInitiatedNavigation() { // If this is set to true, then the renderer initiated navigation is boosted // in addition to the browser initiated navigation. static const bool boost_renderer_initiated_navigation = base::GetFieldTrialParamByFeatureAsBool( blink::features::kBoostRenderProcessForLoading, "prioritize_renderer_initiated", true); return boost_renderer_initiated_navigation; } std::optional GetHostnameMinusRegistry(const GURL& url) { ASSIGN_OR_RETURN( const size_t registry_length, net::registry_controlled_domains::GetRegistry( url, net::registry_controlled_domains::EXCLUDE_UNKNOWN_REGISTRIES, net::registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES) .transform(&std::string_view::size)); const std::string_view hostname = url.host(); if (registry_length == 0 || registry_length >= hostname.length()) { return std::nullopt; } // Removes the tld and the preceding dot. return hostname.substr(0, hostname.length() - (registry_length + 1)); } bool IsSameHostnameMinusRegistry(const GURL& url1, const GURL& url2) { auto hostname_minus_registry1 = GetHostnameMinusRegistry(url1); auto hostname_minus_registry2 = GetHostnameMinusRegistry(url2); if (!hostname_minus_registry1 || !hostname_minus_registry2) { return false; } return *hostname_minus_registry1 == *hostname_minus_registry2; } bool IsTargetUrlOfBoostRenderProcessForLoading(const GURL& url) { static const bool kIsEnabled = base::FeatureList::IsEnabled( blink::features::kBoostRenderProcessForLoading); if (!kIsEnabled) { return false; } static const base::NoDestructor> kTargetUrls( GetTargetUrlsOfBoostRenderProcessForLoading()); if (kTargetUrls->empty()) { return true; } for (GURL target_url : *kTargetUrls) { if (IsSameHostnameMinusRegistry(url, target_url) && url.path() == target_url.path()) { return true; } } return false; } void RecordIsProcessBackgrounded(const char* timing_string, base::Process::Priority process_priority) { base::UmaHistogramBoolean( base::StrCat({"Navigation.IsProcessBackgrounded2.", timing_string}), process_priority == base::Process::Priority::kBestEffort); } // These are directly cast to UKM enums of the same name and logged, // be sure not to change ordering or delete lines. enum class WindowProxyFrameContext { kTopFrame, kSubFrameSameSite, kSubFrameCrossSite, }; WindowProxyFrameContext GetWindowProxyFrameContext(RenderFrameHostImpl* frame) { if (frame == frame->GetOutermostMainFrame()) { return WindowProxyFrameContext::kTopFrame; } else if (frame->GetStorageKey() == frame->GetOutermostMainFrame()->GetStorageKey()) { return WindowProxyFrameContext::kSubFrameSameSite; } else { return WindowProxyFrameContext::kSubFrameCrossSite; } } // These are directly cast to UKM enums of the same name and logged, // be sure not to change ordering or delete lines. enum class WindowProxyPageContext { kWindow = 0, kPopup = 1, kObsolete_PartitionedPopin = 2, }; WindowProxyPageContext GetWindowProxyPageContext(RenderFrameHostImpl* frame) { if (frame->delegate()->IsPopup()) { return WindowProxyPageContext::kPopup; } else { return WindowProxyPageContext::kWindow; } } // These are directly cast to UKM enums of the same name and logged, // be sure not to change ordering or delete lines. enum class WindowProxyStorageKeyComparison { kSameKey, kSameTopSiteCrossOrigin, kCrossTopSiteSameOrigin, kCrossKey, }; WindowProxyStorageKeyComparison GetWindowProxyStorageKeyComparison( const blink::StorageKey& local_storage_key, const blink::StorageKey& remote_storage_key) { if (local_storage_key == remote_storage_key) { return WindowProxyStorageKeyComparison::kSameKey; } else if (local_storage_key.top_level_site() == remote_storage_key.top_level_site()) { return WindowProxyStorageKeyComparison::kSameTopSiteCrossOrigin; } else if (local_storage_key.origin() == remote_storage_key.origin() && local_storage_key.nonce() == remote_storage_key.nonce()) { return WindowProxyStorageKeyComparison::kCrossTopSiteSameOrigin; } else { return WindowProxyStorageKeyComparison::kCrossKey; } } // These are directly cast to UKM enums of the same name and logged, // be sure not to change ordering or delete lines. enum class WindowProxyUserActivationState { kIsActive, kHasBeenActive, kNeverActive, }; WindowProxyUserActivationState GetWindowProxyUserActivationState( const RenderFrameHostImpl* frame) { if (frame->IsActiveUserActivation()) { return WindowProxyUserActivationState::kIsActive; } else if (frame->HasStickyUserActivation()) { return WindowProxyUserActivationState::kHasBeenActive; } else { return WindowProxyUserActivationState::kNeverActive; } } // Responsible for cleaning up render processes for discard operations. class DiscardedRFHProcessHelper : public base::SupportsUserData::Data, public ServiceWorkerContextObserver { public: explicit DiscardedRFHProcessHelper(RenderProcessHost* host) : host_(host) {} DiscardedRFHProcessHelper(const DiscardedRFHProcessHelper&) = delete; DiscardedRFHProcessHelper& operator=(const DiscardedRFHProcessHelper&) = delete; ~DiscardedRFHProcessHelper() override = default; static DiscardedRFHProcessHelper* GetForRenderProcessHost( RenderProcessHost* host) { if (!host->GetUserData(kDiscardedRFHProcessHelperKey)) { host->SetUserData(kDiscardedRFHProcessHelperKey, std::make_unique(host)); } return static_cast( host->GetUserData(kDiscardedRFHProcessHelperKey)); } // Resets `retries_` and begins attempts to shutdown sequenced with delay // until kKeepAliveHandleFactoryTimeout is reached. Posts the shutdown task to // the task queue as a synchronous process shutdown may update RFH state in a // way callers may not expect. void ShutdownForDiscardIfPossible() { shutdown_attempt_timer_.Stop(); retries_ = 0; shutdown_attempt_timer_.Start( FROM_HERE, /*delay=*/kUnloadTimeout, base::BindRepeating(&DiscardedRFHProcessHelper::ShutdownIfPossible, base::Unretained(this))); } void SimulateKeepAliveTimeoutForTesting() { keep_alive_timeout_for_testing_ = true; } private: // A task that attempts to shutdown the render process for the case where only // discarded frames remain. void ShutdownIfPossible() { if (!host_->IsInitializedAndNotDead() || host_->IsDeletingSoon()) { return; } // The delay between render process shutdown attempts. Attempts will // continue until a maximum delay of kKeepAliveHandleFactoryTimeout is // reached. constexpr base::TimeDelta kProcessShutdownRetryDelay = base::Milliseconds(500); // Attempt a fast shutdown if only discarded frames remain in the process. A // render process may host both speculative and non-speculative frames, // however speculative frames cannot be discarded and // FastShutdownIfPossible() will no-op if speculative frames are hosted in // the process. This is because a pending view is registered on the process // when a speculative frame is created. bool only_discarded_frames = true; std::set discarded_widgets; host_->ForEachRenderFrameHost( [&only_discarded_frames, &discarded_widgets](RenderFrameHost* rfh) { if (static_cast(rfh) ->document_associated_data() .is_discarded()) { discarded_widgets.insert(rfh->GetRenderWidgetHost()); } else { only_discarded_frames = false; } }); // Attempt a shutdown if the renderer is hosting only discarded frames. if (discarded_widgets.empty() || !only_discarded_frames) { return; } // If shutdown re-attempts have exceeded the kKeepAliveHandleFactoryTimeout // then attempt a final shutdown ignoring any active keep-alive refs. if (keep_alive_timeout_for_testing_ || retries_ * kProcessShutdownRetryDelay >= RenderProcessHostImpl::kKeepAliveHandleFactoryTimeout) { host_->FastShutdownIfPossible( /*page_count=*/discarded_widgets.size(), /*skip_unload_handlers=*/true, /*ignore_workers=*/true, /*ignore_keep_alive=*/true); return; } // If re-attempts have not yet reached kKeepAliveHandleFactoryTimeout // attempt a shutdown honoring any existing keep-alive refs. Schedule a // retry if fast shutdown is blocked. if (!host_->FastShutdownIfPossible( /*page_count=*/discarded_widgets.size(), /*skip_unload_handlers=*/true, /*ignore_workers=*/true, /*ignore_keep_alive=*/false)) { retries_++; shutdown_attempt_timer_.Start( FROM_HERE, kProcessShutdownRetryDelay, base::BindRepeating(&DiscardedRFHProcessHelper::ShutdownIfPossible, base::Unretained(this))); } } // `retries_` tracks the number of shutdown attempts. int retries_ = 0; // Timer for the task that attempts to shutdown the render process. base::RetainingOneShotTimer shutdown_attempt_timer_; // Owns this. const raw_ptr host_; bool keep_alive_timeout_for_testing_ = false; }; // Helper to record trace events and metrics for a navigation to `url`, using // the timestamps stored in `timeline`. // // This is similar to NavigationRequest::MaybeRecordTraceEventsAndHistograms(), // but improves on it in the following ways: (1) this works for any navigation, // whereas the NavigationRequest version was intended to be used in certain // narrow cases, (2) this is designed to be called at the very end of navigation // commit, which occurs after NavigationRequest destruction, and (3) this // introduces additional slices (e.g. CommitToDidCommit) to give a more thorough // start-to-finish breakdown of navigation timing, and uses more accurate // timestamps for some other slices. Eventually, // NavigationRequest::MaybeRecordTraceEventsAndHistograms() should be replaced // with this function. // // `ukm_builder` should be available only when the navigation is for a main // frame. Thus, we don't need to record separate main-frame-only metrics for // UKMs. void RecordNavigationTraceEventsAndMetrics( const perfetto::Track& track, const NavigationRequest::Timeline& timeline, const GURL& url, bool is_primary_main_frame, bool is_same_document_navigation, std::optional& ukm_builder) { CHECK(!timeline.start.is_null()); const perfetto::NamedTrack track1("Navigation: Timelines (Browser)", base::trace_event::GetNextGlobalTraceId(), track); // Convenient alias for `ukm::builders::NavigationTimeline` member functions. using UkmBuilderMethod = ukm::builders::NavigationTimeline& ( ukm::builders::NavigationTimeline::*)(int64_t); static const perfetto::StaticString kInteractionToActualNavigationStart( "InteractionToActualNavigationStart"); // Define a helper to log both a trace event slice and a corresponding metric // for one stage of a navigation. If `ukm_builder_method` is specified, it // will be used for recording UKMs. If `histogram_name` is specified, it will // be used for the histogram name instead of `name`. If `url` is specified, it // will be emitted as page_load.url argument along the trace event. auto log_trace_event_and_uma = [&](perfetto::StaticString name, const perfetto::NamedTrack track, const base::TimeTicks& begin_time, const base::TimeTicks& end_time, UkmBuilderMethod ukm_builder_method = nullptr, const std::string& histogram_name = std::string(), const std::string& url = std::string()) { if (begin_time.is_null() || end_time.is_null()) { return; } // TODO(alexmos): These cases should never happen in practice, unless // the renderer provides inaccurate timestamps (either by lying, or due // to inter-process time skew that hasn't yet been adjusted with // InterProcessTimeTicksConverter). This should be tightened up to // validate (and possibly adjust) the renderer-provided timestamps and // then convert this to a CHECK. // Note: `timeline.user_interaction` can naturally occur before // `timeline.start`, so it is not subject to the `begin_time < // timeline.start` check, therefore explicitly allow it when the name is // kInteractionToActualNavigationStart. if ((name.value != kInteractionToActualNavigationStart.value && begin_time < timeline.start) || end_time > timeline.finish) { return; } // Note that some cases in practice (e.g., prefetch, headless virtual // time) may cause end_time to be before begin_time. This can happen in // unit tests or due to compromised renderers as well. Skip trace events // and metrics in these ill-defined cases. if (end_time < begin_time) { return; } TRACE_EVENT_BEGIN("navigation", name, track, begin_time, [&](perfetto::EventContext& ctx) { if (url.empty()) { return; } perfetto::protos::pbzero::PageLoad* page_load = ctx.event()->set_page_load(); page_load->set_url(url); }); TRACE_EVENT_END("navigation", track, end_time); // When provided, `histogram_name` is used to avoid including variable // or sensitive data in the reported metric name. For example, `name` // may include the navigation URL when measuring the start-to-finish // time, but we only want to use that for trace events and omit the // URL in metric names for UMA. base::UmaHistogramTimes( "Navigation.Timeline." + (histogram_name.empty() ? std::string(name.value) : histogram_name) + ".Duration", end_time - begin_time); if (ukm_builder.has_value() && ukm_builder_method) { (*ukm_builder.* ukm_builder_method)((end_time - begin_time).InMilliseconds()); } }; // Actual navigation events are logged below in contiguous (or nested) // intervals. // Record a trace event to visualize the duration between a) the OS-level // timestamp of the user input event that started a navigation to b) the // actual navigation start (timeline.start). This duration is not included in // the NavigationTotal intentionally. log_trace_event_and_uma(kInteractionToActualNavigationStart, track1, timeline.user_interaction, timeline.start); // Record a top-level "Navigation" trace event with the duration of the // full navigation, and then break it down into nested intervals which will // show up under it. Note that `url` is the committing URL, which might differ // from the starting URL, e.g. due to redirects. // TODO(crbug.com/405437928): Overlapping navigations may incorrectly appear // to be nested, using the wrong end times. log_trace_event_and_uma("NavigationTotal", track1, timeline.start, timeline.finish, &ukm::builders::NavigationTimeline::SetTotalDuration, /*histogram_name=*/"Total", /*url=*/url.spec()); // Emit a trace event with url in the name for convenience. // TODO(crbug.com/415720503): Remove once Perfetto navigation plugins // surfaces urls. std::string top_level_trace_event_name = "Navigation: " + url.spec(); TRACE_EVENT_BEGIN("navigation", perfetto::DynamicString(top_level_trace_event_name), track1, timeline.start); TRACE_EVENT_END("navigation", track1, timeline.finish); if (!timeline.begin_navigation.is_null()) { // Most navigations (other than synchronous renderer commits) go through // BeginNavigation and the phases below. This includes page activations like // bfcache and prerender, which do not send commit IPCs. // Record Start -> {BeforeUnloadPhase1} -> NavigationRequest. if (!timeline.beforeunload_phase1_start.is_null()) { log_trace_event_and_uma("StartToBeforeUnloadPhase1", track1, timeline.start, timeline.beforeunload_phase1_start, &ukm::builders::NavigationTimeline:: SetStartToBeforeUnloadPhase1Duration); log_trace_event_and_uma( "BeforeUnloadPhase1", track1, timeline.beforeunload_phase1_start, timeline.beforeunload_phase1_end, &ukm::builders::NavigationTimeline::SetBeforeUnloadPhase1Duration); log_trace_event_and_uma( "BeforeUnloadPhase1ToNavigationRequestCreation", track1, timeline.beforeunload_phase1_end, timeline.navigation_request_creation, &ukm::builders::NavigationTimeline:: SetBeforeUnloadPhase1ToNavigationRequestCreationDuration); if (!timeline.beforeunload_phase1_dialog_opened.is_null()) { log_trace_event_and_uma("BeforeUnloadPhase1Dialog", track1, timeline.beforeunload_phase1_dialog_opened, timeline.beforeunload_phase1_dialog_closed); } } else { log_trace_event_and_uma("StartToNavigationRequestCreation", track1, timeline.start, timeline.navigation_request_creation, &ukm::builders::NavigationTimeline:: SetStartToNavigationRequestCreationDuration); } // Record NavigationRequest -> {BeforeUnloadPhase2} -> BeginNavigation. if (!timeline.beforeunload_phase2_start.is_null()) { log_trace_event_and_uma( "NavigationRequestToBeforeUnloadPhase2", track1, timeline.navigation_request_creation, timeline.beforeunload_phase2_start, &ukm::builders::NavigationTimeline:: SetNavigationRequestToBeforeUnloadPhase2Duration); log_trace_event_and_uma( "BeforeUnloadPhase2", track1, timeline.beforeunload_phase2_start, timeline.beforeunload_phase2_end, &ukm::builders::NavigationTimeline::SetBeforeUnloadPhase2Duration); log_trace_event_and_uma( "BeforeUnloadPhase2ToBeginNavigation", track1, timeline.beforeunload_phase2_end, timeline.begin_navigation, &ukm::builders::NavigationTimeline:: SetBeforeUnloadPhase2ToBeginNavigationDuration); if (!timeline.beforeunload_phase2_dialog_opened.is_null()) { log_trace_event_and_uma("BeforeUnloadPhase2Dialog", track1, timeline.beforeunload_phase2_dialog_opened, timeline.beforeunload_phase2_dialog_closed); } } else { log_trace_event_and_uma( "NavigationRequestToBeginNavigation", track1, timeline.navigation_request_creation, timeline.begin_navigation, &ukm::builders::NavigationTimeline:: SetNavigationRequestToBeginNavigationDuration); } // For navigations that don't use a URLLoader, such as about:blank // navigations, record a single interval from BeginNavigation to sending the // CommitNavigation IPC, which will include choosing the target SiteInstance // WillCommitWithoutUrlLoader throttle processing, etc. Do the same for // navigations that encounter an error and never see a response from the // loader. Otherwise, break down the URL loading into several finer-grained // intervals. if (timeline.loader_start.is_null() || timeline.receive_response.is_null()) { log_trace_event_and_uma("BeginNavigationToCommit", track1, timeline.begin_navigation, timeline.commit_ipc_sent, &ukm::builders::NavigationTimeline:: SetBeginNavigationToCommitDuration); } else { log_trace_event_and_uma("BeginNavigationToLoaderStart", track1, timeline.begin_navigation, timeline.loader_start, &ukm::builders::NavigationTimeline:: SetBeginNavigationToLoaderStartDuration); log_trace_event_and_uma("LoaderStartToReceiveResponse", track1, timeline.loader_start, timeline.receive_response, &ukm::builders::NavigationTimeline:: SetLoaderStartToReceiveResponseDuration); // Generate the nested loader events contained within // LoaderStartToReceiveResponse. `loader_fetch_start` can be earlier than // `loader_start` when Prefetch or Prerendering is enabled. Don't record // metrics or traces in such cases to avoid skewing the data. if (timeline.loader_start <= timeline.loader_fetch_start) { log_trace_event_and_uma("LoaderStartToFetchStart", track1, timeline.loader_start, timeline.loader_fetch_start, &ukm::builders::NavigationTimeline:: SetLoaderStartToFetchStartDuration); log_trace_event_and_uma("FetchStartToReceiveHeaders", track1, timeline.loader_fetch_start, timeline.loader_receive_headers, &ukm::builders::NavigationTimeline:: SetFetchStartToReceiveHeadersDuration); // TODO(alexmos): add events for redirects when they are present. log_trace_event_and_uma("ReceiveHeadersToReceiveResponse", track1, timeline.loader_receive_headers, timeline.receive_response, &ukm::builders::NavigationTimeline:: SetReceiveHeadersToReceiveResponseDuration); } log_trace_event_and_uma("ReceiveResponseToCommit", track1, timeline.receive_response, timeline.commit_ipc_sent, &ukm::builders::NavigationTimeline:: SetReceiveResponseToCommitDuration); } log_trace_event_and_uma( "CommitToDidCommit", track1, timeline.commit_ipc_sent, timeline.did_commit_ipc_received, &ukm::builders::NavigationTimeline::SetCommitToDidCommitDuration); } else { // Navigations without a `begin_navigation` timestamp are synchronous // renderer commits, like same-document navigations and the synchronous // about:blank commit. // TODO(crbug.com/409589669): The `timeline.start` value is currently set to // `renderer_commit_ipc_received` in `DidCommitNavigationInternal`, making // `StartToSyncRendererCommit` zero sized. Move the start time earlier. log_trace_event_and_uma("StartToSyncRendererCommit", track1, timeline.start, timeline.renderer_commit_ipc_received, &ukm::builders::NavigationTimeline:: SetStartToSyncRendererCommitDuration); log_trace_event_and_uma( "CommitToDidCommit", track1, timeline.renderer_commit_ipc_received, timeline.did_commit_ipc_received, &ukm::builders::NavigationTimeline::SetCommitToDidCommitDuration); } // Generate a nested slice for the renderer side of the navigation commit, // contained within CommitToDidCommit. log_trace_event_and_uma( "RendererCommitToDidCommit", track1, timeline.renderer_commit_ipc_received, timeline.renderer_did_commit_ipc_sent, &ukm::builders::NavigationTimeline::SetRendererCommitToDidCommitDuration); log_trace_event_and_uma( "DidCommitToFinish", track1, timeline.did_commit_ipc_received, timeline.finish, &ukm::builders::NavigationTimeline::SetDidCommitToFinishDuration); // Create a second track (with the same name but a different ID) for showing // non-nested events about the duration of the navigation, with beforeunload // time removed. const perfetto::NamedTrack track2("Navigation: Timelines (Browser)", base::trace_event::GetNextGlobalTraceId(), track); base::TimeDelta beforeunload_dialog_total_duration; if (!timeline.beforeunload_phase1_dialog_opened.is_null() && !timeline.beforeunload_phase1_dialog_closed.is_null() && timeline.beforeunload_phase1_dialog_opened < timeline.beforeunload_phase1_dialog_closed) { beforeunload_dialog_total_duration += timeline.beforeunload_phase1_dialog_closed - timeline.beforeunload_phase1_dialog_opened; } if (!timeline.beforeunload_phase2_dialog_opened.is_null() && !timeline.beforeunload_phase2_dialog_closed.is_null() && timeline.beforeunload_phase2_dialog_opened < timeline.beforeunload_phase2_dialog_closed) { beforeunload_dialog_total_duration += timeline.beforeunload_phase2_dialog_closed - timeline.beforeunload_phase2_dialog_opened; } // Excluding beforeunload time from the total navigation duration is useful // because it is not under the browser's control, and may include long periods // of waiting for the user to interact with a dialog. base::TimeDelta beforeunload_total_duration; if (!timeline.beforeunload_phase1_start.is_null() && !timeline.beforeunload_phase1_end.is_null() && timeline.beforeunload_phase1_start < timeline.beforeunload_phase1_end) { beforeunload_total_duration += timeline.beforeunload_phase1_end - timeline.beforeunload_phase1_start; } if (!timeline.beforeunload_phase2_start.is_null() && !timeline.beforeunload_phase2_end.is_null() && timeline.beforeunload_phase2_start < timeline.beforeunload_phase2_end) { beforeunload_total_duration += timeline.beforeunload_phase2_end - timeline.beforeunload_phase2_start; } // Record how much time was correctly ignored by current navigation metrics, // by moving it to the start of the duration. base::TimeTicks duration_start = timeline.start + beforeunload_total_duration; log_trace_event_and_uma( "CorrectlyIgnored", track2, timeline.start, duration_start, &ukm::builders::NavigationTimeline::SetIgnoredCorrectlyDuration, /*histogram_name=*/"IgnoredCorrectly"); // Record the remaining duration of the navigation, moving the start time // forward by the amount that was ignored. log_trace_event_and_uma("TotalExcludingBeforeUnload", track2, duration_start, timeline.finish, &ukm::builders::NavigationTimeline:: SetTotalExcludingBeforeUnloadDuration); // Also record a separate metric for main-frame, cross-document cases for // better comparison with guardrail metrics. bool is_main_frame_cross_doc = is_primary_main_frame && !is_same_document_navigation; if (is_main_frame_cross_doc && (timeline.finish >= duration_start)) { base::UmaHistogramTimes( "Navigation.Timeline.TotalExcludingBeforeUnload.MainFrameOnly.Duration", timeline.finish - duration_start); } base::TimeDelta total_excluding_before_unload_dialog; if (!timeline.start.is_null() && !timeline.finish.is_null() && timeline.start < timeline.finish) { total_excluding_before_unload_dialog = (timeline.finish - timeline.start) - beforeunload_dialog_total_duration; } if (total_excluding_before_unload_dialog.is_positive()) { base::UmaHistogramTimes( "Navigation.Timeline.TotalExcludingBeforeUnloadDialog.Duration", total_excluding_before_unload_dialog); if (is_main_frame_cross_doc) { base::UmaHistogramTimes( "Navigation.Timeline.TotalExcludingBeforeUnloadDialog.MainFrameOnly." "Duration", total_excluding_before_unload_dialog); } } // Also record metrics of duration that starts from user interaction timing // when the user interaction timing is available. if (is_main_frame_cross_doc && !timeline.user_interaction.is_null() && !timeline.finish.is_null() && timeline.user_interaction <= timeline.start && timeline.start <= timeline.finish) { const base::TimeDelta interaction_to_actual_navigation_start = timeline.start - timeline.user_interaction; const base::TimeDelta including_before_unload_duration = timeline.finish - timeline.user_interaction; const base::TimeDelta excluding_before_unload_duration = including_before_unload_duration - beforeunload_total_duration; const base::TimeDelta excluding_before_unload_dialog_duration = including_before_unload_duration - beforeunload_dialog_total_duration; base::UmaHistogramTimes( "Navigation.Timeline.InteractionToActualNavigationStart." "MainFrameOnly.Duration", interaction_to_actual_navigation_start); base::UmaHistogramTimes( "Navigation.Timeline.InteractionToNavigationFinished." "MainFrameOnly.Duration", including_before_unload_duration); base::UmaHistogramTimes( "Navigation.Timeline.InteractionToNavigationFinished." "ExcludingBeforeUnload.MainFrameOnly.Duration", excluding_before_unload_duration); base::UmaHistogramTimes( "Navigation.Timeline.InteractionToNavigationFinished." "ExcludingBeforeUnloadDialog.MainFrameOnly.Duration", excluding_before_unload_dialog_duration); if (ukm_builder.has_value()) { ukm_builder->SetInteractionToActualNavigationStartDurationMs( interaction_to_actual_navigation_start.InMilliseconds()); ukm_builder->SetInteractionToNavigationFinishedDurationMs( including_before_unload_duration.InMilliseconds()); ukm_builder ->SetInteractionToNavigationFinishedExcludingBeforeUnloadDurationMs( excluding_before_unload_duration.InMilliseconds()); } } // Most navigation metrics currently ignore everything before the adjusted // common_params start time, which is after any beforeunload handling (either // phase 1 or phase 2). This is incorrect, because it excludes a significant // amount of work done before and between the two beforeunload phases. Record // how much of this time was ignored incorrectly to determine the impact of // changing the metrics. In the trace viewer, this time is shown nested within // (and at the start of) `TotalExcludingBeforeUnload`, to visually see how // much of the navigation duration such metrics are ignoring. // TODO(crbug.com/385170155): Move to a more accurate navigation start so that // we don't incorrectly ignore anything, and remove the metrics below. if (duration_start < timeline.common_params_start) { log_trace_event_and_uma( "IncorrectlyIgnored", track2, duration_start, timeline.common_params_start, &ukm::builders::NavigationTimeline::SetIgnoredIncorrectlyDuration, /*histogram_name=*/"IgnoredIncorrectly"); if (is_main_frame_cross_doc && (timeline.common_params_start >= duration_start)) { base::UmaHistogramTimes( "Navigation.Timeline.IgnoredIncorrectly.MainFrameOnly.Duration", timeline.common_params_start - duration_start); } // Also record what percentage was incorrectly ignored. We don't record UKMs // for that. base::TimeDelta ignored_incorrectly = timeline.common_params_start - duration_start; base::TimeDelta total_excluding_beforeunload = timeline.finish - duration_start; if (!ignored_incorrectly.is_negative() && total_excluding_beforeunload.is_positive()) { size_t ignored_percentage = 100 * ignored_incorrectly / total_excluding_beforeunload; base::UmaHistogramPercentage( "Navigation.Timeline.IgnoredIncorrectly.Percentage", ignored_percentage); if (is_main_frame_cross_doc) { base::UmaHistogramPercentage( "Navigation.Timeline.IgnoredIncorrectly.MainFrameOnly.Percentage", ignored_percentage); } } } if (ukm_builder.has_value()) { if (!timeline.renderer_process_created.is_null()) { int64_t ms = 0; if (timeline.renderer_process_created > timeline.start) { ms = (timeline.renderer_process_created - timeline.start) .InMilliseconds(); } ukm_builder->SetRendererProcessCreated(ms); } if (!timeline.renderer_process_launched.is_null()) { int64_t ms = 0; if (timeline.renderer_process_launched > timeline.start) { ms = (timeline.renderer_process_launched - timeline.start) .InMilliseconds(); } ukm_builder->SetRendererProcessLaunched(ms); } ukm_builder->Record(ukm::UkmRecorder::Get()); } } bool ShouldContributePriorityToProcess( RenderFrameHostImpl::LifecycleStateImpl state) { // The frame should not contribute to the process priority while the frame is // in BFCache or being deleted. switch (state) { case RenderFrameHostImpl::LifecycleStateImpl::kSpeculative: case RenderFrameHostImpl::LifecycleStateImpl::kPendingCommit: case RenderFrameHostImpl::LifecycleStateImpl::kPrerendering: case RenderFrameHostImpl::LifecycleStateImpl::kActive: case RenderFrameHostImpl::LifecycleStateImpl::kRunningUnloadHandlers: return true; case RenderFrameHostImpl::LifecycleStateImpl::kInBackForwardCache: case RenderFrameHostImpl::LifecycleStateImpl::kReadyToBeDeleted: return false; } } bool VerifyHeaderPermissionsPolicyAgainstBaseline( const network::ParsedPermissionsPolicy& header_policy, const std::vector& baseline_policy) { const auto features_in_manifest = base::MakeFlatSet( baseline_policy, std::less(), [](const auto& entry) { return entry->feature; }); const auto& permission_policy_to_feature_map = blink::GetPermissionsPolicyFeatureToNameMap(); for (const auto& feature_in_headers : header_policy) { const auto* name_mapping = base::FindOrNull( permission_policy_to_feature_map, feature_in_headers.feature); // Okay state: returned feature is valid (in the mapping) and is // mentioned in the manifest. if (name_mapping && features_in_manifest.contains(*name_mapping)) { continue; } // Bad state: renderer added new permission policies, which means that // it's most likely compromised. return false; } return true; } constexpr base::MemoryConsumerTraits kRenderFrameHostTraits( base::MemoryConsumerTraits::ConsumerType::kPassive, // Frames are in an out-of-process renderer. base::MemoryConsumerTraits::InProcess::kNo); } // namespace class RenderFrameHostImpl::SubresourceLoaderFactoriesConfig { public: static SubresourceLoaderFactoriesConfig ForLastCommittedNavigation( RenderFrameHostImpl& frame) { SubresourceLoaderFactoriesConfig result; result.origin_ = frame.GetLastCommittedOrigin(); result.isolation_info_ = frame.GetIsolationInfoForSubresources(); result.client_security_state_ = frame.BuildClientSecurityState(); if (frame.coep_reporter_) { frame.coep_reporter_->Clone( result.coep_reporter_.BindNewPipeAndPassReceiver()); } if (frame.dip_reporter_) { frame.dip_reporter_->Clone( result.dip_reporter_.BindNewPipeAndPassReceiver()); } result.trust_token_redemption_policy_ = DetermineAfterCommitWhetherToForbidTrustTokenOperation( frame, network::mojom::TrustTokenOperationType::kRedemption); result.trust_token_issuance_policy_ = DetermineAfterCommitWhetherToForbidTrustTokenOperation( frame, network::mojom::TrustTokenOperationType::kIssuance); // Our data collection policy disallows collecting UKMs while prerendering. // So, assign a valid ID only when the page is not in the prerendering // state. See //content/browser/preloading/prerender/README.md and ask the // team to explore options to record data for prerendering pages. result.ukm_source_id_ = ukm::SourceIdObj::FromInt64( frame.IsInLifecycleState(LifecycleState::kPrerendering) ? ukm::kInvalidSourceId : frame.GetPageUkmSourceId()); result.network_restrictions_id_ = frame.document_associated_data_->NetworkRestrictionsId(); result.cookie_setting_overrides_ = frame.document_associated_data_->cookie_setting_overrides(); // Determine if the frame's sandboxing policy contains the // `allow-same-site-none-cookies` value and a CookieSettingOverride should // be applied so SameSite=None cookies are included in requests from this // context. See // https://github.com/explainers-by-googlers/csp-sandbox-allow-same-site-none-cookies if (frame.HasPolicyContainerHost() && IsOriginSandboxedWithAllowSameSiteNoneCookiesValue( frame.active_sandbox_flags()) && frame.AncestorsAllowSameSiteNoneCookiesOverride(result.origin())) { result.cookie_setting_overrides_.Put( net::CookieSettingOverride::kAllowSameSiteNoneCookiesInSandbox); } return result; } static SubresourceLoaderFactoriesConfig ForPendingNavigation( NavigationRequest& navigation_request) { SubresourceLoaderFactoriesConfig result; result.origin_ = navigation_request.GetOriginToCommit().value(); result.client_security_state_ = navigation_request.BuildClientSecurityStateForCommittedDocument(); result.ukm_source_id_ = ukm::SourceIdObj::FromInt64( navigation_request.GetNextPageUkmSourceId()); result.network_restrictions_id_ = navigation_request.network_restrictions_id(); // TODO(lukasza): Consider pushing the ok-vs-error differentiation into // NavigationRequest methods (e.g. into |isolation_info_for_subresources| // and/or |coep_reporter| methods). if (navigation_request.DidEncounterError()) { // Error frames gets locked down `isolation_info_`, // `trust_token_redemption_policy_` and `trust_token_issuance_policy_` // plus an empty/uninitialized `coep_reporter_`. result.isolation_info_ = net::IsolationInfo::CreateTransient(/*nonce=*/std::nullopt); result.trust_token_redemption_policy_ = network::mojom::TrustTokenOperationPolicyVerdict::kForbid; result.trust_token_issuance_policy_ = network::mojom::TrustTokenOperationPolicyVerdict::kForbid; } else { result.isolation_info_ = navigation_request.isolation_info_for_subresources(); if (navigation_request.coep_reporter()) { navigation_request.coep_reporter()->Clone( result.coep_reporter_.BindNewPipeAndPassReceiver()); } if (navigation_request.dip_reporter()) { navigation_request.dip_reporter()->Clone( result.dip_reporter_.BindNewPipeAndPassReceiver()); } result.trust_token_redemption_policy_ = DetermineWhetherToForbidTrustTokenOperation( navigation_request.GetRenderFrameHost(), navigation_request.commit_params(), result.origin(), network::mojom::TrustTokenOperationType::kRedemption); result.trust_token_issuance_policy_ = DetermineWhetherToForbidTrustTokenOperation( navigation_request.GetRenderFrameHost(), navigation_request.commit_params(), result.origin(), network::mojom::TrustTokenOperationType::kIssuance); // Determine if the frame's sandboxing policy contains the // `allow-same-site-none-cookies` value and a CookieSettingOverride should // be applied so SameSite=None cookies are included in requests from this // context. See // https://github.com/explainers-by-googlers/csp-sandbox-allow-same-site-none-cookies if (!navigation_request.IsSameDocument() && IsOriginSandboxedWithAllowSameSiteNoneCookiesValue( navigation_request.SandboxFlagsToCommit()) && navigation_request.GetRenderFrameHost() ->AncestorsAllowSameSiteNoneCookiesOverride(result.origin())) { result.cookie_setting_overrides_.Put( net::CookieSettingOverride::kAllowSameSiteNoneCookiesInSandbox); } } return result; } // ForPendingOrLastCommittedNavigation is useful in scenarios where there is // no coordination between the timing of 1) a navigation commit and 2) // subresource loader factories bundle creation. For example, using // ForPendingOrLastCommittedNavigation from UpdateSubresourceLoaderFactories // leads to using the correct SubresourceLoaderFactoriesConfig regardless of // the timing of when a NetworkService crash triggers a call to // UpdateSubresourceLoaderFactories: // 1. If the crash happens when there is an in-flight Commit IPC to the // renderer process, then the newly created subresource loader factories // will arrive at the renderer *after* the Commit IPC and therefore the // factories need to use the configuration (e.g. the origin) based on the // pending navigation. // 2. OTOH, if the crash happens when there is no in-flight Commit IPC then // the newly created factories should use the configuration based on the // last committed navigation. // // TODO(crbug.com/40523839): ForPendingOrLastCommittedNavigation might // not be needed once we have RenderDocumentHost (e.g. we swap on every // cross-document navigation), because with RenderDocumentHost there is no // risk of sending last-committed-navigation-based subresource loaders to a // document different from the last-committed one. static SubresourceLoaderFactoriesConfig ForPendingOrLastCommittedNavigation( RenderFrameHostImpl& frame) { NavigationRequest* navigation_request = frame.FindLatestNavigationRequestThatIsStillCommitting(); return navigation_request ? ForPendingNavigation(*navigation_request) : ForLastCommittedNavigation(frame); } ~SubresourceLoaderFactoriesConfig() = default; SubresourceLoaderFactoriesConfig(SubresourceLoaderFactoriesConfig&&) = default; SubresourceLoaderFactoriesConfig& operator=( SubresourceLoaderFactoriesConfig&&) = default; SubresourceLoaderFactoriesConfig(const SubresourceLoaderFactoriesConfig&) = delete; SubresourceLoaderFactoriesConfig& operator=( const SubresourceLoaderFactoriesConfig&) = delete; const url::Origin& origin() const { return origin_; } const net::IsolationInfo& isolation_info() const { return isolation_info_; } network::mojom::ClientSecurityStatePtr GetClientSecurityState() const { return mojo::Clone(client_security_state_); } mojo::PendingRemote GetCoepReporter() const { mojo::PendingRemote p; if (coep_reporter_) { coep_reporter_->Clone(p.InitWithNewPipeAndPassReceiver()); } return p; } mojo::PendingRemote GetDipReporter() const { mojo::PendingRemote p; if (dip_reporter_) { dip_reporter_->Clone(p.InitWithNewPipeAndPassReceiver()); } return p; } const network::mojom::TrustTokenOperationPolicyVerdict& trust_token_redemption_policy() const { return trust_token_redemption_policy_; } const network::mojom::TrustTokenOperationPolicyVerdict& trust_token_issuance_policy() const { return trust_token_issuance_policy_; } const ukm::SourceIdObj& ukm_source_id() const { return ukm_source_id_; } const net::CookieSettingOverrides& cookie_setting_overrides() const { return cookie_setting_overrides_; } const base::UnguessableToken& network_restrictions_id() const { return network_restrictions_id_; } private: // Private constructor - please go through the static For... methods. SubresourceLoaderFactoriesConfig() = default; url::Origin origin_; net::IsolationInfo isolation_info_; network::mojom::ClientSecurityStatePtr client_security_state_; mojo::Remote coep_reporter_; mojo::Remote dip_reporter_; network::mojom::TrustTokenOperationPolicyVerdict trust_token_issuance_policy_; network::mojom::TrustTokenOperationPolicyVerdict trust_token_redemption_policy_; ukm::SourceIdObj ukm_source_id_; net::CookieSettingOverrides cookie_setting_overrides_; base::UnguessableToken network_restrictions_id_; }; class PendingNavigation { public: blink::mojom::CommonNavigationParamsPtr common_params_; blink::mojom::BeginNavigationParamsPtr begin_navigation_params_; scoped_refptr initiator_navigation_state_; scoped_refptr blob_url_loader_factory_; mojo::PendingAssociatedRemote navigation_client_; mojo::PendingReceiver renderer_cancellation_listener_; mojo::PendingReceiver< mojom::NavigationRendererIgnoreDuplicateNavigationListener> renderer_ignore_duplicate_navigation_listener_; mojo::PendingReceiver deferred_commit_resume_listener_; PendingNavigation( blink::mojom::CommonNavigationParamsPtr common_params, blink::mojom::BeginNavigationParamsPtr begin_navigation_params, scoped_refptr blob_url_loader_factory, mojo::PendingAssociatedRemote navigation_client, mojo::PendingReceiver renderer_cancellation_listener, mojo::PendingReceiver< mojom::NavigationRendererIgnoreDuplicateNavigationListener> renderer_ignore_duplicate_navigation_listener, mojo::PendingReceiver< blink::mojom::NavigationResumeDeferredCommitListener> deferred_commit_resume_listener, scoped_refptr initiator_navigation_state); }; PendingNavigation::PendingNavigation( blink::mojom::CommonNavigationParamsPtr common_params, blink::mojom::BeginNavigationParamsPtr begin_navigation_params, scoped_refptr blob_url_loader_factory, mojo::PendingAssociatedRemote navigation_client, mojo::PendingReceiver renderer_cancellation_listener, mojo::PendingReceiver< mojom::NavigationRendererIgnoreDuplicateNavigationListener> renderer_ignore_duplicate_navigation_listener, mojo::PendingReceiver deferred_commit_resume_listener, scoped_refptr initiator_navigation_state) : common_params_(std::move(common_params)), begin_navigation_params_(std::move(begin_navigation_params)), initiator_navigation_state_(initiator_navigation_state), blob_url_loader_factory_(std::move(blob_url_loader_factory)), navigation_client_(std::move(navigation_client)), renderer_cancellation_listener_( std::move(renderer_cancellation_listener)), renderer_ignore_duplicate_navigation_listener_( std::move(renderer_ignore_duplicate_navigation_listener)), deferred_commit_resume_listener_( std::move(deferred_commit_resume_listener)) {} // static RenderFrameHost* RenderFrameHost::FromID(const GlobalRenderFrameHostId& id) { return RenderFrameHostImpl::FromID(id); } // static RenderFrameHost* RenderFrameHost::FromID(int render_process_id, int render_frame_id) { return RenderFrameHostImpl::FromID(GlobalRenderFrameHostId( ChildProcessId::FromUnsafeValue(render_process_id), render_frame_id)); } // static RenderFrameHost* RenderFrameHost::FromID(ChildProcessId render_process_id, int render_frame_id) { return RenderFrameHostImpl::FromID( GlobalRenderFrameHostId(render_process_id, render_frame_id)); } // static RenderFrameHost* RenderFrameHost::FromFrameToken( const GlobalRenderFrameHostToken& frame_token) { return RenderFrameHostImpl::FromFrameToken(frame_token); } // static void RenderFrameHost::AllowInjectingJavaScript() { g_allow_injecting_javascript = true; } // static RenderFrameHostImpl* RenderFrameHostImpl::FromID(GlobalRenderFrameHostId id) { CHECK_CURRENTLY_ON(BrowserThread::UI); RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer(); auto it = frames->find(id); return it == frames->end() ? nullptr : it->second; } // static RenderFrameHostImpl* RenderFrameHostImpl::FromID(int render_process_id, int render_frame_id) { return RenderFrameHostImpl::FromID(GlobalRenderFrameHostId( ChildProcessId::FromUnsafeValue(render_process_id), render_frame_id)); } // static RenderFrameHostImpl* RenderFrameHostImpl::FromID( ChildProcessId render_process_id, int render_frame_id) { return RenderFrameHostImpl::FromID( GlobalRenderFrameHostId(render_process_id, render_frame_id)); } // static RenderFrameHostImpl* RenderFrameHostImpl::FromFrameToken( const GlobalRenderFrameHostToken& global_frame_token, mojo::ReportBadMessageCallback* process_mismatch_callback) { return RenderFrameHostImpl::FromFrameToken(global_frame_token.child_id, global_frame_token.frame_token, process_mismatch_callback); } // static RenderFrameHostImpl* RenderFrameHostImpl::FromFrameToken( int process_id, const blink::LocalFrameToken& frame_token, mojo::ReportBadMessageCallback* process_mismatch_callback) { return RenderFrameHostImpl::FromFrameToken( ChildProcessId::FromUnsafeValue(process_id), frame_token, process_mismatch_callback); } // static RenderFrameHostImpl* RenderFrameHostImpl::FromFrameToken( ChildProcessId process_id, const blink::LocalFrameToken& frame_token, mojo::ReportBadMessageCallback* process_mismatch_callback) { CHECK_CURRENTLY_ON(BrowserThread::UI); auto it = GetTokenFrameMap().find(frame_token); if (it == GetTokenFrameMap().end()) { return nullptr; } if (it->second->GetProcess()->GetID() != process_id) { if (process_mismatch_callback) { SYSLOG(WARNING) << "Denying illegal RenderFrameHost::FromFrameToken request."; std::move(*process_mismatch_callback) .Run( "Unknown LocalFrame made RenderFrameHost::FromFrameToken " "request."); } return nullptr; } return it->second; } // static RenderFrameHostImpl* RenderFrameHostImpl::FromDocumentToken( ChildProcessId process_id, const blink::DocumentToken& document_token, mojo::ReportBadMessageCallback* process_mismatch_callback) { CHECK_CURRENTLY_ON(BrowserThread::UI); auto* rfh = DocumentAssociatedData::GetDocumentFromToken({}, document_token); if (!rfh) { return nullptr; } if (rfh->GetProcess()->GetID() != process_id) { if (process_mismatch_callback) { SYSLOG(WARNING) << "Denying illegal RenderFrameHost::FromDocumentToken request."; std::move(*process_mismatch_callback) .Run("process ID does not match requested DocumentToken"); } return nullptr; } return rfh; } // static RenderFrameHostImpl* RenderFrameHostImpl::FromDocumentToken( int process_id, const blink::DocumentToken& document_token, mojo::ReportBadMessageCallback* process_mismatch_callback) { return RenderFrameHostImpl::FromDocumentToken( ChildProcessId::FromUnsafeValue(process_id), document_token, process_mismatch_callback); } // static RenderFrameHost* RenderFrameHost::FromAXTreeID(const ui::AXTreeID& ax_tree_id) { return RenderFrameHostImpl::FromAXTreeID(ax_tree_id); } // static RenderFrameHostImpl* RenderFrameHostImpl::FromAXTreeID( ui::AXTreeID ax_tree_id) { CHECK_CURRENTLY_ON(BrowserThread::UI); ui::AXActionHandlerRegistry::FrameID frame_id = ui::AXActionHandlerRegistry::GetInstance()->GetFrameID(ax_tree_id); return RenderFrameHostImpl::FromID(frame_id.first, frame_id.second); } // static RenderFrameHostImpl* RenderFrameHostImpl::FromOverlayRoutingToken( const base::UnguessableToken& token) { CHECK_CURRENTLY_ON(BrowserThread::UI); auto it = GetTokenFrameMap().find(blink::LocalFrameToken(token)); return it == GetTokenFrameMap().end() ? nullptr : it->second; } // static void RenderFrameHostImpl::ClearAllPrefetchedSignedExchangeCache() { CHECK_CURRENTLY_ON(BrowserThread::UI); RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer(); for (auto it : *frames) { it.second->ClearPrefetchedSignedExchangeCache(); } } // static void RenderFrameHostImpl::CancelAllNavigationsForBrowserContextShutdown( BrowserContext* browser_context) { CHECK_CURRENTLY_ON(BrowserThread::UI); CHECK(browser_context->ShutdownStarted()); RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer(); // Avoid iterating through the RenderFrameHosts in `frames` directly, since // cancelling a navigation may trigger destruction of a speculative // RenderFrameHost, which may end up invalidating the iterator here. Instead, // create a list of RenderFrameHost IDs to go through and ensure each // RenderFrameHost exists (and that its profile matches the one being // destroyed) before canceling its navigations. See // https://crbug.com/371709958. std::vector rfh_ids; rfh_ids.reserve(frames->size()); std::transform(frames->begin(), frames->end(), std::back_inserter(rfh_ids), [](auto entry) { return entry.first; }); for (auto it : rfh_ids) { auto* rfhi = RenderFrameHostImpl::FromID(it); if (rfhi && rfhi->GetBrowserContext() == browser_context) { rfhi->ResetOwnedNavigationRequests( NavigationDiscardReason::kWillRemoveFrame); rfhi->frame_tree_node()->CancelNavigation( NavigationDiscardReason::kWillRemoveFrame); } } } // TODO(crbug.com/40183788): Get/SetCodeCacheHostReceiverHandler are used only // for a test in content/browser/service_worker/service_worker_browsertest // that tests a bad message is returned on an incorrect origin. Try to find a // way to test this without adding these additional methods. RenderFrameHostImpl::CodeCacheHostReceiverHandler& GetCodeCacheHostReceiverHandler() { static base::NoDestructor instance; return *instance; } // static void RenderFrameHostImpl::SetCodeCacheHostReceiverHandlerForTesting( CodeCacheHostReceiverHandler handler) { GetCodeCacheHostReceiverHandler() = handler; } // static const char* RenderFrameHostImpl::LifecycleStateImplToString( RenderFrameHostImpl::LifecycleStateImpl state) { using LifecycleStateImpl = RenderFrameHostImpl::LifecycleStateImpl; switch (state) { case LifecycleStateImpl::kSpeculative: return "Speculative"; case LifecycleStateImpl::kPrerendering: return "Prerendering"; case LifecycleStateImpl::kPendingCommit: return "PendingCommit"; case LifecycleStateImpl::kActive: return "Active"; case LifecycleStateImpl::kInBackForwardCache: return "InBackForwardCache"; case LifecycleStateImpl::kRunningUnloadHandlers: return "RunningUnloadHandlers"; case LifecycleStateImpl::kReadyToBeDeleted: return "ReadyToBeDeleted"; } } // static scoped_refptr RenderFrameHostImpl::GetInitiatorNavigationStateFromFrameToken( const blink::LocalFrameToken* frame_token, int initiator_process_id, BrowserContext* browser_context) { // TODO(crbug.com/510258191): The initiator state should always be retrieved // from a NavigationStateKeepAlive recorded at the moment the navigation was // initiated. Update this function once we store NavigationStateKeepAlives // properly. // There is no null check for `storage_partition` as tests can pass in a null // StoragePartition in the case the initiator RenderFrameHost still exists. if (!frame_token) { return nullptr; } // Capture the initiator navigation state from the RenderFrameHost directly if // it is still alive. RenderFrameHostImpl* initiator_rfh = RenderFrameHostImpl::FromFrameToken(initiator_process_id, *frame_token); if (initiator_rfh) { return initiator_rfh->CreateInitiatorStateFromCurrentFrame(); } // Otherwise get it from the NavigationStateKeepAlive stored in // `browser_context`. NavigationStateKeepAlive* navigation_state = BrowserContextImpl::From(browser_context) ->GetNavigationStateKeepAlive(*frame_token); if (navigation_state) { return navigation_state->initiator_navigation_state(); } // There is no navigation state record for the given `frame_token`. return nullptr; } RenderFrameHostImpl::RenderFrameHostImpl( SiteInstance* site_instance, scoped_refptr render_view_host, RenderFrameHostDelegate* delegate, FrameTree* frame_tree, FrameTreeNode* frame_tree_node, int32_t routing_id, mojo::PendingAssociatedRemote frame_remote, const blink::LocalFrameToken& frame_token, const blink::DocumentToken& document_token, base::UnguessableToken devtools_frame_token, bool renderer_initiated_creation_of_main_frame, LifecycleStateImpl lifecycle_state, scoped_refptr browsing_context_state, blink::FrameOwnerElementType frame_owner_element_type, RenderFrameHostImpl* parent, FencedFrameStatus fenced_frame_status) : render_view_host_(std::move(render_view_host)), delegate_(delegate), site_instance_(static_cast(site_instance)), agent_scheduling_group_( site_instance_->GetOrCreateAgentSchedulingGroup().GetSafeRef()), frame_tree_(frame_tree), frame_tree_node_(frame_tree_node), owner_(frame_tree_node), browsing_context_state_(std::move(browsing_context_state)), frame_owner_element_type_(frame_owner_element_type), parent_(parent), depth_(parent_ ? parent_->GetFrameDepth() + 1 : 0), last_committed_url_derived_site_info_( site_instance_->GetBrowserContext()), routing_id_(routing_id), beforeunload_timeout_delay_(kUnloadTimeout), frame_(std::move(frame_remote)), waiting_for_init_(renderer_initiated_creation_of_main_frame), frame_token_(frame_token), keep_alive_handle_factory_( agent_scheduling_group_->GetProcess(), RenderProcessHostImpl::kKeepAliveHandleFactoryTimeout), subframe_unload_timeout_(kUnloadTimeout), media_device_id_salt_base_(CreateRandomMediaDeviceIDSalt()), document_associated_data_(std::in_place, *this, document_token), lifecycle_state_(lifecycle_state), cookie_observers_( base::BindRepeating(&RenderFrameHostImpl::NotifyCookiesAccessed, base::Unretained(this))), // TODO(crbug.com/510258191): Plumb an initiator state token from the // renderer process when the RenderFrameHost is for an initial empty // document first created in the renderer process. current_initiator_state_token_(base::UnguessableToken::Create()), code_cache_host_receivers_( GetProcess()->GetStoragePartition()->GetGeneratedCodeCacheContext()), fenced_frame_status_(fenced_frame_status), devtools_frame_token_(devtools_frame_token), tracing_track_(GetLocalFrameTracingTrack( frame_token_, is_main_frame(), agent_scheduling_group_->GetProcess()->GetID())), memory_consumer_registration_( /*consumer_name=*/"RenderFrameHostImpl", kRenderFrameHostTraits, this, base::MemoryConsumerRegistration::CheckUnregister::kDisabled) { TRACE_EVENT("navigation", "RenderFrameHostImpl::RenderFrameHostImpl", perfetto::Flow::FromPointer(this)); base::trace_event::TraceSessionObserverList::AddObserver(this); base::ScopedUmaHistogramTimer histogram_timer( "Navigation.RenderFrameHostConstructor"); // Update lifecycle state on track of RenderFrameHostImpl. TRACE_STATE( "content.frames.lifecycle", perfetto::StaticString{LifecycleStateImplToString(lifecycle_state_)}, *tracing_track_); CHECK_NE(routing_id_, IPC::mojom::kRoutingIdNone); CHECK(delegate_); CHECK(lifecycle_state_ == LifecycleStateImpl::kSpeculative || lifecycle_state_ == LifecycleStateImpl::kPrerendering || lifecycle_state_ == LifecycleStateImpl::kActive); // Only main frames have `waiting_for_init_` set. CHECK(!waiting_for_init_ || !parent_); GetAgentSchedulingGroup().AddRoute(routing_id_, this); g_routing_id_frame_map.Get().emplace( GlobalRenderFrameHostId(GetProcess()->GetDeprecatedID(), routing_id_), this); GetTokenFrameMap().insert(std::make_pair(frame_token_, this)); site_instance_->group()->AddObserver(this); auto* process = GetProcess(); process->RegisterRenderFrameHost(GetGlobalId(), IsOutermostMainFrame()); if (prerender_state_callback_) { prerender_state_callback_.Run(GetGlobalId(), frame_tree_->is_prerendering()); } GetSiteInstance()->group()->IncrementActiveFrameCount(); if (parent_) { // All frames in a frame tree should use the same storage partition. CHECK_EQ(parent_->GetStoragePartition(), GetStoragePartition()); // New child frames should inherit the nav_entry_id of their parent. set_nav_entry_id(parent_->nav_entry_id()); } if (!base::FeatureList::IsEnabled(features::kLazyBrowserInterfaceBroker)) { CreateBrokerHolder(); } if (lifecycle_state_ != LifecycleStateImpl::kSpeculative) { // Creating a RFH in kActive state implies that it is the RFH for a // newly-created FTN, which should still be on its initial empty document. CHECK(frame_tree_node_->is_on_initial_empty_document()); } InitializePolicyContainerHost(renderer_initiated_creation_of_main_frame); InitializeLocalNetworkAccessRequestPolicy(); auto task_runner = GetUIThreadTaskRunner({BrowserTaskType::kUserInput}); // TODO(crbug.com/41483375): Stop using BrowserTaskType::kUserInput task // runner for non-input related tasks. unload_event_monitor_timeout_ = std::make_unique( base::BindRepeating(&RenderFrameHostImpl::OnNavigationUnloadTimeout, weak_ptr_factory_.GetWeakPtr()), task_runner); beforeunload_timeout_ = std::make_unique( base::BindRepeating(&RenderFrameHostImpl::BeforeUnloadTimeout, weak_ptr_factory_.GetWeakPtr()), task_runner); // Local roots are: // - main frames; or // - subframes that use a proxy to talk to their parent. // // Local roots require a RenderWidget for input/layout/painting. // Note: We cannot use is_local_root() here because this block sets up the // fields that are used by that method. const bool setup_local_render_widget_host = is_main_frame() || RequiresProxyToParent(); if (setup_local_render_widget_host) { if (is_main_frame()) { // For main frames, the RenderWidgetHost is owned by the RenderViewHost. // TODO(crbug.com/40441137): Once RenderViewHostImpl has-a // RenderWidgetHostImpl, the main render frame should probably start // owning the RenderWidgetHostImpl itself. CHECK(GetLocalRenderWidgetHost()); } else { // For local child roots, the RenderFrameHost directly creates and owns // its RenderWidgetHost. int32_t widget_routing_id = site_instance->GetProcess()->GetNextRoutingID(); CHECK_EQ(nullptr, GetLocalRenderWidgetHost()); auto frame_sink_id = RenderWidgetHostImpl::DefaultFrameSinkId( *site_instance_->group(), widget_routing_id); owned_render_widget_host_ = RenderWidgetHostFactory::Create( frame_tree_, frame_tree_->render_widget_delegate(), frame_sink_id, site_instance_->group()->GetSafeRef(), widget_routing_id, /*hidden=*/true, /*renderer_initiated_creation=*/false); owned_render_widget_host_->SetViewIsFrameSinkIdOwner(true); } if (is_main_frame()) { GetLocalRenderWidgetHost()->SetIntersectsViewport(true); } GetLocalRenderWidgetHost()->SetFrameDepth(depth_); GetLocalRenderWidgetHost()->SetShouldContributePriorityToProcess( ShouldContributePriorityToProcess(lifecycle_state_)); } // Verify is_local_root() now indicates whether this frame is a local root or // not. It is safe to use this method anywhere beyond this point. CHECK_EQ(setup_local_render_widget_host, is_local_root()); ResetPermissionsPolicy({}); // New RenderFrameHostImpl are put in their own virtual browsing context // group. Then, they can inherit from: // 1) Their opener in RenderFrameHostImpl::CreateNewWindow(). // 2) Their navigation in RenderFrameHostImpl::DidCommitNavigationInternal(). virtual_browsing_context_group_ = CrossOriginOpenerPolicyAccessReportManager:: NextVirtualBrowsingContextGroup(); soap_by_default_virtual_browsing_context_group_ = CrossOriginOpenerPolicyAccessReportManager:: NextVirtualBrowsingContextGroup(); // IdleManager should be unique per RenderFrame to provide proper isolation // of overrides. idle_manager_ = std::make_unique(this); #if BUILDFLAG(IS_ANDROID) // The renderer process priority has been set in the RenderWidgetHost so // it is safe to remove to spare renderer priority here. site_instance->GetProcess()->GraduateSpareToNormalRendererPriority(); #endif SiteInstanceGroupId sig_id = site_instance_->group()->GetId(); bool rfh_in_bfcache = GetBackForwardCache() .IsRenderFrameHostWithSIGInBackForwardCacheForDebugging(sig_id); bool rfph_in_bfcache = GetBackForwardCache() .IsRenderFrameProxyHostWithSIGInBackForwardCacheForDebugging(sig_id); bool rvh_in_bfcache = GetBackForwardCache() .IsRenderViewHostWithMapIdInBackForwardCacheForDebugging( *render_view_host_); bool related_site_instance_in_bfcache = GetBackForwardCache().IsRelatedSiteInstanceInBackForwardCacheForDebugging( *site_instance_); if (rfh_in_bfcache || rfph_in_bfcache || rvh_in_bfcache || related_site_instance_in_bfcache) { SCOPED_CRASH_KEY_BOOL("rvh-double", "rfh_in_bfcache", rfh_in_bfcache); SCOPED_CRASH_KEY_BOOL("rvh-double", "rfph_in_bfcache", rfph_in_bfcache); SCOPED_CRASH_KEY_BOOL("rvh-double", "rvh_in_bfcache", rvh_in_bfcache); SCOPED_CRASH_KEY_NUMBER("rvh-double", "si_id", site_instance_->GetId().value()); SCOPED_CRASH_KEY_NUMBER("rvh-double", "bi_id", site_instance_->GetBrowsingInstanceId().value()); SCOPED_CRASH_KEY_BOOL("rvh-double", "related_si_in_bfcache", related_site_instance_in_bfcache); SCOPED_CRASH_KEY_NUMBER("rvh-double", "related_active_contents", GetSiteInstance()->GetRelatedActiveContentsCount()); base::debug::DumpWithoutCrashing(); } } RenderFrameHostImpl::~RenderFrameHostImpl() { base::trace_event::TraceSessionObserverList::RemoveObserver(this); TRACE_EVENT("navigation", "RenderFrameHostImpl::~RenderFrameHostImpl", perfetto::TerminatingFlow::FromPointer(this)); SCOPED_CRASH_KEY_STRING256("Bug1407526", "lifecycle", LifecycleStateImplToString(lifecycle_state())); TRACE_EVENT("navigation", "~RenderFrameHostImpl()", ChromeTrackEvent::kRenderFrameHost, this); base::ScopedUmaHistogramTimer histogram_timer( "Navigation.RenderFrameHostDestructor"); if (policy_container_host_) { policy_container_host_->SetClient(nullptr); } MaybeResetBoostRenderProcessForLoading(); if (is_main_frame() && base::FeatureList::IsEnabled(features::kWebContentsDiscard)) { // The main frame RenderWidgetHost sets is_discarding of RenderWidgetHost to // true at DiscardFrame(). However, the is_discarding state is not reset if // the renderer process terminates before sending a response to // LocalFrame::Discard() mojo request. Since the main frame RenderWidgetHost // can be reused for future navigations, we need to ensure that the // is_discarding state is reset here. // // Discarded main frame RenderFrameHost remains in FrameTree after // discarding and will be removed when a navigation happens (e.g. user // relands on the page again). However leaving is_discarding state as true // in RenderWidgetHost is fine because the renderer process is terminated // anyway in that case. // // If this RenderFrameHost is not discarded, setting is_discarding from // false to false is a no-op in RenderWidgetHostImpl::SetIsDiscarding(). GetRenderWidgetHost()->SetIsDiscarding(false); } // See https://crbug.com/1276535 if (check_deletion_for_bug_1276535_) { base::debug::DumpWithoutCrashing(); } // The lifetime of this object has ended, so remove it from the id map before // calling any delegates/observers, so that any calls to |FromID| no longer // return |this|. g_routing_id_frame_map.Get().erase( GlobalRenderFrameHostId(GetProcess()->GetDeprecatedID(), routing_id_)); // Remove this object from the isolatable sandboxed iframe set as well, if // necessary. g_routing_id_isolatable_sandboxed_iframes_set.Get().erase(GetGlobalId()); // When a RenderFrameHostImpl is deleted, it may still contain children. This // can happen with the unload timer. It causes a RenderFrameHost to delete // itself even if it is still waiting for its children to complete their // unload handlers. // // Observers expect children to be deleted first. Do it now before notifying // them. ResetChildren(); // Destroying NavigationRequests may call into delegates/observers, // so we do it early while |this| object is still in a sane state. ResetOwnedNavigationRequests( NavigationDiscardReason::kRenderFrameHostDestruction); // Cancel the navigations (including the ones that are not owned by this // RenderFrameHost) that intends to commit in this RenderFrameHost, as they // can no longer do so. { CHECK(frame_tree_node_); NavigationRequest* navigation_request = frame_tree_node_->navigation_request(); if (navigation_request) { if (navigation_request ->GetRenderFrameHostRestoredFromBackForwardCache() == this) { CHECK(navigation_request->IsServedFromBackForwardCache()); frame_tree_node_->RestartBackForwardCachedNavigationAsync( navigation_request->nav_entry_id()); } else if (navigation_request->HasRenderFrameHost() && navigation_request->GetRenderFrameHost() == this) { // If the navigation has picked its final RenderFrameHost and that RFH // gets destructed, the NavigationRequest can no longer commit in that // RFH. Note that there's a similar reset in // `RenderFrameHostManager::DiscardSpeculativeRFH()`, which will // trigger earlier, so we'll not get here when the RFH deleted is a // speculative / pending commit RFH. CHECK_NE(lifecycle_state(), LifecycleStateImpl::kSpeculative); CHECK_NE(lifecycle_state(), LifecycleStateImpl::kPendingCommit); frame_tree_node_->ResetNavigationRequestButKeepState( NavigationDiscardReason::kRenderFrameHostDestruction); } } } // Release the WebUI instances before all else as the WebUI may accesses the // RenderFrameHost during cleanup. base::WeakPtr self = GetWeakPtr(); ClearWebUI(); // `ClearWebUI()` may indirectly call content's embedders and delete this. // There are no known occurrences of it, so we assume this never happen and // crash immediately if it does, because there are no easy ways to recover. CHECK(self); SetLastCommittedSiteInfo(UrlInfo()); if (lifecycle_state_ == LifecycleStateImpl::kActive) { // It's possible to destruct an active RFH when e.g. closing a tab. We // should update the NIK count to not include this RFH anymore. // TODO(crbug.com/40693086): Remove this when it's no longer possible to // destruct an active RFH (i.e. we've changed the state to non-active for // all cases). GetStoragePartition()->DecrementActiveDocumentCount( GetNetworkIsolationKey()); } if (auto* lock_manager = GetStoragePartition()->GetLockManager()) { lock_manager->RemoveLockObserver(GetFrameToken().value()); } GetTokenFrameMap().erase(frame_token_); // Ensure that the render process host has been notified that all media // streams from this frame have terminated. This is required to ensure the // process host has the correct media stream count, which affects its // background priority. CleanUpMediaStreams(); auto* process = GetProcess(); SCOPED_CRASH_KEY_BOOL("Bug1407526", "si_exists", !!site_instance_); SCOPED_CRASH_KEY_BOOL("Bug1407526", "sig_exists", !!site_instance_->group()); SCOPED_CRASH_KEY_BOOL("Bug1407526", "process_exists", !!process); site_instance_->group()->RemoveObserver(this); process->UnregisterRenderFrameHost(GetGlobalId(), IsOutermostMainFrame()); const bool was_created = is_render_frame_created(); SCOPED_CRASH_KEY_BOOL("Bug1407526", "was_created", !!was_created); SCOPED_CRASH_KEY_BOOL("Bug1407526", "delegate_exists", !!delegate_); render_frame_state_ = RenderFrameState::kDeleted; if (was_created) { delegate_->RenderFrameDeleted(this); } // Resetting `document_associated_data_` destroys live `DocumentService` and // `DocumentUserData` instances. It is important for them to be // destroyed before the body of the `RenderFrameHostImpl` destructor // completes. Among other things, this ensures that any `SafeRef`s from // `DocumentService` and `RenderFrameHostUserData` subclasses are still valid // when their destructors run. document_associated_data_.reset(); // If this was the last active frame in the SiteInstanceGroup, the // DecrementActiveFrameCount call will trigger the deletion of the // SiteInstanceGroup's proxies. GetSiteInstance()->group()->DecrementActiveFrameCount(); // Once a RenderFrame is created in the renderer, there are three possible // clean-up paths: // 1. The RenderFrame can be the main frame. In this case, closing the // associated `blink::WebView` will clean up the resources associated with // the main RenderFrame. // 2. The RenderFrame can be unloaded. In this case, the browser sends a // mojom::Frame::Unload message for the RenderFrame to replace itself with // a `blink::RemoteFrame`and release its associated resources. // |lifecycle_state_| is advanced to // LifecycleStateImpl::kRunningUnloadHandlers to track that this IPC is in // flight. // 3. The RenderFrame can be detached, as part of removing a subtree (due to // navigation, unload, or DOM mutation). In this case, the browser sends // a mojom::Frame::Delete message for the RenderFrame to detach itself and // release its associated resources. If the subframe contains an unload // handler, |lifecycle_state_| is advanced to // LifecycleStateImpl::kRunningUnloadHandlers to track that the detach is // in progress; otherwise, it is advanced directly to // LifecycleStateImpl::kReadyToBeDeleted. // // For BackForwardCache or Prerender case: // // Deleting the BackForwardCache::Entry deletes immediately all the // Render{View,Frame,FrameProxy}Host. This will destroy the main RenderFrame // eventually as part of path #1 above: // // - The RenderFrameHost/RenderFrameProxyHost of the main frame are owned by // the BackForwardCache::Entry. // - RenderFrameHost/RenderFrameProxyHost for sub-frames are owned by their // parent RenderFrameHost. // - The RenderViewHost(s) are refcounted by the // RenderFrameHost/RenderFrameProxyHost of the page. They are guaranteed not // to be referenced by any other pages. // // The browser side gives the renderer a small timeout to finish processing // unload / detach messages. When the timeout expires, the RFH will be // removed regardless of whether or not the renderer acknowledged that it // completed the work, to avoid indefinitely leaking browser-side state. To // avoid leaks, ~RenderFrameHostImpl still validates that the appropriate // cleanup IPC was sent to the renderer, by checking IsPendingDeletion(). // // TODO(dcheng): Due to how frame detach is signalled today, there are some // bugs in this area. In particular, subtree detach is reported from the // bottom up, so the replicated mojom::Frame::Delete messages actually operate // on a node-by-node basis rather than detaching an entire subtree at once... // // Note that this logic is fairly subtle. It needs to include all subframes // and all speculative frames, but it should exclude case #1 (a main // RenderFrame owned by the `blink::WebView`). It can't simply check // |frame_tree_node_->render_manager()->speculative_frame_host()| for // equality against |this|. The speculative frame host is unset before the // speculative frame host is destroyed, so this condition would never be // matched for a speculative RFH that needs to be destroyed. // // Note that `RenderViewHostImpl::GetMainRenderFrameHost()` can never return // a speculative RFH. So, a speculative main frame being deleted will always // pass this condition as well. if (was_created && render_view_host_->GetMainRenderFrameHost() != this) { CHECK_NE(lifecycle_state(), LifecycleStateImpl::kActive); } GetAgentSchedulingGroup().RemoveRoute(routing_id_); // Null out the unload timer; in crash dumps this member will be null only if // the dtor has run. (It may also be null in tests.) unload_event_monitor_timeout_.reset(); // Delete this before destroying the widget, to guard against reentrancy // by in-process screen readers such as JAWS. if (browser_accessibility_manager_) { browser_accessibility_manager_->DetachFromParentManager(); browser_accessibility_manager_.reset(); } // Note: The RenderWidgetHost of the main frame is owned by the RenderViewHost // instead. In this case the RenderViewHost is responsible for shutting down // its RenderViewHost. if (owned_render_widget_host_) { owned_render_widget_host_->ShutdownAndDestroyWidget(false); } render_view_host_.reset(); // Attempt to cleanup the render process if only discarded frames remain. CleanupRenderProcessForDiscardIfPossible(); // If another frame is waiting for a beforeunload completion callback from // this frame, simulate it now. RenderFrameHostImpl* beforeunload_initiator = GetBeforeUnloadInitiator(); if (beforeunload_initiator && beforeunload_initiator != this) { base::TimeTicks approx_renderer_start_time = send_before_unload_start_time_; beforeunload_initiator->ProcessBeforeUnloadCompletedFromFrame( /*proceed=*/true, /*treat_as_final_completion_callback=*/false, this, /*is_frame_being_destroyed=*/true, approx_renderer_start_time, base::TimeTicks::Now(), BeforeUnloadExecutionMode::kSync); } // If `NavigationRequest` is waiting for asynchronous beforeunload completion // callback from this frame, try to proceed the all navigations that are // unblocked by this frame. for (RenderFrameHostImpl* rfh = this; rfh; rfh = rfh->GetParent()) { if (NavigationRequest* navigation_request = rfh->frame_tree_node()->navigation_request()) { // Defer the resume to a fresh call stack to avoid Use-After-Frees and // teardown re-entrancy. base::SingleThreadTaskRunner::GetCurrentDefault()->PostTask( FROM_HERE, base::BindOnce(&NavigationRequest::MaybeResumeAsyncBeforeUnloadCommit, navigation_request->GetWeakPtr(), GetGlobalId())); } } if (prefetched_signed_exchange_cache_) { prefetched_signed_exchange_cache_->RecordHistograms(); } // |geolocation_service_| needs to be destroyed before RenderFrameHostImpl, // otherwise it might cause dangling pointer. geolocation_service_.reset(); // Deleting the children would have deleted any guests. CHECK(guest_pages_.empty()); // Matches the slice with the lifecycle state name. TRACE_STATE("content.frames.lifecycle", nullptr, *tracing_track_); } const blink::StorageKey& RenderFrameHostImpl::GetStorageKey() const { return storage_key_; } int RenderFrameHostImpl::GetRoutingID() const { return routing_id_; } int64_t RenderFrameHostImpl::GetNavigationId() const { return navigation_id_; } const blink::LocalFrameToken& RenderFrameHostImpl::GetFrameToken() const { return frame_token_; } const perfetto::Track& RenderFrameHostImpl::GetTracingTrack() const { return *tracing_track_; } const base::UnguessableToken& RenderFrameHostImpl::GetReportingSource() { CHECK(!document_associated_data_->reporting_source().is_empty()); return document_associated_data_->reporting_source(); } ui::AXTreeID RenderFrameHostImpl::GetAXTreeID() { return ax_tree_id(); } const blink::LocalFrameToken& RenderFrameHostImpl::GetTopFrameToken() { RenderFrameHostImpl* frame = this; while (frame->parent_) { frame = frame->parent_; } return frame->GetFrameToken(); } void RenderFrameHostImpl::AudioContextPlaybackStarted(int audio_context_id) { delegate_->AudioContextPlaybackStarted(this, audio_context_id); } void RenderFrameHostImpl::AudioContextPlaybackStopped(int audio_context_id) { delegate_->AudioContextPlaybackStopped(this, audio_context_id); } // The current frame went into the BackForwardCache. void RenderFrameHostImpl::DidEnterBackForwardCache() { TRACE_EVENT0("navigation", "RenderFrameHostImpl::EnterBackForwardCache"); CHECK(IsBackForwardCacheEnabled()); CHECK(IsInPrimaryMainFrame()); // Notifies the View that the page is stored in the `BackForwardCache`. // // We shouldn't BFCache a renderer without a View. CHECK(GetView()); auto* main_view = static_cast(GetView()); main_view->DidEnterBackForwardCache(); // If a widget in this page tree was the TextInputManager's active view, drop // it so the IME / text-input observers see the input target go away while // the page is frozen. DOM focus on the renderer side is preserved so the // state can be re-established on restore. if (auto* tim = main_view->GetTextInputManager()) { RenderWidgetHostImpl* active_widget = tim->GetActiveWidget(); auto* active_view = active_widget ? static_cast(active_widget->GetView()) : nullptr; if (active_view) { bool active_view_in_page = active_view == main_view; if (!active_view_in_page) { auto nodes = FrameTree::SubtreeAndInnerTreeNodes( this, /*include_delegate_nodes_for_inner_frame_trees=*/true); active_view_in_page = std::find_if(nodes.begin(), nodes.end(), [&](FrameTreeNode* node) { RenderFrameHostImpl* subframe = node->current_frame_host(); return subframe && subframe->GetView() == active_view; }) != nodes.end(); } if (active_view_in_page) { tim->DidEnterBackForwardCache(active_view); } } } // Cancel loading memory tracker if it hasn't already recorded loading // memory stats, as we would now be including stats from the navigation // navigating away from the page. GetPage().CancelLoadingMemoryTracker(); CHECK(GetRenderWidgetHost()); CHECK(GetRenderWidgetHost()->view_is_frame_sink_id_owner()); DidEnterBackForwardCacheInternal(); // Pages in the back-forward cache are automatically evicted after a certain // time. StartBackForwardCacheEvictionTimer(); for (FrameTreeNode* node : FrameTree::SubtreeAndInnerTreeNodes( this, /*include_delegate_nodes_for_inner_frame_trees=*/true)) { RenderFrameHostImpl* subframe = node->current_frame_host(); // The subframe can be pending deletion if the unload handlers or the // cleanup didn't complete by the time the main frame enters the BFCache. If // the rfh is not deleted by the time the main frame is getting restored // it will be skipped from transitioning back to active. if (subframe && !subframe->IsPendingDeletion()) { subframe->DidEnterBackForwardCacheInternal(); } } } void RenderFrameHostImpl::DidEnterBackForwardCacheInternal() { CHECK_EQ(lifecycle_state(), LifecycleStateImpl::kActive); SetLifecycleState(LifecycleStateImpl::kInBackForwardCache); // If we are a delegate node we don't need to do anything else. if (inner_tree_main_frame_tree_node_id_) { return; } for (auto& entry : service_worker_clients_) { if (base::WeakPtr service_worker_client = entry.second) { service_worker_client->OnEnterBackForwardCache(); } } DedicatedWorkerHostsForDocument::GetOrCreateForCurrentDocument(this) ->OnEnterBackForwardCache(); #if BUILDFLAG(IS_P2P_ENABLED) GetProcess()->PauseSocketManagerForRenderFrameHost(GetGlobalId()); #endif // BUILDFLAG(IS_P2P_ENABLED) if (auto* permission_service_context = PermissionServiceContext::GetForCurrentDocument(this)) { permission_service_context->StoreResultAtBFCacheEntry(); } } // The frame being restored from the BackForwardCache. void RenderFrameHostImpl::WillLeaveBackForwardCache() { TRACE_EVENT0("navigation", "RenderFrameHostImpl::LeaveBackForwardCache"); CHECK(IsBackForwardCacheEnabled()); CHECK(IsOutermostMainFrame()); if (back_forward_cache_eviction_timer_.IsRunning()) { back_forward_cache_eviction_timer_.Stop(); } WillLeaveBackForwardCacheInternal(); for (FrameTreeNode* node : FrameTree::SubtreeAndInnerTreeNodes( this, /*include_delegate_nodes_for_inner_frame_trees=*/true)) { RenderFrameHostImpl* subframe = node->current_frame_host(); if (subframe && !subframe->IsPendingDeletion()) { subframe->WillLeaveBackForwardCacheInternal(); } } } void RenderFrameHostImpl::WillLeaveBackForwardCacheInternal() { CHECK_EQ(lifecycle_state(), LifecycleStateImpl::kInBackForwardCache); CHECK(!back_forward_cache_eviction_timer_.IsRunning()); // If we are a delegate node we don't need to do anything else. if (inner_tree_main_frame_tree_node_id_) { return; } for (auto& entry : service_worker_clients_) { if (base::WeakPtr service_worker_client = entry.second) { service_worker_client->OnRestoreFromBackForwardCache(); } } DedicatedWorkerHostsForDocument::GetOrCreateForCurrentDocument(this) ->OnRestoreFromBackForwardCache(); #if BUILDFLAG(IS_P2P_ENABLED) GetProcess()->ResumeSocketManagerForRenderFrameHost(GetGlobalId()); #endif // BUILDFLAG(IS_P2P_ENABLED) } void RenderFrameHostImpl::StartBackForwardCacheEvictionTimer() { CHECK(IsInBackForwardCache()); base::TimeDelta evict_after = GetBackForwardCache().GetTimeToLiveInBackForwardCache( LoadedWithCacheControlNoStoreHeader() ? BackForwardCacheImpl::kInCCNSContext : BackForwardCacheImpl::kNotInCCNSContext); back_forward_cache_eviction_timer_.SetTaskRunner( GetBackForwardCache().GetTaskRunner()); back_forward_cache_eviction_timer_.Start( FROM_HERE, evict_after, base::BindOnce(&RenderFrameHostImpl::EvictFromBackForwardCacheWithReason, weak_ptr_factory_.GetWeakPtr(), BackForwardCacheMetrics::NotRestoredReason::kTimeout)); } void RenderFrameHostImpl::DisableBackForwardCache( BackForwardCache::DisabledReason reason, std::optional source_id) { back_forward_cache_disabled_reasons_[reason].insert(source_id); MaybeEvictFromBackForwardCache(); } void RenderFrameHostImpl::DisableProactiveBrowsingInstanceSwapForTesting() { // This should only be called on primary main frames. CHECK(IsInPrimaryMainFrame()); has_test_disabled_proactive_browsing_instance_swap_ = true; } NavigationController& RenderFrameHostImpl::GetController() { // Note: owner_ is null for bfcached and pending deletion cases. CHECK(!IsPendingDeletion()); CHECK(!IsInBackForwardCache()); return owner_->GetCurrentNavigator().controller(); } SiteInstanceImpl* RenderFrameHostImpl::GetSiteInstance() const { return site_instance_.get(); } RenderProcessHost* RenderFrameHostImpl::GetProcess() const { return agent_scheduling_group_->GetProcess(); } AgentSchedulingGroupHost& RenderFrameHostImpl::GetAgentSchedulingGroup() { return *agent_scheduling_group_; } RenderFrameHostImpl* RenderFrameHostImpl::GetParent() const { return parent_; } PageImpl& RenderFrameHostImpl::GetPage() { return *GetMainFrame()->document_associated_data_->owned_page(); } const PageImpl& RenderFrameHostImpl::GetPage() const { return *GetMainFrame()->document_associated_data_->owned_page(); } bool RenderFrameHostImpl::IsDescendantOfWithinFrameTree( RenderFrameHostImpl* ancestor) { if (!ancestor || !ancestor->child_count()) { return false; } for (RenderFrameHostImpl* current = GetParent(); current; current = current->GetParent()) { if (current == ancestor) { return true; } } return false; } bool RenderFrameHostImpl::IsFencedFrameRoot() const { return fenced_frame_status_ == FencedFrameStatus::kFencedFrameRoot; } bool RenderFrameHostImpl::IsNestedWithinFencedFrame() const { switch (fenced_frame_status_) { case FencedFrameStatus::kNotNestedInFencedFrame: return false; case FencedFrameStatus::kFencedFrameRoot: return true; case FencedFrameStatus::kIframeNestedWithinFencedFrame: return true; } } void RenderFrameHostImpl::ForEachRenderFrameHostWithAction( base::FunctionRef on_frame) { ForEachRenderFrameHostImplWithAction( [on_frame](RenderFrameHostImpl* rfh) { return on_frame(rfh); }); } void RenderFrameHostImpl::ForEachRenderFrameHost( base::FunctionRef on_frame) { ForEachRenderFrameHostImpl( [on_frame](RenderFrameHostImpl* rfh) { on_frame(rfh); }); } void RenderFrameHostImpl::ForEachRenderFrameHostImplWithAction( base::FunctionRef on_frame) { ForEachRenderFrameHostImpl(on_frame, /*include_speculative=*/false); } void RenderFrameHostImpl::ForEachRenderFrameHostImpl( base::FunctionRef on_frame) { ForEachRenderFrameHostImplWithAction([on_frame](RenderFrameHostImpl* rfh) { on_frame(rfh); return FrameIterationAction::kContinue; }); } void RenderFrameHostImpl:: ForEachRenderFrameHostImplIncludingSpeculativeWithAction( base::FunctionRef on_frame) { ForEachRenderFrameHostImpl(on_frame, /*include_speculative=*/true); } void RenderFrameHostImpl::ForEachRenderFrameHostImplIncludingSpeculative( base::FunctionRef on_frame) { ForEachRenderFrameHostImplIncludingSpeculativeWithAction( [on_frame](RenderFrameHostImpl* rfh) { on_frame(rfh); return FrameIterationAction::kContinue; }); } void RenderFrameHostImpl::ForEachRenderFrameHostImpl( base::FunctionRef on_frame, bool include_speculative) { CHECK_CURRENTLY_ON(BrowserThread::UI); if (!include_speculative && (lifecycle_state() == LifecycleStateImpl::kSpeculative || lifecycle_state() == LifecycleStateImpl::kPendingCommit)) { return; } // Since |this| may not be current in its FrameTree, we can't begin iterating // from |frame_tree_node()|, so we special case the first invocation for // |this| and then actually start iterating over the subtree starting with // our children's FrameTreeNodes. bool skip_children_of_starting_frame = false; switch (on_frame(this)) { case FrameIterationAction::kContinue: break; case FrameIterationAction::kSkipChildren: skip_children_of_starting_frame = true; break; case FrameIterationAction::kStop: return; } // Potentially include our FrameTreeNode's speculative RenderFrameHost, but // only if |this| is current in its FrameTree. // TODO(crbug.com/40203236): Avoid having a RenderFrameHost access its // FrameTreeNode's speculative RenderFrameHost by moving // ForEachRenderFrameHostImplIncludingSpeculative from RenderFrameHostImpl or // possibly removing it entirely. if (include_speculative && frame_tree_node()->current_frame_host() == this) { RenderFrameHostImpl* speculative_frame_host = frame_tree_node()->render_manager()->speculative_frame_host(); if (speculative_frame_host) { CHECK_EQ(speculative_frame_host->child_count(), 0U); switch (on_frame(speculative_frame_host)) { case FrameIterationAction::kContinue: case FrameIterationAction::kSkipChildren: break; case FrameIterationAction::kStop: return; } } } if (skip_children_of_starting_frame) { return; } FrameTree::NodeRange ftn_range = FrameTree::SubtreeAndInnerTreeNodes(this); FrameTree::NodeIterator it = ftn_range.begin(); const FrameTree::NodeIterator end = ftn_range.end(); while (it != end) { FrameTreeNode* node = *it; RenderFrameHostImpl* frame_host = node->current_frame_host(); if (frame_host) { switch (on_frame(frame_host)) { case FrameIterationAction::kContinue: ++it; break; case FrameIterationAction::kSkipChildren: it.AdvanceSkippingChildren(); break; case FrameIterationAction::kStop: return; } } if (include_speculative) { RenderFrameHostImpl* speculative_frame_host = node->render_manager()->speculative_frame_host(); if (speculative_frame_host) { CHECK_EQ(speculative_frame_host->child_count(), 0U); switch (on_frame(speculative_frame_host)) { case FrameIterationAction::kContinue: case FrameIterationAction::kSkipChildren: break; case FrameIterationAction::kStop: return; } } } } } FrameTreeNodeId RenderFrameHostImpl::GetFrameTreeNodeId() const { return frame_tree_node_->frame_tree_node_id(); } blink::DOMNodeIdType RenderFrameHostImpl::GetFocusedDOMNodeId() const { return focused_editable_dom_node_id_; } EditableLevel RenderFrameHostImpl::GetFocusedEditableLevel() const { return focused_editable_level_; } const base::UnguessableToken& RenderFrameHostImpl::GetDevToolsFrameToken() { return devtools_frame_token(); } std::optional RenderFrameHostImpl::GetEmbeddingToken() { return embedding_token_; } const std::string& RenderFrameHostImpl::GetFrameName() { return browsing_context_state_->frame_name(); } bool RenderFrameHostImpl::IsFrameDisplayNone() { return frame_tree_node()->frame_owner_properties().is_display_none; } const std::optional& RenderFrameHostImpl::GetFrameSize() { return frame_size_; } size_t RenderFrameHostImpl::GetFrameDepth() { return depth_; } bool RenderFrameHostImpl::IsCrossProcessSubframe() { if (is_main_frame()) { return false; } return GetSiteInstance()->GetProcess() != parent_->GetSiteInstance()->GetProcess(); } bool RenderFrameHostImpl::RequiresProxyToParent() { if (is_main_frame()) { return false; } return GetSiteInstance()->group() != parent_->GetSiteInstance()->group(); } WebExposedIsolationLevel RenderFrameHostImpl::GetWebExposedIsolationLevel() { CHECK_EQ(GetSiteInstance()->GetSiteInfo().web_exposed_isolation_info(), GetProcess()->GetProcessLock().GetWebExposedIsolationInfo()); // First, get the WebExposedIsolationLevel that was computed based on whether // this page is in IsolatedWebApp, or was cross-origin isolated through the // use of COOP and COEP. WebExposedIsolationLevel level = GetProcess()->GetWebExposedIsolationLevel(); // Cross-origin isolation set through COOP and COEP can be restricted through // a PermissionPolicy. In this case, the document should be considered as not // isolated. if (!IsFeatureEnabled( network::mojom::PermissionsPolicyFeature::kCrossOriginIsolated)) { level = WebExposedIsolationLevel::kNotIsolated; } // Check if cross-origin isolation was enabled through // DocumentIsolationPolicy. This is stored in the AgentClusterKey, and not the // WebExposedIsolationLevel in the RenderProcessHost. This is not affected by // PermissionPolicy. if (GetSiteInstance() ->GetSiteInfo() .agent_cluster_key() .IsCrossOriginIsolated()) { if (level == WebExposedIsolationLevel::kNotIsolated) { level = WebExposedIsolationLevel::kIsolated; } } // On Android WebView where SiteInstance switching is not possible, DIP // information is stored in the PolicyContainer. Check this instead. const auto& override_key = policy_container_host()->policies().cross_origin_isolation_key_override; if (override_key && override_key->cross_origin_isolation_mode == blink::mojom::CrossOriginIsolationMode::kConcrete) { CHECK(!SiteIsolationPolicy::UseDedicatedProcessesForAllSites() && !SiteIsolationPolicy::AreDynamicIsolatedOriginsEnabled() && !ShouldUseDefaultSiteInstanceGroup()); if (level == WebExposedIsolationLevel::kNotIsolated) { level = WebExposedIsolationLevel::kIsolated; } } return level; } const GURL& RenderFrameHostImpl::GetLastCommittedURL() const { return last_committed_url_; } const url::Origin& RenderFrameHostImpl::GetLastCommittedOrigin() const { return last_committed_origin_; } const GURL& RenderFrameHostImpl::GetInheritedBaseUrl() const { return inherited_base_url_; } const net::NetworkIsolationKey& RenderFrameHostImpl::GetNetworkIsolationKey() { CHECK(!isolation_info_.IsEmpty()); return isolation_info_.network_isolation_key(); } const net::IsolationInfo& RenderFrameHostImpl::GetIsolationInfoForSubresources() { CHECK(!isolation_info_.IsEmpty()); return isolation_info_; } net::IsolationInfo RenderFrameHostImpl::GetPendingIsolationInfoForSubresources() { // TODO(crbug.com/40767475): Figure out if // ForPendingOrLastCommittedNavigation is correct below (it might not be). auto config = SubresourceLoaderFactoriesConfig::ForPendingOrLastCommittedNavigation( *this); CHECK(!config.isolation_info().IsEmpty()); return config.isolation_info(); } base::UnguessableToken RenderFrameHostImpl::GetNetworkRestrictionsID() { // TODO(crbug.com/447954811): Consider refactoring this method after // RenderDocument launches, because we may not need to consider pending // navigations anymore. auto config = SubresourceLoaderFactoriesConfig::ForPendingOrLastCommittedNavigation( *this); return config.network_restrictions_id(); } void RenderFrameHostImpl::GetCanonicalUrl( base::OnceCallback&)> callback) { if (IsRenderFrameLive()) { // Validate that the URL returned by the renderer is HTTP(S) only. It is // allowed to be cross-origin. auto validate_and_forward = [](base::OnceCallback&)> callback, const std::optional& url) { if (url && url->is_valid() && url->SchemeIsHTTPOrHTTPS()) { std::move(callback).Run(url); } else { std::move(callback).Run(std::nullopt); } }; GetAssociatedLocalFrame()->GetCanonicalUrlForSharing( base::BindOnce(validate_and_forward, std::move(callback))); } else { std::move(callback).Run(std::nullopt); } } void RenderFrameHostImpl::GetOpenGraphMetadata( base::OnceCallback callback) { if (IsRenderFrameLive()) { GetAssociatedLocalFrame()->GetOpenGraphMetadata( base::BindOnce(&ForwardOpenGraphMetadataIfValid, std::move(callback))); } else { std::move(callback).Run({}); } } bool RenderFrameHostImpl::IsErrorDocument() const { // This shouldn't be called before committing the document as this value is // set during call to RenderFrameHostImpl::DidNavigate which happens after // commit. CHECK_NE(lifecycle_state(), LifecycleStateImpl::kSpeculative); // TODO(523031825): CHECK-exclusion: Convert to a CHECK once we are confident // it won't be triggered. DCHECK_NE(lifecycle_state(), LifecycleStateImpl::kPendingCommit); return is_error_document_; } DocumentRef RenderFrameHostImpl::GetDocumentRef() { return DocumentRef(document_associated_data_->GetSafeRef()); } WeakDocumentPtr RenderFrameHostImpl::GetWeakDocumentPtr() { return WeakDocumentPtr(document_associated_data_->GetWeakPtr()); } void RenderFrameHostImpl::GetSerializedHtmlWithLocalLinks( const base::flat_map& url_map, const base::flat_map& frame_token_map, bool save_with_empty_url, mojo::PendingRemote serializer_handler) { if (!IsRenderFrameLive()) { return; } GetMojomFrameInRenderer()->GetSerializedHtmlWithLocalLinks( url_map, frame_token_map, save_with_empty_url, std::move(serializer_handler)); } void RenderFrameHostImpl::SetWantErrorMessageStackTrace() { GetMojomFrameInRenderer()->SetWantErrorMessageStackTrace(); } void RenderFrameHostImpl::ExecuteMediaPlayerActionAtLocation( const gfx::Point& location, const blink::mojom::MediaPlayerAction& action) { auto media_player_action = blink::mojom::MediaPlayerAction::New(); media_player_action->type = action.type; media_player_action->enable = action.enable; gfx::PointF point_in_view = GetView()->TransformRootPointToViewCoordSpace( gfx::PointF(location.x(), location.y())); GetAssociatedLocalFrame()->MediaPlayerActionAt( gfx::Point(point_in_view.x(), point_in_view.y()), std::move(media_player_action)); } void RenderFrameHostImpl::RequestVideoFrameAtWithBoundsHint( const gfx::Point& location, const gfx::Size& max_size, int max_area, base::OnceCallback callback) { gfx::PointF point_in_view = GetView()->TransformRootPointToViewCoordSpace( gfx::PointF(location.x(), location.y())); GetAssociatedLocalFrame()->RequestVideoFrameAtWithBoundsHint( gfx::Point(point_in_view.x(), point_in_view.y()), max_size, max_area, std::move(callback)); } bool RenderFrameHostImpl::CreateNetworkServiceDefaultFactory( mojo::PendingReceiver default_factory_receiver) { // Factory config below is based on the last committed navigation, under the // assumptions that the caller wants a factory that acts on behalf of the // *currently* committed document. This assumption is typically valid for // callers that are responding to an IPC coming from the renderer process. If // the caller wanted a factory associated with a pending navigation, then the // config won't be correct. For more details, please see the doc comment of // ForPendingOrLastCommittedNavigation. auto subresource_loader_factories_config = SubresourceLoaderFactoriesConfig::ForLastCommittedNavigation(*this); return CreateNetworkServiceDefaultFactoryAndObserve( CreateURLLoaderFactoryParamsForMainWorld( subresource_loader_factories_config, "RFHI::CreateNetworkServiceDefaultFactory"), subresource_loader_factories_config.ukm_source_id(), std::move(default_factory_receiver)); } std::unique_ptr RenderFrameHostImpl::CreateSubresourceLoaderFactoriesForInitialEmptyDocument() { // This method should only be called (by RenderViewHostImpl::CreateRenderView) // when creating a new local main frame in a Renderer process. CHECK(!GetParent()); // Expecting the frame to be at the initial empty document. // Not CHECK-ing `last_committed_origin_`, because it is not reset by // RenderFrameHostImpl::RenderProcessExited for crashed frames. CHECK_EQ(GURL(), last_committed_url_); auto subresource_loader_factories = std::make_unique(); switch (lifecycle_state()) { case RenderFrameHostImpl::LifecycleStateImpl::kInBackForwardCache: case RenderFrameHostImpl::LifecycleStateImpl::kPendingCommit: case RenderFrameHostImpl::LifecycleStateImpl::kReadyToBeDeleted: case RenderFrameHostImpl::LifecycleStateImpl::kRunningUnloadHandlers: // A newly-created frame shouldn't be in any of the states above. NOTREACHED(); case RenderFrameHostImpl::LifecycleStateImpl::kSpeculative: // No subresource requests should be initiated in the speculative frame. // Serving an empty bundle of `subresource_loader_factories` will // desirably lead to a crash in URLLoaderFactoryBundle::GetFactory (see // also the CHECK there) if the speculative frame attempts to start a // subresource load. break; case RenderFrameHostImpl::LifecycleStateImpl::kActive: case RenderFrameHostImpl::LifecycleStateImpl::kPrerendering: CreateNetworkServiceDefaultFactory( subresource_loader_factories->pending_default_factory() .InitWithNewPipeAndPassReceiver()); // The caller will send the returned factory to the renderer process (as // the default factory). Therefore, after a NetworkService crash we need // to push to the renderer an updated factory. recreate_default_url_loader_factory_after_network_service_crash_ = true; break; } return subresource_loader_factories; } void RenderFrameHostImpl::MarkIsolatedWorldsAsRequiringSeparateURLLoaderFactory( const base::flat_set& isolated_world_origins, bool push_to_renderer_now) { size_t old_size = isolated_worlds_requiring_separate_url_loader_factory_.size(); isolated_worlds_requiring_separate_url_loader_factory_.insert( isolated_world_origins.begin(), isolated_world_origins.end()); size_t new_size = isolated_worlds_requiring_separate_url_loader_factory_.size(); bool insertion_took_place = (old_size != new_size); // Push the updated set of factories to the renderer, but only if // 1) the caller requested an immediate push (e.g. for content scripts // injected programmatically chrome.tabs.executeCode, but not for content // scripts declared in the manifest - the difference is that the latter // happen at a commit and the factories can just be send in the commit // IPC). // 2) an insertion actually took place / the factories have been modified. // // See also the doc comment of `PendingURLLoaderFactoryBundle::OriginMap` // (the type of `pending_isolated_world_factories` that are set below). if (push_to_renderer_now && insertion_took_place) { // The `config` of the new factories might need to depend on the pending // (rather than the last committed) navigation, because we can't predict if // an in-flight Commit IPC might be present when an extension injects a // content script and MarkIsolatedWorlds... is called. See also the doc // comment for the ForPendingOrLastCommittedNavigation method. auto config = SubresourceLoaderFactoriesConfig::ForPendingOrLastCommittedNavigation( *this); std::unique_ptr subresource_loader_factories = std::make_unique(); subresource_loader_factories->pending_isolated_world_factories() = CreateURLLoaderFactoriesForIsolatedWorlds(config, isolated_world_origins); GetMojomFrameInRenderer()->UpdateSubresourceLoaderFactories( std::move(subresource_loader_factories)); } } bool RenderFrameHostImpl::IsSandboxed(network::mojom::WebSandboxFlags flags) { return static_cast(active_sandbox_flags()) & static_cast(flags); } blink::web_pref::WebPreferences RenderFrameHostImpl::GetOrCreateWebPreferences() { return delegate()->GetOrCreateWebPreferences(); } blink::PendingURLLoaderFactoryBundle::OriginMap RenderFrameHostImpl::CreateURLLoaderFactoriesForIsolatedWorlds( const SubresourceLoaderFactoriesConfig& config, const base::flat_set& isolated_world_origins) { blink::PendingURLLoaderFactoryBundle::OriginMap result; for (const url::Origin& isolated_world_origin : isolated_world_origins) { network::mojom::URLLoaderFactoryParamsPtr factory_params = URLLoaderFactoryParamsHelper::CreateForIsolatedWorld( this, isolated_world_origin, config.origin(), config.isolation_info(), config.GetClientSecurityState(), config.trust_token_issuance_policy(), config.trust_token_redemption_policy(), config.cookie_setting_overrides()); mojo::PendingRemote factory_remote; CreateNetworkServiceDefaultFactoryAndObserve( std::move(factory_params), ukm::kInvalidSourceIdObj, /* isolated from page */ factory_remote.InitWithNewPipeAndPassReceiver()); result[isolated_world_origin] = std::move(factory_remote); } return result; } gfx::NativeView RenderFrameHostImpl::GetNativeView() { RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView(); if (!view) { return gfx::NativeView(); } return view->GetNativeView(); } void RenderFrameHostImpl::AddMessageToConsole( blink::mojom::ConsoleMessageLevel level, const std::string& message) { AddMessageToConsoleImpl(level, message, /*discard_duplicates=*/false); } void RenderFrameHostImpl::ExecuteJavaScriptMethod( const std::u16string& object_name, const std::u16string& method_name, base::ListValue arguments, JavaScriptResultCallback callback) { CHECK_CURRENTLY_ON(BrowserThread::UI); CHECK(CanExecuteJavaScript()); AssertFrameWasCommitted(); const bool wants_result = !callback.is_null(); GetAssociatedLocalFrame()->JavaScriptMethodExecuteRequest( object_name, method_name, std::move(arguments), wants_result, std::move(callback)); } void RenderFrameHostImpl::ExecuteJavaScript(const std::u16string& javascript, JavaScriptResultCallback callback) { CHECK_CURRENTLY_ON(BrowserThread::UI); CHECK(CanExecuteJavaScript()); AssertFrameWasCommitted(); const bool wants_result = !callback.is_null(); GetAssociatedLocalFrame()->JavaScriptExecuteRequest(javascript, wants_result, std::move(callback)); } void RenderFrameHostImpl::ExecuteJavaScriptInIsolatedWorld( const std::u16string& javascript, JavaScriptResultCallback callback, int32_t world_id) { CHECK_CURRENTLY_ON(BrowserThread::UI); CHECK_GT(world_id, ISOLATED_WORLD_ID_GLOBAL); CHECK_LE(world_id, ISOLATED_WORLD_ID_MAX); AssertFrameWasCommitted(); const bool wants_result = !callback.is_null(); GetAssociatedLocalFrame()->JavaScriptExecuteRequestInIsolatedWorld( javascript, wants_result, world_id, std::move(callback)); } void RenderFrameHostImpl::ExecuteJavaScriptForTests( const std::u16string& javascript, JavaScriptResultCallback callback, int32_t world_id) { ExecuteJavaScriptForTests( // IN-TEST javascript, /*has_user_gesture=*/false, /*resolve_promises=*/false, /*honor_js_content_settings=*/false, world_id, CreateJavaScriptExecuteRequestForTestsCallback(std::move(callback))); } void RenderFrameHostImpl::ExecuteJavaScriptWithUserGestureForTests( const std::u16string& javascript, JavaScriptResultCallback callback, int32_t world_id) { ExecuteJavaScriptForTests( // IN-TEST javascript, /*has_user_gesture=*/true, /*resolve_promises=*/false, /*honor_js_content_settings=*/false, world_id, CreateJavaScriptExecuteRequestForTestsCallback(std::move(callback))); } void RenderFrameHostImpl::ExecuteJavaScriptForTests( const std::u16string& javascript, bool has_user_gesture, bool resolve_promises, bool honor_js_content_settings, int32_t world_id, JavaScriptResultAndTypeCallback callback) { CHECK_CURRENTLY_ON(BrowserThread::UI); AssertFrameWasCommitted(); if (has_user_gesture && owner_) { // TODO(mustaq): The render-to-browser state update caused by the below // JavaScriptExecuteRequestsForTests call is redundant with this update. We // should determine if the redundancy can be removed. CHECK(owner_->UpdateUserActivationState( blink::mojom::UserActivationUpdateType::kNotifyActivation, blink::mojom::UserActivationNotificationType::kTest)); } GetAssociatedLocalFrame()->JavaScriptExecuteRequestForTests( // IN-TEST javascript, has_user_gesture, resolve_promises, honor_js_content_settings, world_id, std::move(callback)); } void RenderFrameHostImpl::ExecutePluginActionAtLocalLocation( const gfx::Point& location, blink::mojom::PluginActionType plugin_action) { gfx::Point local_location = gfx::ToFlooredPoint( GetView()->TransformRootPointToViewCoordSpace(gfx::PointF(location))); GetAssociatedLocalFrame()->PluginActionAt(local_location, plugin_action); } void RenderFrameHostImpl::CopyImageAt(int x, int y) { gfx::PointF point_in_view = GetView()->TransformRootPointToViewCoordSpace(gfx::PointF(x, y)); GetAssociatedLocalFrame()->CopyImageAt( gfx::Point(point_in_view.x(), point_in_view.y())); } void RenderFrameHostImpl::SaveImageAt(int x, int y) { gfx::PointF point_in_view = GetView()->TransformRootPointToViewCoordSpace(gfx::PointF(x, y)); GetAssociatedLocalFrame()->SaveImageAt( gfx::Point(point_in_view.x(), point_in_view.y())); } RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() const { return render_view_host_.get(); } service_manager::InterfaceProvider* RenderFrameHostImpl::GetRemoteInterfaces() { // TODO(https://crbug.com/526541360): CHECK-exclusion: Convert to CHECK once // we are sure this isn't hit. DCHECK(IsRenderFrameLive()); return remote_interfaces_.get(); } blink::AssociatedInterfaceProvider* RenderFrameHostImpl::GetRemoteAssociatedInterfaces() { if (!remote_associated_interfaces_) { mojo::AssociatedRemote remote_interfaces; if (GetAgentSchedulingGroup().GetChannel()) { GetAgentSchedulingGroup().GetRemoteRouteProvider()->GetRoute( GetFrameToken(), remote_interfaces.BindNewEndpointAndPassReceiver()); } else { LOG(WARNING) << "Creating unbound remote associated interface provider"; // The channel may not be initialized in some tests environments. In this // case we set up a dummy interface provider. std::ignore = remote_interfaces.BindNewEndpointAndPassDedicatedReceiver(); } remote_associated_interfaces_ = std::make_unique( remote_interfaces.Unbind()); } return remote_associated_interfaces_.get(); } PageVisibilityState RenderFrameHostImpl::GetVisibilityState() { // Works around the crashes seen in https://crbug.com/501863, where the // active WebContents from a browser iterator may contain a render frame // detached from the frame tree. This tries to find a RenderWidgetHost // attached to an ancestor frame, and defaults to visibility hidden if // it fails. // TODO(yfriedman, peter): Ideally this would never be called on an // unattached frame and we could omit this check. See // https://crbug.com/615867. RenderFrameHostImpl* frame = this; while (frame) { if (frame->GetLocalRenderWidgetHost()) { break; } frame = frame->GetParent(); } if (!frame) { return PageVisibilityState::kHidden; } return GetRenderWidgetHost()->IsHidden() ? PageVisibilityState::kHidden : PageVisibilityState::kVisible; } void RenderFrameHostImpl::OnAssociatedInterfaceRequest( const std::string& interface_name, mojo::ScopedInterfaceEndpointHandle handle) { // `this` is an `IPC::Listener`, but there is no path by which `this` would // receive associated interface requests through this method. Associated // interface requests come in through `GetAssociatedInterface()`. NOTREACHED(); } std::string RenderFrameHostImpl::ToDebugString() { return "RFHI:" + render_view_host_->GetDelegate()->GetCreatorLocation().ToString(); } void RenderFrameHostImpl::AccessibilityPerformAction( const ui::AXActionData& action_data) { // Don't perform any Accessibility action on an inactive frame. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kAXPerformAction) || !render_accessibility_) { return; } if (action_data.action == ax::mojom::Action::kHitTest) { AccessibilityHitTest(action_data.target_point, action_data.hit_test_event_to_fire, action_data.request_id, {}); return; } // Don't perform the action if the WebContents is set to ignore input events. // See WebContents::IgnoreInputEvents for more information. if (delegate()->ShouldIgnoreInputEvents()) { return; } // Set the input modality in RenderWidgetHostViewAura to touch so the // VK shows up. if (action_data.action == ax::mojom::Action::kFocus) { RenderWidgetHostViewBase* view = static_cast( render_view_host_->GetWidget()->GetView()); if (view) { view->SetLastPointerType(ui::EventPointerType::kTouch); } } render_accessibility_->PerformAction(action_data); } bool RenderFrameHostImpl::AccessibilityViewHasFocus() { RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView(); if (view) { return view->AccessibilityHasFocus(); } return false; } void RenderFrameHostImpl::AccessibilityViewSetFocus() { // Don't update Accessibility for inactive frames. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kAXSetFocus)) { return; } RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView(); if (view) { view->Focus(); } } gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() { RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView(); if (view) { return view->GetViewBounds(); } return gfx::Rect(); } float RenderFrameHostImpl::AccessibilityGetDeviceScaleFactor() { return GetScaleFactorForView(GetView()); } void RenderFrameHostImpl::AccessibilityReset() { if (!render_accessibility_) { return; } accessibility_reset_token_ = ++g_accessibility_reset_token; is_first_accessibility_request_ = false; accessibility_reset_start_ = base::TimeTicks::Now(); render_accessibility_->Reset(*accessibility_reset_token_); } void RenderFrameHostImpl::UnrecoverableAccessibilityError() { CHECK(!ui::AXTreeManager::IsFailFastMode()); browser_accessibility_manager_.reset(); if (!render_accessibility_) { return; } static auto* ax_rfhi_url_crash_key = base::debug::AllocateCrashKeyString( "ax_rfhi_url", base::debug::CrashKeySize::Size256); base::debug::ScopedCrashKeyString ax_rfhi_url(ax_rfhi_url_crash_key, GetLastCommittedURL().spec()); static auto* ax_rfhi_top_url_crash_key = base::debug::AllocateCrashKeyString( "ax_rfhi_top_url", base::debug::CrashKeySize::Size256); base::debug::ScopedCrashKeyString ax_rfhi_top_url( ax_rfhi_top_url_crash_key, GetOutermostMainFrameOrEmbedder()->GetLastCommittedURL().spec()); // Turn off accessibility for this WebContents to ensure we don't continue // churning on failures, but do not crash the renderer. delegate_->UnrecoverableAccessibilityError(); // Crash keys were set in BrowserAccessibilityManager::Unserialize(). base::debug::DumpWithoutCrashing(); } gfx::AcceleratedWidget RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() { CHECK(AccessibilityIsRootFrame()); // Only the active RenderFrameHost is connected to the native widget tree for // accessibility, so return null if this is queried on any other frame. if (!IsActive()) { return gfx::kNullAcceleratedWidget; } RenderWidgetHostViewBase* view = static_cast( render_view_host_->GetWidget()->GetView()); if (view) { return view->AccessibilityGetAcceleratedWidget(); } return gfx::kNullAcceleratedWidget; } gfx::NativeViewAccessible RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() { RenderWidgetHostViewBase* view = static_cast( render_view_host_->GetWidget()->GetView()); if (view) { return view->AccessibilityGetNativeViewAccessible(); } return gfx::NativeViewAccessible(); } gfx::NativeViewAccessible RenderFrameHostImpl::AccessibilityGetNativeViewAccessibleForWindow() { // If this method is called when the frame is in BackForwardCache, evict // the frame to avoid ignoring any accessibility related events which are not // expected. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kAXGetNativeViewForWindow)) { return gfx::NativeViewAccessible(); } RenderWidgetHostViewBase* view = static_cast( render_view_host_->GetWidget()->GetView()); if (view) { return view->AccessibilityGetNativeViewAccessibleForWindow(); } return gfx::NativeViewAccessible(); } void RenderFrameHostImpl::AccessibilityHitTest( const gfx::Point& point_in_frame_pixels, const ax::mojom::Event& opt_event_to_fire, int opt_request_id, base::OnceCallback opt_callback) { // This is called by BrowserAccessibilityManager. During teardown it's // possible that render_accessibility_ is null but the corresponding // BrowserAccessibilityManager still exists and could call this. if (IsInactiveAndDisallowActivation(DisallowActivationReasonId::kAXHitTest) || !render_accessibility_) { if (opt_callback) { std::move(opt_callback).Run(nullptr, ui::kInvalidAXNodeID); } return; } render_accessibility_->HitTest( point_in_frame_pixels, opt_event_to_fire, opt_request_id, base::BindOnce(&RenderFrameHostImpl::AccessibilityHitTestCallback, weak_ptr_factory_.GetWeakPtr(), opt_request_id, opt_event_to_fire, std::move(opt_callback))); } gfx::NativeWindow RenderFrameHostImpl::GetTopLevelNativeWindow() { return delegate_ ? delegate_->GetOwnerNativeWindow() : gfx::NativeWindow(); } bool RenderFrameHostImpl::CanFireAccessibilityEvents() const { return IsActive(); } bool RenderFrameHostImpl::ShouldSuppressAXLoadComplete() { if (!AccessibilityIsRootFrame()) { return false; } return GetContentClient()->browser()->ShouldSuppressAXLoadComplete(this); } bool RenderFrameHostImpl::AccessibilityIsRootFrame() const { // Do not use is_main_frame() or IsOutermostMainFrame(). // Frame trees may be nested so it can be the case that is_main_frame() is // true, but is not the outermost RenderFrameHost (it only checks for nullity // of |parent_|. In particular, !is_main_frame() cannot be used to check if // this RenderFrameHost is embedded. In addition, IsOutermostMainFrame() // does not escape guest views. Therefore, we must check for any kind of // parent document or embedder. if (GetParentOrOuterDocumentOrEmbedderExcludingProspectiveOwners()) { return false; } // A surface-embedded frame has an AX parent in another tree, so it is not // the AX root even though it is the root of its own frame tree. if (delegate_->GetSurfaceEmbedConnector()) { return false; } return true; } WebContentsAccessibility* RenderFrameHostImpl::AccessibilityGetWebContentsAccessibility() { CHECK(AccessibilityIsRootFrame()); auto* view = static_cast(GetView()); if (!view) { return nullptr; } return view->GetWebContentsAccessibility(); } bool RenderFrameHostImpl::AccessibilityIsWebContentSource() { return true; } ui::AXMode RenderFrameHostImpl::GetScopedAccessibilityMode() const { return delegate_->GetAccessibilityMode(); } ui::AXPlatformNodeId RenderFrameHostImpl::GetOrCreateAXNodeUniqueId( ui::AXNodeID ax_node_id) { auto [iter, inserted] = ax_unique_ids_.try_emplace(ax_node_id, ui::AXUniqueId::CreateInvalid()); if (inserted) { iter->second = ui::AXUniqueId::Create(); } return iter->second; } void RenderFrameHostImpl::OnAXNodeDeleted(ui::AXNodeID ax_node_id) { ax_unique_ids_.erase(ax_node_id); } void RenderFrameHostImpl::InitializePolicyContainerHost( bool renderer_initiated_creation_of_main_frame) { // No policy container for speculative frames. if (lifecycle_state_ == LifecycleStateImpl::kSpeculative) { return; } // During initialization, a RenderFrameHost always has a non-null `owner_`. // This is called from the constructor. CHECK(owner_); // The initial empty document inherits its policy container from its creator. // The creator is either its parent for subframes and embedded frames, or its // opener for new windows. // // Note 1: For normal document created from a navigation, the policy container // is computed from the NavigationRequest and assigned in // DidCommitNewDocument(). RenderFrameHostImpl* creator_rfh = nullptr; scoped_refptr policy_container_host = nullptr; if (parent_) { creator_rfh = parent_; policy_container_host = parent_->policy_container_host()->Clone(); } else if (GetParentOrOuterDocument()) { creator_rfh = GetParentOrOuterDocument(); // In the MPArch implementation of FencedFrame, this RenderFrameHost's // SiteInstance has been adjusted to match its parent. During navigations, // COOP, COEP and DIP are used to determine the SiteInstance. It means that // if SiteInstance has been inherited, COOP,COEP and DIP must also be // inherited to avoid creating inconsistencies. See: // https://chromium-review.googlesource.com/c/chromium/src/+/3645368 // // TODO(crbug.com/40849161): What makes sense for GuestView? const PolicyContainerPolicies& parent_policies = GetParentOrOuterDocument()->policy_container_host()->policies(); // Note: the full constructor is used, to force developers to make an // explicit decision when adding new fields to the PolicyContainer. // The IP address space of fenced frame is set to `kPublic`. // 1. This makes it subject to local network access checks, restricting // its ability to access the private network. // 2. The IP address space of the parent does not leak to the fenced frame. policy_container_host = base::MakeRefCounted(PolicyContainerPolicies( network::mojom::ReferrerPolicy::kDefault, IsFencedFrameRoot() ? network::mojom::IPAddressSpace::kPublic : network::mojom::IPAddressSpace::kUnknown, /*is_web_secure_context=*/false, parent_policies.connection_allowlists, std::vector(), parent_policies.cross_origin_opener_policy, parent_policies.cross_origin_embedder_policy, parent_policies.document_isolation_policy, parent_policies.integrity_policy, parent_policies.integrity_policy_report_only, network::mojom::WebSandboxFlags::kNone, /*is_credentialless=*/false, /*can_navigate_top_without_user_gesture=*/true, parent_policies.cross_origin_isolation_enabled_by_dip, parent_policies.cross_origin_isolation_key_override)); } else if (owner_->GetOpener()) { creator_rfh = owner_->GetOpener()->current_frame_host(); // During a `window.open(...)` without `noopener`, a new popup is created // and always starts from the initial empty document. The opener has // synchronous access toward its openee. So they must both share the same // policies. policy_container_host = creator_rfh->policy_container_host()->Clone(); } else { // In all the other cases, there is no environment to inherit policies // from. This is "probably" a new top-level about:blank document created by // the browser directly (omnibox, bookmarks, ...). PolicyContainerPolicies policies; // Main frames created by the browser are treated as belonging the // `loopback` address space, so that they can make requests to any address // space unimpeded. The only way to execute code in such a context is to // inject it via DevTools, WebView APIs, or extensions; it is impossible to // do so with Web Platform means only. // // See also https://crbug.com/1191161. // // We also exclude prerendering from this case manually, since prendering // RenderFrameHosts are unconditionally created with the // `renderer_initiated_creation_of_main_frame` set to false, even though the // frames arguably are renderer-created. // // TODO(crbug.com/40758431): Address the prerendering case. CHECK(IsOutermostMainFrame()); if (!renderer_initiated_creation_of_main_frame && lifecycle_state_ != LifecycleStateImpl::kPrerendering) { policies.ip_address_space = network::mojom::IPAddressSpace::kLoopback; } policy_container_host = base::MakeRefCounted(std::move(policies)); } // For cases where policy container's connection allowlists is inherited, // also inherit its creator's network_restrictions_id until it gets // navigated at which point it will create its own id. // e.g. iframes that stay at about:blank. This ensures any dns prefetch // requests from the iframe also get subjected to the CA of the creator. // Their fetch requests already get subjected because they use the creator's // URLloader factory. // The id is shared via ref-counting: the initial empty document holds a // reference to the creator's id. If the child navigates, the navigation // throttle assigns a new id, replacing the shared reference. The creator's // id is only cleared from the network service when the last document // holding a reference is destroyed. if (creator_rfh) { document_associated_data_->ShareNetworkRestrictionsId( creator_rfh->document_associated_data_->NetworkRestrictionsIdHandle()); } // The initial empty documents sandbox flags is the union from: // - The parent or opener document's CSP sandbox inherited by policy // container. // - The frame's sandbox flags, contained in browsing_context_state. This // are either: // 1. For iframe: the parent + iframe.sandbox attribute. // 2. For popups: the opener if "allow-popups-to-escape-sandbox" isn't // set. network::mojom::WebSandboxFlags sandbox_flags_to_commit = browsing_context_state_->effective_frame_policy().sandbox_flags; for (const auto& csp : policy_container_host->policies().content_security_policies) { sandbox_flags_to_commit |= csp->sandbox; } policy_container_host->set_sandbox_flags( sandbox_flags_to_commit, base::PassKey()); // The initial empty document's credentialless bit was inherited from the // parent document. The frame's credentialless bit can also turn it on. if (owner_->Credentialless()) { policy_container_host->SetIsCredentialless( base::PassKey()); } // Assign the newly created PolicyContainerHost to the RenderFrameHostImpl. // This will register this RFH as the PolicyContainerHost::Client, and the // PolicyContainerHost will no longer be modifiable (except by IPCs received // from the renderer process). // Since this is the initialization of the frame, we do not need to generate a // new initiator state token, as there was not previous state. SetPolicyContainerHost(std::move(policy_container_host), current_initiator_state_token_); } void RenderFrameHostImpl::SetPolicyContainerHost( scoped_refptr policy_container_host, const base::UnguessableToken& new_initiator_state_token) { // Reset an existing PolicyContainerHost::Client now that it will no longer be // associated with this RenderFrameHost. if (policy_container_host_) { policy_container_host_->SetClient(nullptr); } policy_container_host_ = std::move(policy_container_host); policy_container_host_->SetClient(this); // Top-level document are never credentialless. // Note: It is never inherited from the opener, because they are forced to // open windows using noopener. devtools_instrumentation::DidUpdatePolicyContainerHost(frame_tree_node_); CHECK(parent_ || !IsCredentialless()); current_initiator_state_token_ = new_initiator_state_token; // TODO(crbug.com/510258191): Here, we should generate a new // InitiatorNavigationState tied to the updated initiator state token and // store it in the RenderFrameHost, so that it can be passed to navigations // started from the document. } void RenderFrameHostImpl::DidChangeReferrerPolicy( network::mojom::ReferrerPolicy referrer_policy) { if (!IsActive()) { return; } CHECK(owner_); // See `owner_` invariants about `IsActive()`. owner_->DidChangeReferrerPolicy(referrer_policy); } void RenderFrameHostImpl::DidUpdateInitiatorStateToken( const base::UnguessableToken& new_initiator_state_token) { // TODO(crbug.com/510258191): We should create a new InitiatorNavigationState // and associate it with the updated token, while validating that the updated // token is valid and is not already in use. current_initiator_state_token_ = new_initiator_state_token; } void RenderFrameHostImpl::InitializeLocalNetworkAccessRequestPolicy() { if (!policy_container_host_) { // Only speculative RFHs may lack a policy container. CHECK_EQ(lifecycle_state_, LifecycleStateImpl::kSpeculative); return; } local_network_access_request_policy_ = DeriveLocalNetworkAccessRequestPolicy( policy_container_host_->policies(), LocalNetworkAccessRequestContext::kSubresource); } void RenderFrameHostImpl::RenderProcessGone( SiteInstanceGroup* site_instance_group, const ChildProcessTerminationInfo& info) { CHECK_EQ(site_instance_->group(), site_instance_group); if (IsInBackForwardCache()) { EvictFromBackForwardCacheWithReason( info.status == base::TERMINATION_STATUS_PROCESS_CRASHED ? BackForwardCacheMetrics::NotRestoredReason:: kRendererProcessCrashed : BackForwardCacheMetrics::NotRestoredReason:: kRendererProcessKilled); } CancelPrerendering(PrerenderCancellationReason( info.status == base::TERMINATION_STATUS_PROCESS_CRASHED ? PrerenderFinalStatus::kRendererProcessCrashed : PrerenderFinalStatus::kRendererProcessKilled)); if (owned_render_widget_host_) { owned_render_widget_host_->RendererExited(); } // The renderer process is gone, so this frame can no longer be loading. ResetOwnedNavigationRequests(NavigationDiscardReason::kRenderProcessGone); ResetLoadingState(); // Also, clear any pending navigations that have been blocked while the // embedder is processing window.open() requests. This is consistent // with clearing NavigationRequests and loading state above, and it also // makes sense because certain parts of `pending_navigate_`, like the // NavigationClient remote interface, can no longer be used. pending_navigate_.reset(); // Any future UpdateState or UpdateTitle messages from this or a recreated // process should be ignored until the next commit. set_nav_entry_id(0); // During fast-shutdown, avoid cleanup as the VideoCaptureHost will still send // removal notifications after this function ends. if (!GetProcess()->FastShutdownStarted()) { CleanUpMediaStreams(); } ++renderer_exit_count_; MaybeGenerateCrashReport(info.status, info.exit_code); // Reporting API: Send any queued reports and mark the reporting source as // expired so that the reporting configuration in the network service can be // removed. This is done here, rather than in the destructor, as it needs the // mojo pipe to the network service. GetProcess() ->GetStoragePartition() ->GetNetworkContext() ->SendReportsAndRemoveSource(GetReportingSource()); // When a frame's process dies, its RenderFrame no longer exists, which means // that its child frames must be cleaned up as well. ResetChildren(); // Reset state for the current RenderFrameHost once the FrameTreeNode has been // reset. RenderFrameDeleted(); SetLastCommittedUrl(GURL()); SetInheritedBaseUrl(GURL()); renderer_url_info_ = RendererURLInfo(); must_be_replaced_for_crash_ = true; has_committed_any_navigation_ = false; #if BUILDFLAG(IS_ANDROID) // Execute any pending Samsung smart clip callbacks. for (base::IDMap>::iterator iter(&smart_clip_callbacks_); !iter.IsAtEnd(); iter.Advance()) { std::move(*iter.GetCurrentValue()) .Run(std::u16string(), std::u16string(), gfx::Rect()); } smart_clip_callbacks_.Clear(); #endif // BUILDFLAG(IS_ANDROID) // Ensure that future remote interface requests are associated with the new // process's channel. remote_associated_interfaces_.reset(); // Any termination disablers in content loaded by the new process will // be sent again. has_before_unload_handler_ = false; has_unload_handler_ = false; has_pagehide_handler_ = false; has_visibilitychange_handler_ = false; has_navigate_event_handler_ = false; if (IsPendingDeletion()) { // If the process has died, we don't need to wait for the ACK. Complete the // deletion immediately. // Note that it is possible for a frame to already be in kReadyToBeDeleted. // This happens when this RenderFrameHost is pending deletion and is // waiting on one of its children to run its unload handler. While running // it, it can request its parent to detach itself. if (lifecycle_state() != LifecycleStateImpl::kReadyToBeDeleted) { SetLifecycleState(LifecycleStateImpl::kReadyToBeDeleted); } CHECK(children_.empty()); PendingDeletionCheckCompleted(); // Can delete |this|. // |this| is deleted. Don't add any more code at this point in the function. return; } // If this was the current pending or speculative RFH dying, cancel and // destroy it. if (lifecycle_state_ == LifecycleStateImpl::kSpeculative || lifecycle_state_ == LifecycleStateImpl::kPendingCommit) { CHECK(owner_); // See `owner_` invariants about `lifecycle_state_`. owner_->GetRenderFrameHostManager() .CleanupSpeculativeRfhForRenderProcessGone(); } // Note: don't add any more code at this point in the function because // |this| may be deleted. Any additional cleanup should happen before // the last block of code here. } bool RenderFrameHostImpl::OnLockContention() { if (IsInBackForwardCache()) { EvictFromBackForwardCacheWithReason( BackForwardCacheMetrics::NotRestoredReason::kWebLocksContention); return true; } return false; } void RenderFrameHostImpl::PerformAction(const ui::AXActionData& data) { AccessibilityPerformAction(data); } bool RenderFrameHostImpl::RequiresPerformActionPointInPixels() const { return true; } bool RenderFrameHostImpl::CreateRenderFrame( const std::optional& previous_frame_token, const std::optional& opener_frame_token, const std::optional& parent_frame_token, const std::optional& previous_sibling_frame_token, const std::optional& navigation_metrics_token) { TRACE_EVENT0("navigation", "RenderFrameHostImpl::CreateRenderFrame"); CHECK(!IsRenderFrameLive()) << "Creating frame twice"; // The process may (if we're sharing a process with another host that already // initialized it) or may not (we have our own process or the old process // crashed) have been initialized. Calling Init() multiple times will be // ignored, so this is safe. if (!GetAgentSchedulingGroup().Init()) { return false; } CHECK(GetProcess()->IsInitializedAndNotDead()); mojom::CreateFrameParamsPtr params = mojom::CreateFrameParams::New(); BindBrowserInterfaceBrokerReceiver( params->interface_broker.InitWithNewPipeAndPassReceiver()); params->routing_id = routing_id_; params->is_for_nested_main_frame = is_main_frame() && render_view_host_->ViewWidgetType() != mojom::ViewWidgetType::kTopLevel; params->previous_frame_token = previous_frame_token; params->opener_frame_token = opener_frame_token; params->parent_frame_token = parent_frame_token; params->previous_sibling_frame_token = previous_sibling_frame_token; params->tree_scope_type = frame_tree_node()->tree_scope_type(); params->replication_state = browsing_context_state_->current_replication_state().Clone(); params->frame_token = frame_token_; params->devtools_frame_token = devtools_frame_token(); BindAssociatedInterfaceProviderReceiver( params->associated_interface_provider_remote .InitWithNewEndpointAndPassReceiver()); params->document_token = document_associated_data_->token(); params->navigation_metrics_token = navigation_metrics_token; // If this is a new RenderFrameHost for a frame that has already committed a // document, we don't have a policy container yet. Indeed, in that case, this // RenderFrameHost will not display any document until it commits a // navigation. The policy container for the navigated document will be sent to // Blink at CommitNavigation time and then stored in this RenderFrameHost in // DidCommitNewDocument. if (policy_container_host()) { params->policy_container = policy_container_host()->CreatePolicyContainerForBlink(); } // Normally, the replication state contains effective frame policy, excluding // sandbox flags and permissions policy attributes that were updated but have // not taken effect. However, a new RenderFrame should use the pending frame // policy, since it is being created as part of the navigation that will // commit it. (I.e., the RenderFrame needs to know the policy to use when // initializing the new document once it commits). params->replication_state->frame_policy = frame_tree_node()->pending_frame_policy(); // If we switched BrowsingInstances because of the COOP header, we should // clear the frame name. This below informs the renderer at frame creation. NavigationRequest* navigation_request = frame_tree_node()->navigation_request(); BrowserContext* context = frame_tree_node()->navigator().controller().GetBrowserContext(); bool should_clear_browsing_instance_name = navigation_request && (navigation_request->browsing_context_group_swap() .ShouldClearWindowName() || (navigation_request->commit_params() .is_cross_site_cross_browsing_context_group && base::FeatureList::IsEnabled( features::kClearCrossSiteCrossBrowsingContextGroupWindowName) && GetContentClient() ->browser() ->IsClearWindowNameForNewBrowsingContextGroupAllowed(context))); if (should_clear_browsing_instance_name) { params->replication_state->name = ""; // The "swaps" only affect main frames, that have an empty unique name. CHECK(params->replication_state->unique_name.empty()); } params->frame_owner_properties = frame_tree_node()->frame_owner_properties().Clone(); params->is_on_initial_empty_document = frame_tree_node()->is_on_initial_empty_document(); // The RenderWidgetHost takes ownership of its view. It is tied to the // lifetime of the current RenderProcessHost for this RenderFrameHost. // TODO(avi): This will need to change to initialize a // RenderWidgetHostViewAura for the main frame once RenderViewHostImpl has-a // RenderWidgetHostImpl. https://crbug.com/545684 if (owned_render_widget_host_) { CHECK(parent_); CHECK(parent_frame_token); RenderWidgetHostView* rwhv = RenderWidgetHostViewChildFrame::Create( owned_render_widget_host_.get(), parent_->GetRenderWidgetHost()->GetScreenInfos()); // The child frame should be created hidden. CHECK(!rwhv->IsShowing()); } if (auto* rwh = GetLocalRenderWidgetHost()) { params->widget_params = rwh->BindAndGenerateCreateFrameWidgetParams(); auto* previous_rfh = lifecycle_state_ == LifecycleStateImpl::kSpeculative ? frame_tree_node_->current_frame_host() : nullptr; if (previous_rfh) { // When migrating a frame to a new/different render process, use the frame // size we already have from the existing RenderFrameHost. if (params->widget_params->visual_properties.new_size_device_px .IsZero()) { params->widget_params->visual_properties.new_size_device_px = previous_rfh->GetFrameSize().value_or(gfx::Size()); } } } mojo::PendingAssociatedRemote pending_frame_remote; params->frame = pending_frame_remote.InitWithNewEndpointAndPassReceiver(); SetMojomFrameRemote(std::move(pending_frame_remote)); // https://crbug.com/1006814. The renderer needs at least one of these tokens // to be able to insert the new frame in the frame tree. CHECK(params->previous_frame_token || params->parent_frame_token); GetAgentSchedulingGroup().CreateFrame(std::move(params)); if (previous_frame_token && previous_frame_token->Is()) { RenderFrameProxyHost* proxy = RenderFrameProxyHost::FromFrameToken( GetProcess()->GetDeprecatedID(), previous_frame_token->GetAs()); // We have also created a `blink::RemoteFrame` in CreateFrame above, so // remember that. CHECK(proxy); proxy->SetRenderFrameProxyCreated(true); } // The renderer now has a RenderFrame for this RenderFrameHost. Note that // this path is only used for out-of-process iframes. Main frame RenderFrames // are created with their RenderView, and same-site iframes are created at the // time of OnCreateChildFrame. RenderFrameCreated(); return true; } void RenderFrameHostImpl::SetMojomFrameRemote( mojo::PendingAssociatedRemote frame_remote) { CHECK(!frame_); frame_.Bind(std::move(frame_remote)); } void RenderFrameHostImpl::DeleteRenderFrame( mojom::FrameDeleteIntention intent) { TRACE_EVENT("navigation", "RenderFrameHostImpl::DeleteRenderFrame", [&](perfetto::EventContext ctx) { WriteRenderFrameImplDeletion(ctx, this, intent); }); base::ScopedUmaHistogramTimer histogram_timer( "Navigation.RenderFrameHostImpl.DeleteRenderFrame"); if (IsPendingDeletion()) { return; } if (IsRenderFrameLive()) { GetMojomFrameInRenderer()->Delete(intent); // We change the lifecycle state to kRunningUnloadHandlers at the end of // this method to wait until OnUnloadACK() is invoked. // For subframes, process shutdown may be delayed for two reasons: // (1) to allow the process to be potentially reused by future navigations // withjin a short time window, and // (2) to give the subframe unload handlers a chance to execute. // TODO(crbug.com/40860307): consider delaying process shutdown for fenced // frames. if (!is_main_frame() && IsActive()) { base::TimeDelta subframe_shutdown_timeout = frame_tree_->IsBeingDestroyed() ? base::TimeDelta() : GetSubframeProcessShutdownDelay( GetSiteInstance()->GetBrowserContext(), memory_limit()); // If this document has unload handlers (and is active), ensure that they // have a chance to execute by delaying process cleanup. This will prevent // the process from shutting down immediately in the case where this is // the last active frame in the process. See https://crbug.com/852204. // Note that in the majority of cases, this is not necessary now that we // keep track of pending delete RenderFrameHost // (https://crbug.com/609963), but there are still a few exceptions where // this is needed (https://crbug.com/1014550). const base::TimeDelta unload_handler_timeout = has_unload_handlers() ? subframe_unload_timeout_ : base::TimeDelta(); if (!subframe_shutdown_timeout.is_zero() || !unload_handler_timeout.is_zero()) { // Release the runner to allow the delay to persist until the fallback // timeout expires. std::ignore = GetProcess() ->DelayProcessShutdown(subframe_shutdown_timeout, unload_handler_timeout, site_instance_->GetSiteInfo()) .Release(); } // If the subframe takes too long to unload, force its removal from the // tree. See https://crbug.com/950625. subframe_unload_timer_.Start( FROM_HERE, subframe_unload_timeout_, this, &RenderFrameHostImpl::OnSubframeDeletionUnloadTimeout); } } // In case of speculative RenderFrameHosts deletion, we don't run any unload // handlers and RenderFrameHost is deleted directly without any lifecycle // state transitions. if (lifecycle_state() == LifecycleStateImpl::kSpeculative) { CHECK(!has_unload_handlers()); return; } // In case of BackForwardCache, page is evicted directly from the cache and // deleted immediately, without waiting for unload handlers. SetLifecycleState(ShouldWaitForUnloadHandlers() ? LifecycleStateImpl::kRunningUnloadHandlers : LifecycleStateImpl::kReadyToBeDeleted); } void RenderFrameHostImpl::RenderFrameCreated() { // In https://crbug.com/1146573 a WebContentsObserver was causing the frame to // be reinitialized during deletion. It is not valid to re-enter navigation // code like that and it led to an invalid state. This is not a CHECK because // the corruption will not be visible until later, making the bug very // difficult to understand. CHECK_NE(render_frame_state_, RenderFrameState::kDeleting); // We should not create new RenderFrames while `frame_tree_` is being // destroyed (e.g., via a WebContentsObserver during WebContents shutdown). // This seems to have caused crashes in https://crbug.com/717650. CHECK(!frame_tree_->IsBeingDestroyed()); CHECK_NE(render_frame_state_, RenderFrameState::kCreated); const RenderFrameState old_render_frame_state = render_frame_state_; render_frame_state_ = RenderFrameState::kCreated; if (old_render_frame_state == RenderFrameState::kDeleted) { // Dispatch update notification when a Page is recreated after a crash. Only // main RenderFrameHosts should ever be reused. CHECK(is_main_frame()); // Only a current RenderFrameHost should be recreating its RenderFrame // here, since speculative and pending deletion RenderFrameHosts get // deleted immediately after crash, whereas prerender gets cancelled and // bfcache entry gets evicted. CHECK_EQ(lifecycle_state(), LifecycleStateImpl::kActive); GetPage().NotifyPageBecameCurrent(); } // Initialize the RenderWidgetHost which marks it and the RenderViewHost as // live before calling to the `delegate_`. RendererWidgetCreated(); // Set up mojo connections to the renderer from the `frame_` connection before // notifying the delegate. SetUpMojoConnection(); delegate_->RenderFrameCreated(this); if (!enabled_bindings_.empty()) { GetFrameBindingsControl()->AllowBindings(enabled_bindings_.ToEnumBitmask()); } if (web_ui_ && enabled_bindings_.Has(BindingsPolicyValue::kWebUi)) { web_ui_->SetUpMojoConnection(); } } void RenderFrameHostImpl::RendererWidgetCreated() { if (GetLocalRenderWidgetHost()) { #if BUILDFLAG(IS_ANDROID) GetLocalRenderWidgetHost()->SetForceEnableZoom( delegate_->GetOrCreateWebPreferences().force_enable_zoom); #endif // BUILDFLAG(IS_ANDROID) GetLocalRenderWidgetHost()->RendererWidgetCreated( /*for_frame_widget=*/true); } } void RenderFrameHostImpl::RenderFrameDeleted() { // In https://crbug.com/1146573 a WebContentsObserver was causing the frame to // be reinitialized during deletion. It is not valid to re-enter navigation // code like that and it led to an invalid state. This is not a CHECK because // the corruption will cause a crash but later, making the bug very // difficult to understand. CHECK_NE(render_frame_state_, RenderFrameState::kDeleting); CHECK(children_.empty()); bool was_created = is_render_frame_created(); render_frame_state_ = RenderFrameState::kDeleting; render_frame_scoped_weak_ptr_factory_.InvalidateWeakPtrs(); // If the current status is different than the new status, the delegate // needs to be notified. if (was_created) { delegate_->RenderFrameDeleted(this); } TearDownMojoConnection(); #if !BUILDFLAG(IS_ANDROID) HostZoomMap* host_zoom_map = HostZoomMap::Get(GetSiteInstance()); host_zoom_map->ClearTemporaryZoomLevel(GetGlobalId()); #endif // !BUILDFLAG(IS_ANDROID) if (web_ui_) { web_ui_->RenderFrameDeleted(); web_ui_->TearDownMojoConnection(); } render_frame_state_ = RenderFrameState::kDeleted; MaybeNotifyDiscardedFrame(); } void RenderFrameHostImpl::SwapIn() { GetAssociatedLocalFrame()->SwapInImmediately(); } void RenderFrameHostImpl::Init() { // This is only called on the main frame, for renderer-created windows. These // windows wait for the renderer to signal that we can show them and begin // navigations. CHECK(is_main_frame()); CHECK(waiting_for_init_); waiting_for_init_ = false; GetLocalRenderWidgetHost()->Init(); if (pending_navigate_) { // `pending_navigate_` is set only by BeginNavigation(), and // BeginNavigation() should only be triggered when the navigation is // initiated by a document in the same process. const ChildProcessId initiator_process_id = GetProcess()->GetID(); // Transfer `pending_navigate_` to a local variable, to avoid resetting it // after OnBeginNavigation since `this` might already be destroyed (see // below). // // This shouldn't matter for early RFH swaps out of crashed frames, since // `pending_navigate_` is cleared when the renderer process dies, but it // may matter for other current/future use cases of the early RFH swap. std::unique_ptr pending_navigation = std::move(pending_navigate_); frame_tree_node()->navigator().OnBeginNavigation( frame_tree_node(), std::move(pending_navigation->common_params_), std::move(pending_navigation->begin_navigation_params_), std::move(pending_navigation->blob_url_loader_factory_), std::move(pending_navigation->navigation_client_), EnsurePrefetchedSignedExchangeCache(), initiator_process_id, std::move(pending_navigation->renderer_cancellation_listener_), std::move( pending_navigation->renderer_ignore_duplicate_navigation_listener_), std::move(pending_navigation->deferred_commit_resume_listener_), pending_navigation->initiator_navigation_state_); // DO NOT ADD CODE after this, as `this` might be deleted if an early // RenderFrameHost swap was performed when starting the navigation above. } } RenderFrameProxyHost* RenderFrameHostImpl::GetProxyToParent() { if (is_main_frame()) { return nullptr; } return browsing_context_state_->GetRenderFrameProxyHost( GetParent()->GetSiteInstance()->group()); } RenderFrameProxyHost* RenderFrameHostImpl::GetProxyToOuterDelegate() { // Precondition:RFH in subframe, in pending deletion, speculative, or in the // BFCache are not expected to access the outer WebContents. CHECK(lifecycle_state_ == LifecycleStateImpl::kActive || lifecycle_state_ == LifecycleStateImpl::kPrerendering); CHECK(is_main_frame()); CHECK(owner_); // See `owner_` invariants about `lifecycle_state_`. return owner_->GetRenderFrameHostManager().GetProxyToOuterDelegate(); } void RenderFrameHostImpl::PropagateEmbeddingTokenToParentFrame() { // Protect against calls from WebContentsImpl::AttachInnerWebContents() that // happen before RFHI::SetEmbeddingToken() gets called, which is where the // token gets set. It's safe to early return in those cases since this method // will get called anyway by RFHI::SetEmbeddingToken(), at which time the // outer delegate for the inner web contents will have been created already. if (!embedding_token_) { return; } // We need to propagate the token to the parent frame if it's either remote or // part of an outer web contents, therefore we need to figure out the right // proxy to send the token to, if any. // For local parents the propagation occurs within the renderer process. The // token is also present on the main frame for generalization when the main // frame in embedded in another context (e.g. browser UI). The main frame is // not embedded in the context of the frame tree so it is not propagated here. // See RenderFrameHost::GetEmbeddingToken for more details. RenderFrameProxyHost* target_render_frame_proxy = nullptr; if (RequiresProxyToParent()) { // This subframe should have a remote parent frame. target_render_frame_proxy = GetProxyToParent(); CHECK(target_render_frame_proxy); } else if (is_main_frame()) { // The main frame in an inner web contents could have a delegate in the // outer web contents, so we need to account for that as well. target_render_frame_proxy = GetProxyToOuterDelegate(); } // Propagate the token to the right process, if a proxy was found. if (target_render_frame_proxy && target_render_frame_proxy->is_render_frame_proxy_live()) { target_render_frame_proxy->GetAssociatedRemoteFrame()->SetEmbeddingToken( embedding_token_.value()); } } void RenderFrameHostImpl::OnMediaStreamAdded(MediaStreamType type) { int& media_stream_count = media_stream_counts_[type]; CHECK_NE(media_stream_count, std::numeric_limits::max()); ++media_stream_count; // Only notify on the first media stream, as the delegate only care about the // existence of at least 1 stream, but not the exact count. if (media_stream_count == 1) { switch (type) { case MediaStreamType::kCapturingMediaStream: GetProcess()->OnMediaStreamAdded(); delegate_->OnFrameIsCapturingMediaStreamChanged(this, true); break; case GetAudibleMediaStreamType(): // TODO(https://crbug.com/526541279): CHECK-exclusion: Convert to CHECK // once we are sure this isn't hit. DCHECK_NE(lifecycle_state(), LifecycleStateImpl::kPrerendering); GetProcess()->OnMediaStreamAdded(); delegate_->OnFrameAudioStateChanged(this, true); break; default: break; } } } void RenderFrameHostImpl::OnMediaStreamRemoved(MediaStreamType type) { int& media_stream_count = media_stream_counts_[type]; CHECK(media_stream_count); --media_stream_count; // Only notify the delegate if this is the last media stream that was removed // to match the behavior in `OnMediaStreamAdded`. if (media_stream_count == 0) { switch (type) { case MediaStreamType::kCapturingMediaStream: GetProcess()->OnMediaStreamRemoved(); delegate_->OnFrameIsCapturingMediaStreamChanged(this, false); break; case GetAudibleMediaStreamType(): GetProcess()->OnMediaStreamRemoved(); delegate_->OnFrameAudioStateChanged(this, false); break; default: break; } } } bool RenderFrameHostImpl::HasMediaStreams(MediaStreamType type) const { return media_stream_counts_[type] > 0; } void RenderFrameHostImpl::DidAddMessageToConsole( blink::mojom::ConsoleMessageLevel log_level, const std::u16string& message, uint32_t line_no, const std::optional& source_id, const std::optional& untrusted_stack_trace) { std::u16string updated_source_id; if (source_id.has_value()) { updated_source_id = *source_id; } if (delegate_->DidAddMessageToConsole(this, log_level, message, line_no, updated_source_id, untrusted_stack_trace)) { return; } // Pass through log severity only on builtin components pages to limit console // spew. const bool is_web_ui = HasWebUIScheme(GetMainFrame()->GetLastCommittedURL()); if (is_web_ui) { CHECK_EQ(GetMainFrame(), GetOutermostMainFrame()) << "The mainframe and outermost mainframe should be the same in WebUI."; } const bool is_builtin_component = is_web_ui || GetContentClient()->browser()->IsBuiltinComponent( GetProcess()->GetBrowserContext(), GetLastCommittedOrigin()); const bool is_off_the_record = GetSiteInstance()->GetBrowserContext()->IsOffTheRecord(); LogConsoleMessage(log_level, message, line_no, is_builtin_component, is_off_the_record, updated_source_id); } void RenderFrameHostImpl::FrameSizeChanged(const gfx::Size& frame_size) { frame_size_ = frame_size; delegate_->FrameSizeChanged(this, frame_size); } void RenderFrameHostImpl::RendererDidActivateForPrerendering() { // RendererDidActivateForPrerendering() is called after the renderer has // notified that it fired the prerenderingchange event on the documents. The // browser now runs any binders that were deferred during prerendering. This // corresponds to the following steps of the activate algorithm: // // https://wicg.github.io/nav-speculation/prerendering.html#prerendering-browsing-context-activate // Step 8.3.4. "For each steps in doc's post-prerendering activation steps // list:" // Step 8.3.4.1. "Run steps." // Release Mojo capability control to run the binders. The RenderFrameHostImpl // may have been created after activation started, in which case it already // does not have Mojo capability control applied. if (mojo_binder_policy_applier_) { mojo_binder_policy_applier_->GrantAll(); // As per `ReleaseMojoBinderPolicies` method requirement, the policy applier // owner should call the method when destroying the object, so we first // need to call this method before resetting the unique pointer. CHECK(broker_holder_); broker_holder_->broker().ReleaseMojoBinderPolicies(); mojo_binder_policy_applier_.reset(); } } void RenderFrameHostImpl::SetCrossOriginOpenerPolicyReporter( std::unique_ptr coop_reporter) { coop_access_report_manager_.set_coop_reporter(std::move(coop_reporter)); } bool RenderFrameHostImpl::IsCredentialless() const { return policy_container_host_ && policy_container_host_->policies().is_credentialless; } bool RenderFrameHostImpl::IsLastCrossDocumentNavigationStartedByUser() const { return last_cross_document_navigation_started_by_user_; } std::vector> RenderFrameHostImpl::GetPendingCommitCrossDocumentNavigations() const { // Obtain the NavigationHandles corresponding to each of pending // cross-document navigations for this RenderFrameHostImpl. std::vector> handles; for (const auto& request : navigation_requests_) { handles.push_back(request.first->GetSafeRef()); } return handles; } void RenderFrameHostImpl::OnCreateChildFrame( int new_routing_id, mojo::PendingAssociatedRemote frame_remote, mojo::PendingReceiver browser_interface_broker_receiver, blink::mojom::PolicyContainerBindParamsPtr policy_container_bind_params, mojo::PendingAssociatedReceiver associated_interface_provider_receiver, blink::mojom::TreeScopeType scope, const std::string& frame_name, const std::string& frame_unique_name, bool is_created_by_script, const blink::LocalFrameToken& frame_token, const base::UnguessableToken& devtools_frame_token, const blink::DocumentToken& document_token, const blink::FramePolicy& frame_policy, const blink::mojom::FrameOwnerProperties& frame_owner_properties, blink::FrameOwnerElementType owner_type, ukm::SourceId document_ukm_source_id, std::unique_ptr sandbox_origin_token) { // TODO(lukasza): Call ReceivedBadMessage when |frame_unique_name| is empty. CHECK(!frame_unique_name.empty()); CHECK(browser_interface_broker_receiver.is_valid()); CHECK(policy_container_bind_params->receiver.is_valid()); CHECK(associated_interface_provider_receiver.is_valid()); CHECK(devtools_frame_token); // The RenderFrame corresponding to this host sent an IPC message to create a // child, but by the time we get here, it's possible for its process to have // disconnected (maybe due to browser shutdown). Ignore such messages. if (!is_render_frame_created()) { return; } // Only active and prerendered documents are allowed to create child // frames. if (lifecycle_state() != LifecycleStateImpl::kPrerendering) { // The RenderFrame corresponding to this host sent an IPC message to create // a child, but by the time we get here, it's possible for the // RenderFrameHost to become inactive. Ignore such messages. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kCreateChildFrame)) { return; } } // The placeholder frame for an inner frame tree (e.g., an attached // GuestView, fenced frame) must never have its own local children, since // the inner tree's main frame is treated as this frame's only child during // FrameTree iteration. This message could only have been sent before the // renderer processed the corresponding Unload IPC, so just drop it. See // https://crbug.com/518078552. if (inner_tree_main_frame_tree_node_id_) { return; } // `new_routing_id`, `frame_token`, `devtools_frame_token` and // `document_token` were generated on the browser's IO thread and not taken // from the renderer process. frame_tree_->AddFrame( this, GetProcess()->GetDeprecatedID(), new_routing_id, std::move(frame_remote), std::move(browser_interface_broker_receiver), std::move(policy_container_bind_params), std::move(associated_interface_provider_receiver), scope, frame_name, frame_unique_name, is_created_by_script, frame_token, devtools_frame_token, document_token, frame_policy, frame_owner_properties, was_discarded_, owner_type, /*is_dummy_frame_for_inner_tree=*/false, std::move(sandbox_origin_token)); } void RenderFrameHostImpl::OnPreloadingHeuristicsModelDone(const GURL& url, float score) { if (auto* preloading_decider = PreloadingDecider::GetOrCreateForCurrentDocument(this)) { preloading_decider->OnPreloadingHeuristicsModelDone(url, score); } } void RenderFrameHostImpl::CreateChildFrame( const blink::LocalFrameToken& frame_token, mojo::PendingAssociatedRemote frame_remote, mojo::PendingReceiver browser_interface_broker_receiver, blink::mojom::PolicyContainerBindParamsPtr policy_container_bind_params, mojo::PendingAssociatedReceiver associated_interface_provider_receiver, blink::mojom::TreeScopeType scope, const std::string& frame_name, const std::string& frame_unique_name, bool is_created_by_script, const blink::FramePolicy& frame_policy, blink::mojom::FrameOwnerPropertiesPtr frame_owner_properties, blink::FrameOwnerElementType owner_type, ukm::SourceId document_ukm_source_id) { int new_routing_id = IPC::mojom::kRoutingIdNone; base::UnguessableToken devtools_frame_token; blink::DocumentToken document_token; // The sandbox_origin_token was stored by the browser process when it // pre-allocated the frame routing IDs, and also sent to the renderer in // `FrameRoutingInfo`. Both browser and renderer use this token to // deterministically generate identical opaque origins for the new frame's // initial empty document. It is passed directly to // `SetOriginDependentStateOfNewFrame()` (via `AddChild()`). std::unique_ptr sandbox_origin_token; if (!static_cast(GetProcess()) ->TakeStoredDataForFrameToken(frame_token, new_routing_id, devtools_frame_token, document_token, sandbox_origin_token)) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_CREATE_CHILD_FRAME_TOKENS_NOT_FOUND); return; } // Documents create iframes, iframes host new documents. Both are associated // with sandbox flags. They are required to be stricter or equal to their // owner when they are created, as we go down. if (frame_policy.sandbox_flags != (frame_policy.sandbox_flags | active_sandbox_flags())) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_CREATE_CHILD_FRAME_SANDBOX_FLAGS); return; } // TODO(crbug.com/40155982). The interface exposed to tests should // match the mojo interface. OnCreateChildFrame(new_routing_id, std::move(frame_remote), std::move(browser_interface_broker_receiver), std::move(policy_container_bind_params), std::move(associated_interface_provider_receiver), scope, frame_name, frame_unique_name, is_created_by_script, frame_token, devtools_frame_token, document_token, frame_policy, *frame_owner_properties, owner_type, document_ukm_source_id, std::move(sandbox_origin_token)); } void RenderFrameHostImpl::DidNavigate( const mojom::DidCommitProvisionalLoadParams& params, NavigationRequest* navigation_request, bool was_within_same_document) { // The `url` and `origin` of the current document are stored in the // RenderFrameHost, because: // - The FrameTreeNode represents the frame. // - The RenderFrameHost represents a document hosted inside the frame. // // The URL is set regardless of whether it's for a net error or not. SetLastCommittedUrl(params.url); // The origin is only updated for cross-document navigations. if (!was_within_same_document || !features::IsEnforceSameDocumentOriginInvariantsEnabled()) { SetLastCommittedOrigin(params.origin); } // If the navigation was a cross-document navigation and it's not the // synchronous about:blank commit, then it committed a document that is not // the initial empty document. if (!navigation_request->IsSameDocument() && (!navigation_request->is_synchronous_renderer_commit() || !navigation_request->GetURL().IsAboutBlank())) { navigation_request->frame_tree_node()->set_not_on_initial_empty_document(); } if (lifecycle_state_ == LifecycleStateImpl::kActive) { // The NIK might change after this, so decrement the count for the current // NIK. GetStoragePartition()->DecrementActiveDocumentCount( GetNetworkIsolationKey()); } isolation_info_ = ComputeIsolationInfoInternal( GetLastCommittedOrigin(), isolation_info_.request_type(), navigation_request->is_credentialless(), navigation_request->ComputeFencedFrameNonce()); if (lifecycle_state_ == LifecycleStateImpl::kActive) { // The NIK might have changed after the above call, so increment the count // for the new NIK. GetStoragePartition()->IncrementActiveDocumentCount( GetNetworkIsolationKey()); } // Separately, update the frame's last successful URL except for net error // pages, since those do not end up in the correct process after transfers // (see https://crbug.com/560511). Instead, the next cross-process navigation // or transfer should decide whether to swap as if the net error had not // occurred. // TODO(creis): Remove this block and always set the URL. // See https://crbug.com/588314. if (!navigation_request->DidEncounterError()) { last_successful_url_ = params.url; navigation_request->frame_tree_node()->set_last_successful_origin( GetLastCommittedOrigin()); } renderer_url_info_.last_document_url = GetLastDocumentURL( navigation_request, params, is_error_document_, renderer_url_info_); // Set the last committed HTTP method and POST ID. Note that we're setting // this here instead of in DidCommitNewDocument because same-document // navigations triggered by the History API (history.replaceState/pushState) // will reset the method to "GET" (while fragment navigations won't). // TODO(arthursonzogni): Stop relying on DidCommitProvisionalLoadParams. Use // the NavigationRequest instead. The browser process doesn't need to rely on // the renderer process. last_http_method_ = params.method; last_post_id_ = params.post_id; // TODO(arthursonzogni): Stop relying on DidCommitProvisionalLoadParams. Use // the NavigationRequest instead. The browser process doesn't need to rely on // the renderer process. last_http_status_code_ = params.http_status_code; // Sets whether the last navigation has user gesture/transient activation or // not. last_committed_common_params_has_user_gesture_ = navigation_request->common_params().has_possibly_filtered_user_gesture; // Sets whether the last cross-document navigation was initiated from the // browser (e.g. typing on the location bar) or from the renderer while having // transient user activation if (!was_within_same_document) { last_cross_document_navigation_started_by_user_ = !navigation_request->IsRendererInitiated() || navigation_request->StartedWithTransientActivation(); } // Navigations that activate an existing bfcached or prerendered document do // not create a new document. bool did_create_new_document = !navigation_request->IsPageActivation() && !was_within_same_document; if (did_create_new_document) { DidCommitNewDocument(params, navigation_request); } // When the frame hosts a different document, its state must be replicated // via its proxies to the other processes where it appears as remote. // // This includes new documents. It also includes documents restored from the // BackForwardCache. This is because the cached state in // BrowsingContextState::replication_state_ needs to be refreshed with the // actual values. if (!navigation_request->IsSameDocument()) { // Permissions policy's inheritance from parent frame's permissions policy // is through accessing parent frame's security context(either remote or // local) when initializing child's security context, so the update to // proxies is needed. browsing_context_state_->UpdateFramePolicyHeaders( active_sandbox_flags(), permissions_policy_header_); // Document policy's inheritance from parent frame's required document // policy is done at |HTMLFrameOwnerElement::UpdateRequiredPolicy|. Parent // frame owns both parent's required document policy and child frame's frame // owner element which contains child's required document policy, so there // is no need to store required document policy in proxies. } // Set `honor_sticky_activation_for_history_intervention_` to false if // it's a browser-initiated same-document back/forward navigation. // Note that `honor_sticky_activation_for_history_intervention_` is only // tracked on the main frame so that same-document navigations on a child // frame cannot be used as a work-around to the intervention. // navigation_request->GetPageTransition only returns the bit set for // PAGE_TRANSITION_FORWARD_BACK for back/forward transitions on the main // frame so retrieve it from the pending entry instead of the // navigation_request. Also navigation_request->IsSameDocument // won't be true for the subframe's cross-document back/forward navigation // case so instead check GetMainFrameDocumentSequenceNumber(). // TODO(creis): Add NavigationRequest::IsSessionHistory() and // NavigationRequest::IsSamePage() to avoid needing to check either the // pending NavigationEntry or the PageTransition. NavigationControllerImpl& controller = frame_tree()->controller(); NavigationEntryImpl* pending_entry = controller.GetPendingEntry(); // pending_entry should be non-nullptr for a back/forward navigation. if (pending_entry) { ui::PageTransition transition = pending_entry->GetTransitionType(); if (transition & ui::PAGE_TRANSITION_FORWARD_BACK && navigation_request->browser_initiated() && pending_entry->GetMainFrameDocumentSequenceNumber() == controller.GetLastCommittedEntry() ->GetMainFrameDocumentSequenceNumber()) { GetMainFrame()->honor_sticky_activation_for_history_intervention_ = false; } // After a navigation there is no need to map the renderer's AXNodeIds to // unique ids within the WebContents. ax_unique_ids_.clear(); } } void RenderFrameHostImpl::SetLastCommittedOrigin(const url::Origin& origin) { last_committed_origin_ = origin; const url::SchemeHostPort& precursor = origin.GetTupleOrPrecursorTupleIfOpaque(); bool is_potentially_trustworthy_unique_origin = origin.opaque() && precursor.IsValid() && network::IsUrlPotentiallyTrustworthy(precursor.GetURL()); browsing_context_state()->SetCurrentOrigin( origin, is_potentially_trustworthy_unique_origin); } void RenderFrameHostImpl::SetInheritedBaseUrl(const GURL& inherited_base_url) { inherited_base_url_ = inherited_base_url; } void RenderFrameHostImpl::SetLastCommittedOriginForTesting( const url::Origin& origin) { SetLastCommittedOrigin(origin); } const url::Origin& RenderFrameHostImpl::ComputeTopFrameOrigin( const url::Origin& frame_origin) const { if (is_main_frame()) { return frame_origin; } CHECK(parent_); // It's important to go through parent_ rather than via // frame_free_->root() here in case we're in process of being deleted, as the // latter might point to what our ancestor is being replaced with rather than // the actual ancestor. RenderFrameHostImpl* host = parent_; while (host->parent_) { host = host->parent_; } return host->GetLastCommittedOrigin(); } void RenderFrameHostImpl::SetStorageKey(const blink::StorageKey& storage_key) { storage_key_ = storage_key; } net::IsolationInfo RenderFrameHostImpl::ComputeIsolationInfoForNavigation( const GURL& destination) { return ComputeIsolationInfoForNavigation( destination, IsCredentialless(), /*fenced_frame_nonce_for_navigation=*/std::nullopt); } net::IsolationInfo RenderFrameHostImpl::ComputeIsolationInfoForNavigation( const GURL& destination, bool is_credentialless, std::optional fenced_frame_nonce_for_navigation) { net::IsolationInfo::RequestType request_type = is_main_frame() ? net::IsolationInfo::RequestType::kMainFrame : net::IsolationInfo::RequestType::kSubFrame; return ComputeIsolationInfoInternal(url::Origin::Create(destination), request_type, is_credentialless, fenced_frame_nonce_for_navigation); } net::IsolationInfo RenderFrameHostImpl::ComputeIsolationInfoForSubresourcesForPendingCommit( const url::Origin& main_world_origin, bool is_credentialless, std::optional fenced_frame_nonce_for_navigation) { return ComputeIsolationInfoInternal( main_world_origin, net::IsolationInfo::RequestType::kOther, is_credentialless, fenced_frame_nonce_for_navigation); } net::SiteForCookies RenderFrameHostImpl::ComputeSiteForCookies() { return isolation_info_.site_for_cookies(); } net::IsolationInfo RenderFrameHostImpl::ComputeIsolationInfoInternal( const url::Origin& frame_origin, net::IsolationInfo::RequestType request_type, bool is_credentialless, std::optional fenced_frame_nonce_for_navigation) { url::Origin top_frame_origin = ComputeTopFrameOrigin(frame_origin); // When this frame is inside a MIME handler extension subtree, the // extension acts as the effective top-level for IsolationInfo. Applies // both to the extension subframe itself and to any iframe nested // inside it. When `this` is the effective top, use the pending // `frame_origin` rather than the last committed origin: the MIME // handler stream is registered against the frame tree node before the // extension URL commits, so during the extension frame's own // navigation `GetLastCommittedOrigin()` still returns the initial // about:blank inherited from the embedder. RenderFrameHostImpl* effective_top_for_isolation = nullptr; if (RenderFrameHost* effective_top = GetContentClient()->browser()->GetEffectiveTopFrameForPartitioning( this)) { effective_top_for_isolation = static_cast(effective_top); top_frame_origin = (effective_top_for_isolation == this) ? frame_origin : effective_top_for_isolation->GetLastCommittedOrigin(); } net::SchemefulSite top_frame_site = net::SchemefulSite(top_frame_origin); net::SiteForCookies candidate_site_for_cookies(top_frame_site); std::optional candidate_frame_ancestor_relation = net::IsolationInfo::FrameAncestorRelation::kSameOrigin; // Walk up the frame tree to check SiteForCookies and FrameAncestorRelation. // // If |request_type| is kOther, then IsolationInfo is being computed // for subresource requests. Check/compute starting from the frame itself. // Otherwise, it's OK to skip checking the frame itself since it's stored in // IsolationInfo for each request and will be validated later anyway. // // If origins are not consistent with the candidate SiteForCookies // of the main document, SameSite cookies may not be used. const RenderFrameHostImpl* initial_rfh = this; if (request_type != net::IsolationInfo::RequestType::kOther) { initial_rfh = this->parent_; } for (const RenderFrameHostImpl* rfh = initial_rfh; rfh; rfh = rfh->parent_) { // If the effective top frame was overridden for a MIME handler // extension, stop walking at the extension frame's parent. Overriding // `top_frame_origin` alone is not enough: this loop also computes // `candidate_frame_ancestor_relation` over all visited ancestors, and // including the cross-site embedder would force kCrossSite even though // the override declares the extension as the effective top. if (effective_top_for_isolation && rfh == effective_top_for_isolation->parent_) { break; } const url::Origin& cur_origin = rfh == this ? frame_origin : rfh->last_committed_origin_; net::SchemefulSite cur_site = net::SchemefulSite(cur_origin); candidate_frame_ancestor_relation = net::IsolationInfo::ComputeNewFrameAncestorRelation( candidate_frame_ancestor_relation, cur_origin, top_frame_origin); candidate_site_for_cookies.CompareWithFrameTreeSiteAndRevise(cur_site); } // Reset the SiteForCookies if the top frame origin should always be treated // as the SiteForCookies. if (GetContentClient()->browser()->ShouldTreatAsFirstPartyWhenTopLevel( top_frame_origin, GURL::SchemeIsCryptographic(frame_origin.scheme()))) { candidate_site_for_cookies = net::SiteForCookies(top_frame_site); } std::optional nonce = ComputeNonce(is_credentialless, fenced_frame_nonce_for_navigation); return net::IsolationInfo::Create( request_type, top_frame_origin, frame_origin, candidate_site_for_cookies, nonce, net::NetworkIsolationPartition::kGeneral, candidate_frame_ancestor_relation); } std::optional RenderFrameHostImpl::ComputeNonce( bool is_credentialless, std::optional fenced_frame_nonce_for_navigation) { // If it's a credentialless frame tree, use its nonce even if it's within a // fenced frame tree to maintain the guarantee that a credentialless frame // tree has a unique nonce. if (is_credentialless) { return GetPage().credentialless_iframes_nonce(); } // Otherwise, use the fenced frame nonce for this navigation. // If this call is for a pending navigation, the fenced frame nonce should // have been computed with `NavigationRequest::ComputeFencedFrameNonce()` and // passed in `fenced_frame_nonce_for_navigation`. If there is no navigation // associated with this call, then we get the nonce from this RFHI's // FrameTreeNode with FrameTreeNode::GetFencedFrameNonce(). if (fenced_frame_nonce_for_navigation.has_value()) { return fenced_frame_nonce_for_navigation; } return frame_tree_node_->GetFencedFrameNonce(); } bool RenderFrameHostImpl::IsThirdPartyStoragePartitioningEnabled( const url::Origin& new_rfh_origin) { const std::vector ancestor_chain = GetAncestorChainForStorageKeyCalculation(new_rfh_origin); RenderFrameHostImpl* main_frame_for_storage_partitioning = ancestor_chain.back(); // If we're in the main frame the state of third-party storage partitioning // doesn't matter as the StorageKey will be first-party. if (main_frame_for_storage_partitioning == this) { return false; } return blink::StorageKey::IsThirdPartyStoragePartitioningEnabled(); } std::vector RenderFrameHostImpl::GetAncestorChainForStorageKeyCalculation( const url::Origin& new_rfh_origin) { // If the effective top frame was overridden for a MIME handler // extension, stop walking at that frame. `top_level_site` and // `ancestor_chain_bit` below are derived from the last entry and the // entries between `this` and the top, so leaving the embedder in the // chain would force the descendant's StorageKey to use the embedder // as top_level_site instead of the extension. auto* effective_top_for_storage_key = static_cast( GetContentClient()->browser()->GetEffectiveTopFrameForPartitioning(this)); std::vector ancestor_chain; RenderFrameHostImpl* current = this; while (current) { ancestor_chain.push_back(current); if (current == effective_top_for_storage_key) { break; } current = current->parent_; } // Make sure to always use the `new_rfh_origin` when referring to the current // RenderFrameHost. The origin might differ when the RenderFrameHost is reused // when SiteIsolation is off. auto origin = [&](RenderFrameHostImpl* rfh) { return rfh == this ? new_rfh_origin : rfh->GetLastCommittedOrigin(); }; // When the top level RenderFrameHost is a Chrome extension, with host // permissions to its child in the ancestor chain, then behave "as-if" the // child was the top-level one computing the StorageKey. // // https://github.com/wanderview/quota-storage-partitioning/blob/main/explainer.md#interaction-with-extension-pages // // Sites with host permissions are saved in // `browser_context->GetSharedCorsOriginAccessList()` because they are also // used to bypass CORS restrictions. We can reuse this permissions list here // because sites that are explicitly granted access permissions should also be // able to access partitioned storage based not partitioned by the top level // extension URL. A origin will only have access to another origin via // OriginAccessList if the origin is an extension. // The size guard protects `ancestor_chain.end()[-2]` from a // single-element chain when `this` is itself the MIME handler // effective top. bool ignore_top_level_extension = !is_main_frame() && ancestor_chain.size() >= 2 && GetBrowserContext() ->GetSharedCorsOriginAccessList() ->GetOriginAccessList() .CheckAccessState(origin(ancestor_chain.end()[-1]), origin(ancestor_chain.end()[-2]).GetURL()) == network::cors::OriginAccessList::AccessState::kAllowed; if (ignore_top_level_extension) { ancestor_chain.pop_back(); } return ancestor_chain; } blink::StorageKey RenderFrameHostImpl::CalculateStorageKey( const url::Origin& new_rfh_origin, const base::UnguessableToken* nonce) { if (nonce) { // If the nonce isn't null, we can use the simpler form of the constructor. return blink::StorageKey::CreateWithNonce(new_rfh_origin, *nonce); } if (GetContentClient()->browser()->ShouldUseFirstPartyStorageKey( new_rfh_origin)) { // Extension subframes should not take their top-level site into account // when determining storage access. Thus, we construct all extension frame // StorageKeys as first-party using the extension origin. return blink::StorageKey::CreateFirstParty(new_rfh_origin); } const std::vector ancestor_chain = GetAncestorChainForStorageKeyCalculation(new_rfh_origin); // Make sure to always use the `new_rfh_origin` when referring to the current // RenderFrameHost. The origin might differ when the RenderFrameHost is reused // when SiteIsolation is off. auto origin = [&](RenderFrameHostImpl* rfh) { return rfh == this ? new_rfh_origin : rfh->GetLastCommittedOrigin(); }; net::SchemefulSite top_level_site(origin(ancestor_chain.back())); // Compute the AncestorChainBit. It represents whether every ancestors are // all same-site or not. If `origin` or `top_level_site` is opaque the bit // must be kCrossSite as this is the default (which won't be serialized). blink::mojom::AncestorChainBit ancestor_chain_bit = blink::mojom::AncestorChainBit::kSameSite; if (!new_rfh_origin.opaque() && !top_level_site.opaque()) { for (auto* ancestor : ancestor_chain) { if (!top_level_site.IsSameSiteWith(origin(ancestor))) { ancestor_chain_bit = blink::mojom::AncestorChainBit::kCrossSite; break; } } } else { ancestor_chain_bit = blink::mojom::AncestorChainBit::kCrossSite; } // We want the RuntimeFeatureStateReadContext from the effective main frame // (keeping in mind `ignore_top_level_extension`). bool is_third_party_storage_partitioning_allowed = IsThirdPartyStoragePartitioningEnabled(new_rfh_origin); return blink::StorageKey::Create(new_rfh_origin, top_level_site, ancestor_chain_bit, is_third_party_storage_partitioning_allowed); } void RenderFrameHostImpl::SetOriginDependentStateOfNewFrame( RenderFrameHostImpl* creator_frame, std::unique_ptr sandbox_origin_token) { // This method should only be called for *new* frames, that haven't committed // a navigation yet. CHECK(!has_committed_any_navigation_); CHECK(GetLastCommittedOrigin().opaque()); url::Origin creator_origin = creator_frame ? creator_frame->GetLastCommittedOrigin() : url::Origin(); // Calculate and set |new_frame_origin|. bool new_frame_should_be_sandboxed = network::mojom::WebSandboxFlags::kOrigin == (browsing_context_state_->active_sandbox_flags() & network::mojom::WebSandboxFlags::kOrigin); url::Origin new_frame_origin; if (base::FeatureList::IsEnabled( blink::features::kUseSandboxTokenForOriginDerivation)) { if (new_frame_should_be_sandboxed) { if (sandbox_origin_token) { // Child iframes always receive a token during creation, so verify // we are in a child iframe. CHECK(parent_); last_sandbox_origin_token_for_testing_ = *sandbox_origin_token; new_frame_origin = content::SandboxedOpaqueOriginCreator:: CreateOriginForSandboxedFrame( base::PassKey(), *sandbox_origin_token, creator_origin.GetTupleOrPrecursorTupleIfOpaque()); } else { // When no sandbox origin token is provided for a sandboxed window, // generate one now and use it to create the sandboxed origin. This // only happens for renderer-initiated top-level windows // (window.open()). Child iframes always receive a token during // creation, so verify we're not in the child iframe path. CHECK(!parent_); auto token = std::make_unique( base::UnguessableToken::Create()); last_sandbox_origin_token_for_testing_ = *token; new_frame_origin = content::SandboxedOpaqueOriginCreator:: CreateOriginForSandboxedFrame( base::PassKey(), *token, creator_origin.GetTupleOrPrecursorTupleIfOpaque()); GetPage().SetSandboxOriginTokenForPopup(std::move(token)); } } else { new_frame_origin = creator_origin; } } else { new_frame_origin = new_frame_should_be_sandboxed ? creator_origin.DeriveNewOpaqueOrigin() : creator_origin; } isolation_info_ = ComputeIsolationInfoInternal( new_frame_origin, net::IsolationInfo::RequestType::kOther, IsCredentialless(), /*fenced_frame_nonce_for_navigation=*/std::nullopt); if (lifecycle_state_ == LifecycleStateImpl::kActive) { // Increment the document count if the newly created RenderFrameHost is // active. Note that it's necessary to check if we're active, since // prerendering RFHs can also call this function. GetStoragePartition()->IncrementActiveDocumentCount( GetNetworkIsolationKey()); } SetLastCommittedOrigin(new_frame_origin); if (!creator_frame || !creator_frame->is_error_document_) { frame_tree_node()->set_last_successful_origin(new_frame_origin); } if (creator_frame) { // The initial empty document inherits insecure request state from its // parent or opener. const blink::mojom::FrameReplicationState& creator_replication_state = creator_frame->browsing_context_state()->current_replication_state(); browsing_context_state_->SetInsecureRequestPolicy( creator_replication_state.insecure_request_policy); browsing_context_state_->SetInsecureNavigationsSet( creator_replication_state.insecure_navigations_set); // If we're given a parent/opener frame, copy the // RuntimeFeatureStateReadContext. RuntimeFeatureStateDocumentData* rfs_document_data_from_creator = RuntimeFeatureStateDocumentData::GetForCurrentDocument(creator_frame); CHECK(rfs_document_data_from_creator); RuntimeFeatureStateDocumentData::CreateForCurrentDocument( this, rfs_document_data_from_creator->runtime_feature_state_read_context()); } else { // Otherwise create a RuntimeFeatureStateContext. We need to construct a // RuntimeFeatureStateContext because its constructor initializes default // values while the RuntimeFeatureStateReadContext's doesn't. RuntimeFeatureStateDocumentData::CreateForCurrentDocument( this, blink::RuntimeFeatureStateContext()); } // For the StorageKey, we want the main frame's // RuntimeFeatureStateReadContext. SetStorageKey(CalculateStorageKey( new_frame_origin, base::OptionalToPtr(isolation_info_.nonce()))); // Apply private network request policy according to our new origin. // TODO(crbug.com/452389539): Centralize these policy overrides. switch (GetContentClient() ->browser() ->ShouldOverrideLocalNetworkAccessRequestPolicy( GetBrowserContext(), new_frame_origin)) { case ContentBrowserClient::LocalNetworkAccessRequestPolicyOverride:: kForceAllow: local_network_access_request_policy_ = network::mojom::LocalNetworkAccessRequestPolicy::kAllow; break; case ContentBrowserClient::LocalNetworkAccessRequestPolicyOverride:: kBlockInsteadOfWarn: local_network_access_request_policy_ = OverrideToBlockInsteadOfWarn(DeriveLocalNetworkAccessRequestPolicy( policy_container_host_->policies(), LocalNetworkAccessRequestContext::kSubresource)); break; case ContentBrowserClient::LocalNetworkAccessRequestPolicyOverride:: kWarnInsteadOfBlock: local_network_access_request_policy_ = OverrideToWarnInsteadOfBlock(DeriveLocalNetworkAccessRequestPolicy( policy_container_host_->policies(), LocalNetworkAccessRequestContext::kSubresource)); break; case ContentBrowserClient::LocalNetworkAccessRequestPolicyOverride:: kDefault: break; } // Construct the frame's permissions policy only once we know its initial // committed origin. It's necessary to wait for the origin because the // permissions policy's state depends on the origin, so the PermissionsPolicy // object could be configured incorrectly if it were initialized before // knowing the value of |last_committed_origin_|. More at crbug.com/1112959. ResetPermissionsPolicy({}); // New empty frames created on error page documents are also considered error // documents. Otherwise, site isolation enforcements would get confused by a // non-error document attempting to do things in an error process. Error pages // do not normally have subframes (or do window.open, which would also go // through here), but it's possible to inject new frames into error pages via // DevTools, for example. if (creator_frame) { is_error_document_ = creator_frame->is_error_document_; } } FrameTreeNode* RenderFrameHostImpl::AddChild( std::unique_ptr child, int frame_routing_id, mojo::PendingAssociatedRemote frame_remote, const blink::LocalFrameToken& frame_token, const blink::DocumentToken& document_token, base::UnguessableToken devtools_frame_token, const blink::FramePolicy& frame_policy, std::string frame_name, std::string frame_unique_name, std::unique_ptr sandbox_origin_token) { CHECK(lifecycle_state_ == LifecycleStateImpl::kActive || lifecycle_state_ == LifecycleStateImpl::kPrerendering); // Initialize the RenderFrameHost for the new node. We always create child // frames in the same SiteInstance as the current frame, and they can swap to // a different one if they navigate away. child->render_manager()->InitChild( GetSiteInstance(), frame_routing_id, std::move(frame_remote), frame_token, document_token, devtools_frame_token, frame_policy, frame_name, frame_unique_name); // Other renderer processes in this BrowsingInstance may need to find out // about the new frame. Create a proxy for the child frame in all // SiteInstances that have a proxy for the frame's parent, since all frames // in a frame tree should have the same set of proxies. CHECK(owner_); // See `owner_` invariants about `lifecycle_state_`. owner_->GetRenderFrameHostManager().CreateProxiesForChildFrame(child.get()); // When the child is added, it hasn't committed any navigation yet - its // initial empty document should inherit the origin (the origin may change // after the first commit) and other state (such as the // RuntimeFeatureStateReadContext) from its parent. See also // https://crbug.com/932067. child->current_frame_host()->SetOriginDependentStateOfNewFrame( this, std::move(sandbox_origin_token)); children_.push_back(std::move(child)); return children_.back().get(); } void RenderFrameHostImpl::RemoveChild(FrameTreeNode* child) { for (auto iter = children_.begin(); iter != children_.end(); ++iter) { if (iter->get() == child) { // Subtle: we need to make sure the node is gone from the tree before // observers are notified of its deletion. std::unique_ptr node_to_delete(std::move(*iter)); children_.erase(iter); // TODO(dcheng): Removing a subtree is still very piecemeal and somewhat // buggy. The entire subtree should be removed as a group, but it can // actually happen incrementally. For example, given the frame tree: // // A1(A2(B3(A4(B5)))) // // // Suppose A1 executes: // // window.frames[0].frameElement.remove(); // // What ends up happening is this: // // 1. Renderer A detaches the subtree beginning at A2. // 2. Renderer A starts detaching A2. // 3. Renderer A starts detaching B3. // 4. Renderer A starts detaching A4. // 5. Renderer A starts detaching B5 // 6. Renderer A reports B5 is complete detaching with the Mojo IPC // `RenderFrameProxyHost::Detach()`, which calls // `RenderFrameHostImpl::DetachFromProxy()`. `DetachFromProxy()` // deletes RenderFrame B5 in renderer B, which means that the unload // handler for B5 runs immediately--before the unload handler for B3. // However, per the spec, the right order to run unload handlers is // top-down (e.g. B3's unload handler should run before B5's in this // scenario). node_to_delete->current_frame_host()->DeleteRenderFrame( mojom::FrameDeleteIntention::kNotMainFrame); RenderFrameHostImpl* speculative_frame_host = node_to_delete->render_manager()->speculative_frame_host(); if (speculative_frame_host) { if (speculative_frame_host->lifecycle_state() == LifecycleStateImpl::kPendingCommit) { // A speculative RenderFrameHost that has reached `kPendingCommit` has // already sent a `CommitNavigation()` to the renderer. Any subsequent // IPCs will only be processed after the renderer has already swapped // in the provisional RenderFrame and swapped out the provisional // frame's reference frame (which is either a RenderFrame or a // `blink::RemoteFrame`). // // Since the swapped out `RenderFrame`/`blink::RemoteFrame` is already // gone, a `DeleteRenderFrame()` (routed to the RenderFrame) or a // `DetachAndDispose()` (routed to the `blink::RemoteFrame`) won't do // anything. The browser must also instruct the already-committed but // not-yet-acknowledged speculative RFH to detach itself as well. speculative_frame_host->DeleteRenderFrame( mojom::FrameDeleteIntention::kNotMainFrame); } else { // Otherwise, the provisional RenderFrame has not yet been instructed // to swap in but is already associated with the RenderFrame or // `blink::RemoteFrame` it is expected to replace. The associated // `RenderFrame`/`blink::RemoteFrame` (which is still in the frame // tree) will be responsible for tearing down any associated // provisional RenderFrame, so the browser does not need to take any // explicit cleanup actions. } } // No explicit cleanup is needed here for `RenderFrameProxyHost`s. // Destroying `FrameTreeNode` destroys the map of `RenderFrameProxyHost`s, // and `~RenderFrameProxyHost()` sends a Mojo `DetachAndDispose()` IPC for // child frame proxies. node_to_delete.reset(); PendingDeletionCheckCompleted(); // Can delete |this|. // |this| is potentially deleted. Do not add code after this. return; } } } void RenderFrameHostImpl::ResetChildren() { TRACE_EVENT("navigation", "RenderFrameHostImpl::ResetChildren", ChromeTrackEvent::kRenderFrameHost, this); base::ScopedUmaHistogramTimer histogram_timer("Navigation.ResetChildren"); // Remove child nodes from the tree, then delete them. This destruction // operation will notify observers. See https://crbug.com/612450 for // explanation why we don't just call the std::vector::clear method. std::vector> children; children.swap(children_); // TODO(dcheng): Ideally, this would be done by messaging all the proxies of // this RenderFrameHostImpl to detach the current frame's children, rather // than messaging each child's current frame host... for (auto& child : children) { child->current_frame_host()->DeleteRenderFrame( mojom::FrameDeleteIntention::kNotMainFrame); } } void RenderFrameHostImpl::SetLastCommittedUrl(const GURL& url) { last_committed_url_ = url; } void RenderFrameHostImpl::Detach() { // Detach() can be called in both speculative and pending-commit states. // - a speculative RenderFrameHost as a result of its associated Frame being // detached (i.e., the Frame in the renderer with a provisional_frame_ field // that points to `this`'s LocalFrame). We don't expect it to self-detach // otherwise. // - a pending commit RenderFrameHost might detach itself due to unload events // running that remove it from the tree when swapping it in. // // In both cases speculative and pending-commit RenderFrameHosts, it's OK to // early-return. The logical FrameTreeNode is going to be torn down as well, // and the speculative / pending commit RenderFrameHost (which is still // strongly owned by the RenderFrameHostManager via unique_ptr) will be torn // down then. If we do proceed, this ends up with a use-after-free, since // StartPendingDeletionOnSubtree() will call // ResetAllNavigationsInSubtreeForFrameDetach(), which deletes `this`. if (lifecycle_state() == LifecycleStateImpl::kSpeculative || lifecycle_state() == LifecycleStateImpl::kPendingCommit) { return; } if (!parent_) { bad_message::ReceivedBadMessage(GetProcess(), bad_message::RFH_DETACH_MAIN_FRAME); return; } // A frame is removed while replacing this document with the new one. When it // happens, delete the frame and both the new and old documents. Unload // handlers aren't guaranteed to run here. if (is_waiting_for_unload_ack_) { parent_->RemoveChild(GetFrameTreeNodeForUnload()); return; } // Ignore Detach Mojo API, if the RenderFrameHost should be left in pending // deletion state. if (do_not_delete_for_testing_) { return; } if (IsPendingDeletion()) { // The frame is pending deletion. Detach Mojo API is used to confirm its // unload handlers ran. Note that it is possible for a frame to already be // in kReadyToBeDeleted. This happens when this RenderFrameHost is pending // deletion and is waiting on one of its children to run its unload // handler. While running it, it can request its parent to detach itself. // See test: SitePerProcessBrowserTest.PartialUnloadHandler. if (lifecycle_state() != LifecycleStateImpl::kReadyToBeDeleted) { SetLifecycleState(LifecycleStateImpl::kReadyToBeDeleted); } PendingDeletionCheckCompleted(); // Can delete |this|. // |this| is potentially deleted. Do not add code after this. return; } // This frame is being removed by the renderer, and it has already executed // its unload handler. SetLifecycleState(LifecycleStateImpl::kReadyToBeDeleted); // Before completing the removal, we still need to wait for all of its // descendant frames to execute unload handlers. Start executing those // handlers now. StartPendingDeletionOnSubtree(PendingDeletionReason::kFrameDetach); frame_tree()->FrameUnloading(GetFrameTreeNodeForUnload()); // Some children with no unload handler may be eligible for immediate // deletion. Cut the dead branches now. PendingDeletionCheckCompletedOnSubtree(); // Can delete |this|. // |this| is potentially deleted. Do not add code after this. } void RenderFrameHostImpl::DidFailLoadWithError(const GURL& url, int32_t error_code) { TRACE_EVENT("navigation", "RenderFrameHostImpl::DidFailLoadWithError", ChromeTrackEvent::kRenderFrameHost, *this, "error", error_code); // Terminate the renderer if it sends an invalid error code. if (!net::IsOkOrDefinedError(error_code)) { bad_message::ReceivedBadMessage(GetProcess(), bad_message::RFHI_INVALID_NET_ERROR_CODE); return; } // Cancel prerendering if DidFailLoadWithError is called on the outermost main // document during prerendering after committing the navigation. // Don't dispatch the DidFailLoad event for prerender pages // the embedders are unaware of the page yet and shouldn't // show any user-visible changes from an inactive RenderFrameHost. // CancelPrerenderingForLoadingError checks the navigation stage of the // prerender request and filters all the loading errors before committing the // navigation. These errors come from the previous page in the reused // FrameTree and can be ignored. if (!GetParentOrOuterDocument() && CancelPrerenderingForLoadingError(error_code)) { return; } GURL validated_url(url); GetProcess()->FilterURL(false, &validated_url); delegate_->DidFailLoadWithError(this, validated_url, error_code); } bool RenderFrameHostImpl::TakingFocusWillCrossFencedBoundary( RenderFrameHostImpl* focused_rfh) { if (!focused_rfh) { return false; } if (this == focused_rfh) { return false; } if (frame_tree() == focused_rfh->frame_tree()) { return false; } // We only care if the focus change is ENTERING a fenced frame. Focus is still // allowed to be pulled out of a fenced frame. This is done because an outer // frame should be allowed to re-gain focus from a child frame, and since // gating focus in one direction is enough to prevent a communication channel // from opening. if (!IsNestedWithinFencedFrame()) { return false; } return true; } bool RenderFrameHostImpl::VerifyFencedFrameFocusChange( RenderFrameHostImpl* focused_rfh) { if (GetOutermostMainFrameOrEmbedder() ->GetRenderWidgetHost() ->HasLostFocus()) { ActivateFocusSourceUserActivation(); return true; } if (HasTransientUserActivation() || FocusSourceHasTransientUserActivation()) { return true; } if (!TakingFocusWillCrossFencedBoundary(focused_rfh)) { return true; } SCOPED_CRASH_KEY_BOOL("FencedFocus", "is_fenced_root", IsFencedFrameRoot()); // Information about the previously focused frame SCOPED_CRASH_KEY_BOOL("FencedFocus", "current_in_fenced_tree", focused_rfh->IsNestedWithinFencedFrame()); SCOPED_CRASH_KEY_BOOL("FencedFocus", "current_is_fenced_root", focused_rfh->IsFencedFrameRoot()); // If none of the other cases were hit, disallow the focus change. // TODO(crbug.com/40274134): We will later badmessage the renderer, but, for // now, we will dump without crashing to monitor if any legitimate cases are // reaching this point. if (base::FeatureList::IsEnabled(features::kFencedFramesEnforceFocus)) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_FOCUS_ACROSS_FENCED_BOUNDARY); } else { base::debug::DumpWithoutCrashing(); } return false; } void RenderFrameHostImpl::DidFocusFrame() { TRACE_EVENT("navigation", "RenderFrameHostImpl::DidFocusFrame", ChromeTrackEvent::kRenderFrameHost, *this, ChromeTrackEvent::kSiteInstanceGroup, *GetSiteInstance()->group()); // We don't handle this IPC signal for non-active RenderFrameHost. if (!IsActive()) { return; } CHECK(owner_); // See `owner_` invariants about `IsActive()`. owner_->SetFocusedFrame(GetSiteInstance()->group()); #if BUILDFLAG(IS_WIN) // If the frame has a url, notify the view to allow it to supply the Url to // any interested IME (e.g. Windows 11's TSF uses this information). if (!last_committed_url_.is_empty()) { RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView(); if (view) { ui::TextInputClient* input_client = view->GetTextInputClient(); if (input_client) { input_client->NotifyOnFrameFocusChanged(); } } } #endif // BUILDFLAG(IS_WIN) // The lost focus tracker is cleared out after a focus call. GetOutermostMainFrameOrEmbedder()->GetRenderWidgetHost()->ResetLostFocus(); } void RenderFrameHostImpl::DidCallFocus() { // This should not occur for prerenders but may occur for pages in // the BackForwardCache depending on timing. if (!IsActive()) { return; } delegate_->DidCallFocus(); } void RenderFrameHostImpl::CancelInitialHistoryLoad() { // A Javascript navigation interrupted the initial history load. Check if an // initial subframe cross-process navigation needs to be canceled as a result. // TODO(creis, clamy): Cancel any cross-process navigation. NOTIMPLEMENTED(); } void RenderFrameHostImpl::DidChangeBackForwardCacheDisablingFeatures( BackForwardCacheBlockingDetails details) { renderer_reported_bfcache_blocking_details_ = std::move(details); MaybeEvictFromBackForwardCache(); } using BackForwardCacheDisablingFeatureHandle = RenderFrameHostImpl::BackForwardCacheDisablingFeatureHandle; BackForwardCacheDisablingFeatureHandle:: BackForwardCacheDisablingFeatureHandle() { // |render_frame_host_| will be null, so this value is never used. feature_ = BackForwardCacheDisablingFeature::kDummy; } BackForwardCacheDisablingFeatureHandle::BackForwardCacheDisablingFeatureHandle( BackForwardCacheDisablingFeatureHandle&& other) = default; BackForwardCacheDisablingFeatureHandle::BackForwardCacheDisablingFeatureHandle( RenderFrameHostImpl* render_frame_host, BackForwardCacheDisablingFeature feature) : render_frame_host_(render_frame_host->GetWeakPtr()), feature_(feature) { CHECK(render_frame_host_); render_frame_host_->OnBackForwardCacheDisablingFeatureUsed(feature_); } BackForwardCacheDisablingFeatureHandle:: ~BackForwardCacheDisablingFeatureHandle() { Reset(); } bool BackForwardCacheDisablingFeatureHandle::IsValid() const { return render_frame_host_.get(); } void BackForwardCacheDisablingFeatureHandle::Reset() { if (render_frame_host_) { render_frame_host_->OnBackForwardCacheDisablingFeatureRemoved(feature_); } render_frame_host_ = nullptr; } void RenderFrameHostImpl::RecordBackForwardCacheDisablingReason( BackForwardCacheDisablingFeature feature) { ++browser_reported_bfcache_disabling_features_counts_[feature]; } void RenderFrameHostImpl::OnBackForwardCacheDisablingFeatureUsed( BackForwardCacheDisablingFeature feature) { RecordBackForwardCacheDisablingReason(feature); MaybeEvictFromBackForwardCache(); } void RenderFrameHostImpl::OnBackForwardCacheDisablingStickyFeatureUsed( BackForwardCacheDisablingFeature feature) { OnBackForwardCacheDisablingFeatureUsed(feature); } void RenderFrameHostImpl::OnBackForwardCacheDisablingFeatureRemoved( BackForwardCacheDisablingFeature feature) { auto it = browser_reported_bfcache_disabling_features_counts_.find(feature); CHECK(it != browser_reported_bfcache_disabling_features_counts_.end()); CHECK(it->second >= 1); if (it->second == 1) { browser_reported_bfcache_disabling_features_counts_.erase(it); } else { --it->second; } } RenderFrameHostImpl::BackForwardCacheDisablingFeatures RenderFrameHostImpl::GetBackForwardCacheDisablingFeatures() const { BackForwardCacheDisablingFeatures features; for (const auto& details : GetBackForwardCacheBlockingDetails()) { features.Put(details->feature); } return features; } RenderFrameHostImpl::BackForwardCacheBlockingDetails RenderFrameHostImpl::GetBackForwardCacheBlockingDetails() const { BackForwardCacheBlockingDetails combined_details_list = DedicatedWorkerHostsForDocument::GetOrCreateForCurrentDocument( const_cast(this)) ->GetBackForwardCacheBlockingDetails(); for (const auto& details : renderer_reported_bfcache_blocking_details_) { combined_details_list.push_back(details.Clone()); } for (const auto& it : browser_reported_bfcache_disabling_features_counts_) { // Browser reported features do not have JS location details. Create a // blocking details struct with only the feature filled. auto details_ptr = blink::mojom::BlockingDetails::New(); details_ptr->feature = it.first; combined_details_list.push_back(std::move(details_ptr)); } return combined_details_list; } RenderFrameHostImpl::BackForwardCacheDisablingFeatureHandle RenderFrameHostImpl::RegisterBackForwardCacheDisablingNonStickyFeature( BackForwardCacheDisablingFeature feature) { return BackForwardCacheDisablingFeatureHandle(this, feature); } using HoldingBlockingIDBLockHandle = RenderFrameHostImpl::HoldingBlockingIDBLockHandle; HoldingBlockingIDBLockHandle::HoldingBlockingIDBLockHandle() = default; HoldingBlockingIDBLockHandle::HoldingBlockingIDBLockHandle( HoldingBlockingIDBLockHandle&& other) = default; HoldingBlockingIDBLockHandle::HoldingBlockingIDBLockHandle( RenderFrameHostImpl* render_frame_host) : render_frame_host_(render_frame_host->GetWeakPtr()) { CHECK(render_frame_host_); render_frame_host_->OnStartHoldingBlockingIDBLock(); } HoldingBlockingIDBLockHandle::~HoldingBlockingIDBLockHandle() { Reset(); } bool HoldingBlockingIDBLockHandle::IsValid() const { return render_frame_host_.get(); } void HoldingBlockingIDBLockHandle::Reset() { if (render_frame_host_) { render_frame_host_->OnStopHoldingBlockingIDBLock(); } render_frame_host_ = nullptr; } HoldingBlockingIDBLockHandle RenderFrameHostImpl::RegisterHoldingBlockingIDBLockHandle() { return HoldingBlockingIDBLockHandle(this); } void RenderFrameHostImpl::OnStartHoldingBlockingIDBLock() { CHECK_GE(holding_blocking_idb_lock_count_, 0); if (++holding_blocking_idb_lock_count_ != 1) { return; } if (auto* client = GetContentClient()->browser()->GetFeatureObserverClient()) { client->OnStartUsing( GetGlobalId(), blink::mojom::ObservedFeatureType::kBlockingIndexedDBLock); } } void RenderFrameHostImpl::OnStopHoldingBlockingIDBLock() { CHECK_GT(holding_blocking_idb_lock_count_, 0); if (--holding_blocking_idb_lock_count_ != 0) { return; } if (auto* client = GetContentClient()->browser()->GetFeatureObserverClient()) { client->OnStopUsing( GetGlobalId(), blink::mojom::ObservedFeatureType::kBlockingIndexedDBLock); } } bool RenderFrameHostImpl::IsFrozen() { auto state = render_view_host() ->GetPageLifecycleStateManager() ->CalculatePageLifecycleState(); return state->is_frozen; } void RenderFrameHostImpl::DidCommitProvisionalLoad( mojom::DidCommitProvisionalLoadParamsPtr params, mojom::DidCommitProvisionalLoadInterfaceParamsPtr interface_params) { if (!MaybeInterceptCommitCallback(nullptr, ¶ms, &interface_params)) { return; } CHECK(params); DidCommitNavigation(nullptr, std::move(params), std::move(interface_params)); } void RenderFrameHostImpl::DidCommitPageActivation( NavigationRequest* committing_navigation_request, mojom::DidCommitProvisionalLoadParamsPtr params) { TRACE_EVENT("navigation", "RenderFrameHostImpl::DidCommitPageActivation", ChromeTrackEvent::kRenderFrameHost, this, "committing_navigation_request", committing_navigation_request); CHECK(committing_navigation_request->IsPageActivation()); CHECK(is_main_frame()); auto request = navigation_requests_.find(committing_navigation_request); CHECK(request != navigation_requests_.end()); base::TimeTicks navigation_start = committing_navigation_request->NavigationStart(); bool is_prerender_page_activation = committing_navigation_request->IsPrerenderedPageActivation(); std::unique_ptr owned_request = std::move(request->second); navigation_requests_.erase(committing_navigation_request); // Copy the prerendering frame replication state to have it available after // the navigation commit to be able to check that it didn't change, as // NavigationRequest will be destroyed by that point. blink::mojom::FrameReplicationState prerender_main_frame_replication_state; // Copy the prerendering trigger type and the histogram suffix for metrics // before NavigationRequest is destroyed. PreloadingTriggerType prerender_trigger_type; std::string prerender_histogram_suffix; if (is_prerender_page_activation) { prerender_main_frame_replication_state = owned_request->prerender_main_frame_replication_state(); prerender_trigger_type = owned_request->GetPrerenderTriggerType(); prerender_histogram_suffix = owned_request->GetPrerenderHistogramSuffix(); } #if DCHECK_IS_ON() // We do not support activating a page while subframes have any ongoing // NavigationRequest with a NavigationEntry (this would happen on a navigation // to an existing entry; this is called a "history navigation"). This would be // tricky to support because the NavigationRequest would change its // NavigationController in the course of the activation, and while that may be // safe for a normal navigation, it has more implications for a history // navigation as it already has an associated NavigationEntry and we do not // transfer pending NavigationEntries during activation. Fortunately, for // prerendering, we do not expect there to be any ongoing history navigations // in a subframe, because we maintain a trivial session history, so check that // nav_entry_id() is 0 here. Reloading subframes are considered // renderer-initiated navigations and do not create a new navigation entry // when NavigationRequest is created. // // Note that due to PrerenderCommitDeferringCondition, the main frame should // have no ongoing NavigationRequest at all, so it is not checked here. ForEachRenderFrameHostImpl([](RenderFrameHostImpl* rfh) { // Interested only in subframes. if (rfh->is_main_frame()) { return; } for (const auto& pair : rfh->navigation_requests_) { CHECK_EQ(pair.first->nav_entry_id(), 0); } }); #endif base::WeakPtr weak_ptr = GetWeakPtr(); DidCommitNavigationInternal( std::move(owned_request), std::move(params), /*same_document_params=*/nullptr, /*did_commit_ipc_received_time=*/base::TimeTicks()); if (!weak_ptr) { // This RFH may be deleted after DidCommitNavigationInternal due to a nested // message loop. All callers should handle this. return; } // NOTE: Navigation metrics assume that not much work is done between // DidCommitNavigationInternal() and the end of this function. Avoid adding // code below unless absolutely needed specifically for page activation. // If any load events occurred pre-activation and were deferred until // activation, dispatch them now. This must happen before DidStopLoading() is // called because observers expect them to occur before that. if (is_prerender_page_activation) { GetPage().MaybeDispatchLoadEventsOnPrerenderActivation(); } // Try to dispatch DidStopLoading event (note that // RenderFrameHostImpl::DidStopLoading implementation won't dispatch the event // if the page is still loading). We dispatch it here as it hasn't been // dispatched pre-activation because the back-forward cache page is already // loaded, whereas, for initial prerendering navigation, prerendered page // might still be loading. if (is_prerender_page_activation) { // Regardless of the actual loading state of the prerendered page, the state // should be overwritten with LoadingState::LOADING_UI_REQUESTED in // SetNavigationRequest(). CHECK_EQ(loading_state_, LoadingState::LOADING_UI_REQUESTED); // Dispatch DidStopLoading only when the page is fully loaded during // prerendering. Otherwise, DidStopLoading will be dispatched later. if (document_associated_data_ ->pending_did_stop_loading_for_prerendering()) { DidStopLoading(); } } else { DidStopLoading(); } if (is_prerender_page_activation) { // Record metric to check navigation time with prerender activation. base::TimeDelta delta = base::TimeTicks::Now() - navigation_start; RecordPrerenderActivationTime(delta, prerender_trigger_type, prerender_histogram_suffix); // We haven't sent any updates to the proxies during prerendering // activation, so we need to ensure that the new frame replication being // stored in the browser is the same as the old and consistent with the // state we've sent to the renderers. // // TODO - can we check main frame replication state? // // TODO(https://crbug.com/526541280): CHECK-exclusion: Convert to CHECK once // we are sure this isn't hit. DCHECK(prerender_main_frame_replication_state == frame_tree()->root()->current_replication_state()); ForEachRenderFrameHostImpl([](RenderFrameHostImpl* rfh) { rfh->document_associated_data_->RunPostPrerenderingActivationSteps(); }); } else if (auto* view = GetView()) { view->ActivatedOrEvictedFromBackForwardCache(); } } void RenderFrameHostImpl::StartLoadingForAsyncNavigationApiCommit() { // A same document navigation commit was requested, but was intercepted by // the navigation event. This should cause loading UI to appear, because // unlike other same-document navigations, this one is asynchronous. Note that // the renderer notifies the browser after a short delay, in order to lessen // the risk of the loading UI jittering if there are several short // asynchronous navigations in a row. LoadingState previous_frame_tree_loading_state = frame_tree()->LoadingTree()->GetLoadingState(); loading_state_ = LoadingState::LOADING_UI_REQUESTED; frame_tree_node()->DidStartLoading(previous_frame_tree_loading_state); } void RenderFrameHostImpl::DidCommitSameDocumentNavigation( mojom::DidCommitProvisionalLoadParamsPtr params, mojom::DidCommitSameDocumentNavigationParamsPtr same_document_params) { TRACE_EVENT("navigation", "RenderFrameHostImpl::DidCommitSameDocumentNavigation", ChromeTrackEvent::kRenderFrameHost, this, "url", params->url.possibly_invalid_spec()); base::TimeTicks did_commit_ipc_received_time = base::TimeTicks().Now(); // TODO(peilinwang): remove after the kAndroidVisibleUrlTruncation experiment // is complete. SCOPED_UMA_HISTOGRAM_TIMER( "Navigation.DidCommitSameDocumentNavigation.Duration"); ScopedActiveURL scoped_active_url(params->url, GetMainFrame()->GetLastCommittedOrigin()); ScopedCommitStateResetter commit_state_resetter(this); // When the frame is pending deletion, the browser is waiting for it to unload // properly. In the meantime, because of race conditions, it might tries to // commit a same-document navigation before unloading. Similarly to what is // done with cross-document navigations, such navigation are ignored. The // browser already committed to destroying this RenderFrameHost. // See https://crbug.com/805705 and https://crbug.com/930132. // TODO(crbug.com/40276805): Investigate to see if this can be removed // when the NavigationClient interface is implemented. // // If this is called when the frame is in BackForwardCache, evict the frame // to avoid ignoring the renderer-initiated navigation, which the frame // might not expect. // // If this is called when the frame is in Prerendering, do not cancel // Prerendering as prerendered frames can be navigated, including // same-document navigations like push/replaceState. if (lifecycle_state() != LifecycleStateImpl::kPrerendering && IsInactiveAndDisallowActivation( DisallowActivationReasonId::kCommitSameDocumentNavigation)) { return; } // Check if the navigation matches a stored same-document NavigationRequest. // In that case it is browser-initiated. auto request_entry = same_document_navigation_requests_.find(params->navigation_token); bool is_browser_initiated = (request_entry != same_document_navigation_requests_.end()); std::unique_ptr request = is_browser_initiated ? std::move(request_entry->second) : nullptr; same_document_navigation_requests_.erase(params->navigation_token); if (!MaybeInterceptCommitCallback(request.get(), ¶ms, nullptr)) { return; } if (!DidCommitNavigationInternal(std::move(request), std::move(params), std::move(same_document_params), did_commit_ipc_received_time)) { return; } // NOTE: Navigation metrics assume that not much work is done between // DidCommitNavigationInternal() and the end of this function. Avoid adding // code below unless absolutely needed. // Since we didn't early return, it's safe to keep the commit state. commit_state_resetter.disable(); } void RenderFrameHostImpl::DidOpenDocumentInputStream(const GURL& url) { // Check if the URL can actually be committed to the current origin. When // checking, the restrictions should be the same as a same-document navigation // since document.open() can only update the URL to a same-origin URL. if (!ValidateURLAndOrigin(url, last_committed_origin_, /*is_same_document_navigation=*/true, /*navigation_request=*/nullptr)) { return; } // Filter the URL, then update `renderer_url_info_`'s `last_document_url`. // Note that we won't update `last_committed_url_` because this doesn't really // count as committing a real navigation and won't update NavigationEntry etc. // See https://crbug.com/1046898 and https://github.com/whatwg/html/pull/6649 // for more details. GURL filtered_url(url); GetProcess()->FilterURL(/*empty_allowed=*/false, &filtered_url); renderer_url_info_.last_document_url = filtered_url; // `owner_` could be null if we get this message asynchronously from the // renderer in pending deletion state. if (owner_) { owner_->DidOpenDocumentInputStream(); } } RenderWidgetHostImpl* RenderFrameHostImpl::GetRenderWidgetHost() { RenderFrameHostImpl* frame = this; while (frame) { if (frame->GetLocalRenderWidgetHost()) { return frame->GetLocalRenderWidgetHost(); } frame = frame->GetParent(); } DUMP_WILL_BE_NOTREACHED(); return nullptr; } RenderWidgetHostViewBase* RenderFrameHostImpl::GetView() { return GetRenderWidgetHost()->GetView(); } GlobalRenderFrameHostId RenderFrameHostImpl::GetGlobalId() const { return GlobalRenderFrameHostId(GetProcess()->GetDeprecatedID(), GetRoutingID()); } GlobalRenderFrameHostToken RenderFrameHostImpl::GetGlobalFrameToken() const { return GlobalRenderFrameHostToken(GetProcess()->GetDeprecatedID(), GetFrameToken()); } bool RenderFrameHostImpl::HasPendingCommitNavigation() const { return HasPendingCommitForCrossDocumentNavigation() || !same_document_navigation_requests_.empty(); } bool RenderFrameHostImpl::HasPendingCommitForCrossDocumentNavigation() const { return !navigation_requests_.empty(); } void RenderFrameHostImpl::RecordMetricsForBlockedGetFrameHostAttempt( bool commit_attempt) { CHECK_EQ(lifecycle_state_, LifecycleStateImpl::kPendingCommit); CHECK_EQ(1u, navigation_requests_.size()); navigation_requests_.begin() ->first->RecordMetricsForBlockedGetFrameHostAttempt(commit_attempt); } NavigationRequest* RenderFrameHostImpl::GetSameDocumentNavigationRequest( const base::UnguessableToken& token) { auto request = same_document_navigation_requests_.find(token); return (request == same_document_navigation_requests_.end()) ? nullptr : request->second.get(); } void RenderFrameHostImpl::ResetOwnedNavigationRequests( NavigationDiscardReason reason) { if (lifecycle_state_ == LifecycleStateImpl::kPendingCommit) { // Pending commit RenderFrameHosts should never have same document // navigation requests yet, as they do not have a real document committed // yet. CHECK(same_document_navigation_requests_.empty()); if (HasPendingCommitForCrossDocumentNavigation()) { // With navigation queueing, pending commit navigations shouldn't get // canceled, unless the FrameTreeNode or renderer process // is gone/will be gone soon. CHECK(reason == NavigationDiscardReason::kRenderProcessGone || reason == NavigationDiscardReason::kWillRemoveFrame); } } for (auto& request : navigation_requests_) { request.second->set_navigation_discard_reason(reason); } for (auto& request : same_document_navigation_requests_) { request.second->set_navigation_discard_reason(reason); } // Move the NavigationRequests to new maps first before deleting them. This // avoids issues if a re-entrant call is made when a NavigationRequest is // being deleted (e.g., if the process goes away as the tab is closing). std::map> navigation_requests; navigation_requests_.swap(navigation_requests); base::flat_map> same_document_navigation_requests; same_document_navigation_requests_.swap(same_document_navigation_requests); } void RenderFrameHostImpl::SetNavigationRequest( std::unique_ptr navigation_request) { CHECK(navigation_request); if (NavigationTypeUtils::IsSameDocument( navigation_request->common_params().navigation_type)) { loading_state_ = LoadingState::LOADING_WITHOUT_UI; same_document_navigation_requests_[navigation_request->commit_params() .navigation_token] = std::move(navigation_request); return; } loading_state_ = LoadingState::LOADING_UI_REQUESTED; navigation_requests_[navigation_request.get()] = std::move(navigation_request); } const scoped_refptr& RenderFrameHostImpl::GetNavigationOrDocumentHandle() { if (!document_associated_data_->navigation_or_document_handle()) { document_associated_data_->set_navigation_or_document_handle( NavigationOrDocumentHandle::CreateForDocument(GetGlobalId())); } return document_associated_data_->navigation_or_document_handle(); } void RenderFrameHostImpl::Unload(RenderFrameProxyHost* proxy, bool is_loading) { base::ScopedUmaHistogramTimer histogram_timer("Navigation.Unload"); // If this RenderFrameHost is already pending deletion, it must have already // gone through this, therefore just return. if (IsPendingDeletion()) { NOTREACHED() << "RFH should be in default state when calling Unload."; } if (unload_event_monitor_timeout_ && !do_not_delete_for_testing_) { unload_event_monitor_timeout_->Start(kUnloadTimeout); } is_waiting_for_unload_ack_ = true; if (proxy) { SetLifecycleState(LifecycleStateImpl::kRunningUnloadHandlers); if (IsRenderFrameLive()) { GetMojomFrameInRenderer()->Unload( is_loading, proxy->frame_tree_node()->current_replication_state().Clone(), proxy->GetFrameToken(), proxy->CreateAndBindRemoteFrameInterfaces(), proxy->CreateAndBindRemoteMainFrameInterfaces(), /*devtools_frame_token=*/std::nullopt); // Remember that a `blink::RemoteFrame` was created as part of processing // the Unload message above. proxy->SetRenderFrameProxyCreated(true); } } else { // RenderDocument: After a local<->local swap, this function is called with // a null |proxy|. // It may be the case that two navigations are queued up. Both may initially // see `ShouldChangeRenderFrameHostOnSameSiteNavigation()` return true, // however after the first one commits the RFH will change. When the second // navigation commits `ShouldChangeRenderFrameHostOnSameSiteNavigation()` // may no longer return true. CHECK_EQ( GetSiteInstance()->group(), frame_tree_node_->current_frame_host()->GetSiteInstance()->group()); // The unload handlers already ran for this document during the // local<->local swap. Hence, there is no need to send // mojom::Frame::Unload here. It can be marked at completed. SetLifecycleState(LifecycleStateImpl::kReadyToBeDeleted); } if (web_ui()) { web_ui()->RenderFrameHostUnloading(); } StartPendingDeletionOnSubtree(PendingDeletionReason::kSwappedOut); // Some children with no unload handler may be eligible for immediate // deletion. Cut the dead branches now. PendingDeletionCheckCompletedOnSubtree(); // Can delete |this|. // |this| is potentially deleted. Do not add code after this. } void RenderFrameHostImpl::MaybeDispatchDidFinishLoadOnPrerenderActivation() { // Don't dispatch notification if DidFinishLoad has not yet been invoked for // `rfh` i.e., when the url is nullopt. if (!document_associated_data_ ->pending_did_finish_load_url_for_prerendering()) { return; } delegate_->OnDidFinishLoad( this, *document_associated_data_ ->pending_did_finish_load_url_for_prerendering()); // Set to nullopt to avoid calling DidFinishLoad twice. document_associated_data_ ->reset_pending_did_finish_load_url_for_prerendering(); } void RenderFrameHostImpl::MaybeDispatchDOMContentLoadedOnPrerenderActivation() { // Don't send a notification if DOM content is not yet loaded. if (!document_associated_data_->dom_content_loaded()) { return; } delegate_->DOMContentLoaded(this); if (last_committed_url_.SchemeIsHTTPOrHTTPS() && IsOutermostMainFrame()) { RecordIsProcessBackgrounded("OnDOMContentLoaded", GetProcess()->GetPriority()); } MaybeResetBoostRenderProcessForLoading(); } void RenderFrameHostImpl::SwapOuterDelegateFrame( RenderFrameProxyHost* proxy, const base::UnguessableToken& devtools_frame_token) { // The placeholder frame for an inner frame tree must never have its own // local children. Clear them here, before sending the Unload IPC, so that // the cleanup does not depend on the renderer sending a DidUnloadRenderFrame // ACK. See https://crbug.com/518078552. ResetChildren(); // Note: At this point the placeholder iframe for embedding the guest has // been initialized with a devtools_frame_token that is different from the // guest's main frame (that is about to be attached to it). When we swap // the LocalFrame with a RemoteFrame below; we also update its // devtools_frame_token to the guest main frame's devtools_frame_token (i.e. // `devtools_frame_token`) to indicate to DevTools clients that the guest has // been attached to this placeholder iframe. const bool should_swap_devtools_frame_token = base::FeatureList::IsEnabled(features::kGuestViewMPArch); GetMojomFrameInRenderer()->Unload( /*is_loading=*/false, browsing_context_state_->current_replication_state().Clone(), proxy->GetFrameToken(), proxy->CreateAndBindRemoteFrameInterfaces(), proxy->CreateAndBindRemoteMainFrameInterfaces(), should_swap_devtools_frame_token ? std::make_optional(devtools_frame_token) : std::nullopt); // Drop all accessibility state for this frame to release resources and ensure // that any in-flight tree updates received before the unload ACK are ignored. last_ax_mode_ = ui::AXMode(); render_accessibility_.reset(); browser_accessibility_manager_.reset(); ax_unique_ids_.clear(); accessibility_reset_token_.reset(); ax_tree_data_ = ui::AXTreeData(); } void RenderFrameHostImpl::DetachFromProxy() { if (IsPendingDeletion()) { return; } // Start pending deletion on this frame and its children. DeleteRenderFrame(mojom::FrameDeleteIntention::kNotMainFrame); StartPendingDeletionOnSubtree(PendingDeletionReason::kFrameDetach); frame_tree()->FrameUnloading(GetFrameTreeNodeForUnload()); // Some children with no unload handler may be eligible for immediate // deletion. Cut the dead branches now. PendingDeletionCheckCompletedOnSubtree(); // Can delete |this|. // |this| is potentially deleted. Do not add code after this. } void RenderFrameHostImpl::ProcessBeforeUnloadCompleted( bool proceed, bool treat_as_final_completion_callback, const base::TimeTicks& renderer_before_unload_start_time, const base::TimeTicks& renderer_before_unload_end_time, BeforeUnloadExecutionMode execution_mode) { TRACE_EVENT("navigation", "RenderFrameHostImpl::ProcessBeforeUnloadCompleted", perfetto::Flow::FromPointer(this)); // If this renderer navigated while the beforeunload request was in flight, we // may have cleared this state in DidCommitProvisionalLoad, in which case we // can ignore this message. // However renderer might also be swapped out but we still want to proceed // with navigation, otherwise it would block future navigations. This can // happen when pending cross-site navigation is canceled by a second one just // before DidCommitProvisionalLoad while current RVH is waiting for commit // but second navigation is started from the beginning. RenderFrameHostImpl* initiator = GetBeforeUnloadInitiator(); if (!initiator) { return; } if (on_process_before_unload_completed_for_testing_) [[unlikely]] { std::move(on_process_before_unload_completed_for_testing_).Run(); } // Continue processing the ACK in the frame that triggered beforeunload in // this frame. This could be either this frame itself or an ancestor frame. initiator->ProcessBeforeUnloadCompletedFromFrame( proceed, treat_as_final_completion_callback, this, /*is_frame_being_destroyed=*/false, renderer_before_unload_start_time, renderer_before_unload_end_time, execution_mode); // DO NOT add code after this. `this` can be deleted at this point. } void RenderFrameHostImpl::ProcessBeforeUnloadCompletedFromFrame( bool proceed, bool treat_as_final_completion_callback, RenderFrameHostImpl* frame, bool is_frame_being_destroyed, const base::TimeTicks& renderer_before_unload_start_time, const base::TimeTicks& renderer_before_unload_end_time, BeforeUnloadExecutionMode execution_mode) { // Check if we need to wait for more beforeunload completion callbacks. If // |proceed| is false, we know the navigation or window close will be aborted, // so we don't need to wait for beforeunload completion callbacks from any // other frames. |treat_as_final_completion_callback| also indicates that we // shouldn't wait for any other ACKs (e.g., when a beforeunload timeout // fires). if (!proceed || treat_as_final_completion_callback) { beforeunload_pending_replies_.clear(); } else { beforeunload_pending_replies_.erase(frame->GetGlobalId()); if (!beforeunload_pending_replies_.empty()) { return; } } CHECK(!send_before_unload_start_time_.is_null()); // Sets a default value for before_unload_end_time so that the browser // survives a hacked renderer. base::TimeTicks before_unload_end_time = renderer_before_unload_end_time; base::TimeDelta browser_to_renderer_ipc_time_delta; if (!renderer_before_unload_start_time.is_null() && !renderer_before_unload_end_time.is_null()) { base::TimeTicks before_unload_completed_time = base::TimeTicks::Now(); if (!base::TimeTicks::IsConsistentAcrossProcesses() && execution_mode == BeforeUnloadExecutionMode::kSync) { // TimeTicks is not consistent across processes and we are passing // TimeTicks across process boundaries so we need to compensate for any // skew between the processes. Here we are converting the renderer's // notion of before_unload_end_time to TimeTicks in the browser process. // See comments in inter_process_time_ticks_converter.h for more. blink::InterProcessTimeTicksConverter converter( blink::LocalTimeTicks::FromTimeTicks(send_before_unload_start_time_), blink::LocalTimeTicks::FromTimeTicks(before_unload_completed_time), blink::RemoteTimeTicks::FromTimeTicks( renderer_before_unload_start_time), blink::RemoteTimeTicks::FromTimeTicks( renderer_before_unload_end_time)); const base::TimeTicks browser_before_unload_start_time = converter .ToLocalTimeTicks(blink::RemoteTimeTicks::FromTimeTicks( renderer_before_unload_start_time)) .ToTimeTicks(); const base::TimeTicks browser_before_unload_end_time = converter .ToLocalTimeTicks(blink::RemoteTimeTicks::FromTimeTicks( renderer_before_unload_end_time)) .ToTimeTicks(); before_unload_end_time = browser_before_unload_end_time; browser_to_renderer_ipc_time_delta = browser_before_unload_start_time - send_before_unload_start_time_; } else { browser_to_renderer_ipc_time_delta = (renderer_before_unload_start_time - send_before_unload_start_time_); } if (execution_mode == BeforeUnloadExecutionMode::kForLegacy || execution_mode == BeforeUnloadExecutionMode::kAsync) { // When `execution_mode` is `kForLegacy` or `kAsync`, callers should // supply `send_before_unload_start_time_` as the value for // `renderer_before_unload_start_time`, which means // `browser_to_renderer_ipc_time_delta` should be 0. // TODO(https://crbug.com/526540985): CHECK-exclusion: Convert to CHECK // once we are sure this isn't hit. DCHECK(browser_to_renderer_ipc_time_delta.is_zero()); } base::TimeDelta on_before_unload_overhead_time = (before_unload_completed_time - send_before_unload_start_time_) - (renderer_before_unload_end_time - renderer_before_unload_start_time); base::UmaHistogramTimes("Navigation.OnBeforeUnloadOverheadTime", on_before_unload_overhead_time); switch (execution_mode) { case BeforeUnloadExecutionMode::kSync: case BeforeUnloadExecutionMode::kAsync: base::UmaHistogramTimes( "Navigation.OnBeforeUnloadOverheadTime." "BeforeUnloadHandlerRegistered", on_before_unload_overhead_time); if (execution_mode == BeforeUnloadExecutionMode::kAsync) { base::UmaHistogramTimes( "Navigation.OnBeforeUnloadOverheadTime." "BeforeUnloadHandlerRegistered.Async", on_before_unload_overhead_time); } else { base::UmaHistogramTimes( "Navigation.OnBeforeUnloadOverheadTime." "BeforeUnloadHandlerRegistered.Sync", on_before_unload_overhead_time); } break; case BeforeUnloadExecutionMode::kForLegacy: base::UmaHistogramTimes( "Navigation.OnBeforeUnloadOverheadTime." "NoBeforeUnloadHandlerRegistered", on_before_unload_overhead_time); break; case BeforeUnloadExecutionMode::kNotBlocked: // ProcessBeforeUnloadCompletedFromFrame should not be called if // beforeunload handlers were not executed. NOTREACHED(); } frame_tree_node_->navigator().LogBeforeUnloadTime( renderer_before_unload_start_time, renderer_before_unload_end_time, send_before_unload_start_time_, execution_mode == BeforeUnloadExecutionMode::kForLegacy || execution_mode == BeforeUnloadExecutionMode::kAsync); } if (auto* navigation_request = frame_tree_node_->navigation_request()) { navigation_request->set_before_unload_execution_mode(execution_mode); } bool showed_dialog = has_shown_beforeunload_dialog_; // Resets beforeunload waiting state. is_waiting_for_beforeunload_completion_ = false; has_shown_beforeunload_dialog_ = false; if (beforeunload_timeout_) { beforeunload_timeout_->Stop(); } send_before_unload_start_time_ = base::TimeTicks(); // We could reach this from a subframe destructor for |frame| while we're in // the middle of closing the current tab. In that case, dispatch the ACK to // prevent re-entrancy and a potential nested attempt to free the current // frame. See https://crbug.com/866382 and https://crbug.com/1147567. base::OnceClosure task = base::BindOnce( [](base::WeakPtr self, const base::TimeTicks& before_unload_end_time, bool proceed, bool unload_ack_is_for_navigation, bool for_legacy, bool showed_dialog) { if (!self) { return; } FrameTreeNode* frame = self->frame_tree_node(); // If the ACK is for a navigation, send it to the Navigator to have the // current navigation stop/proceed. Otherwise, send it to the // RenderFrameHostManager which handles closing. if (unload_ack_is_for_navigation) { frame->navigator().BeforeUnloadCompleted(frame, proceed, before_unload_end_time, for_legacy, showed_dialog); } else { frame->render_manager()->BeforeUnloadCompleted(proceed); } }, // The overhead of the browser->renderer IPC may be non trivial. Account // for it here. Ideally this would also include the time to execute the // JS, but we would need to exclude the time spent waiting for a dialog, // which is tricky. weak_ptr_factory_.GetWeakPtr(), before_unload_end_time - browser_to_renderer_ipc_time_delta, proceed, unload_ack_is_for_navigation_, execution_mode == BeforeUnloadExecutionMode::kForLegacy, showed_dialog); if (is_frame_being_destroyed) { CHECK(proceed); base::SingleThreadTaskRunner::GetCurrentDefault()->PostTask( FROM_HERE, std::move(task)); } else { std::move(task).Run(); } // If canceled, notify the delegate to cancel its pending navigation entry. // This is usually redundant with the dialog closure code in WebContentsImpl's // OnDialogClosed, but there may be some cases that Blink returns !proceed // without showing the dialog. We also update the address bar here to be safe. if (!proceed) { frame_tree_->DidCancelLoading(); } } bool RenderFrameHostImpl::IsWaitingForUnloadACK() const { return page_close_state_ == PageCloseState::kRunningUnloadHandlers || is_waiting_for_unload_ack_; } bool RenderFrameHostImpl::BeforeUnloadTimedOut() const { return beforeunload_timeout_ && (send_before_unload_start_time_ != base::TimeTicks()) && (base::TimeTicks::Now() - send_before_unload_start_time_) > beforeunload_timeout_delay_; } void RenderFrameHostImpl::OnUnloadACK() { // Give the tests a chance to override this sequence. if (unload_ack_callback_ && unload_ack_callback_.Run()) { return; } // This method should be called in the pending deletion state except the // placeholder RFHs for an inner WebContents that use unload without changing // lifecycle states. When attaching a GuestView as the inner WebContents, // `RFH::SwapOuterDelegateFrame()` is called for the placeholder RFH so that // it makes its renderer send this message. `owner_` is non null since this // attachment can only happen for subframes and pending deletion is the only // case where subframes may have a null `owner_`. // // Note that for MimeHandlerView specifically, the unload ACK can only be // legitimately received after the inner delegate has already been attached by // `RFH::SwapOuterDelegateFrame()`, and should be ignored if it's received // during an earlier MimeHandlerView-specific preparation phase invoked via // `RFH::PrepareForInnerContentsAttach()` (because not ignoring it would later // disrupt the attachment, e.g. by causing the Unload IPC not to be sent). // Hence, it's important to check for `is_inner_delegate_attached()` rather // than `is_attaching_inner_delegate()`. RenderFrameHostOwner* owner = IsPendingDeletion() ? GetFrameTreeNodeForUnload() : owner_; if (!is_main_frame() && owner->GetRenderFrameHostManager().is_inner_delegate_attached()) { // This RFH was unloaded while attaching an inner delegate. The RFH will // stay around but it will no longer be associated with a RenderFrame. // Ensure there are no lingering child frames before marking the frame // deleted - this matters for compromised renderers (see // https://crbug.com/517241992). This is a defense-in-depth call that // mirrors a similar call in SwapOuterDelegateFrame(). ResetChildren(); RenderFrameDeleted(); return; } // Ignore spurious unload ack. if (!is_waiting_for_unload_ack_) { return; } // Ignore OnUnloadACK if the RenderFrameHost should be left in pending // deletion state. if (do_not_delete_for_testing_) { return; } CHECK_EQ(LifecycleStateImpl::kRunningUnloadHandlers, lifecycle_state()); SetLifecycleState(LifecycleStateImpl::kReadyToBeDeleted); PendingDeletionCheckCompleted(); // Can delete |this|. // |this| is potentially deleted. Do not add code after this. } void RenderFrameHostImpl::MaybeLogMissingUnloadAck() { // If you are seeing this logging appear in a flaky test, the test may be // dependent on an unload handler or other sudden-termination disabling event // handler. If so, the test should probably // - call DisableUnloadTimerForTesting() to avoid timeouts on slow devices // - wait for the frame to be deleted e.g. via // RenderFrameHostWrapper::WaitUntilRenderFrameDeleted // See https://crbug.com/1489568 for more information. if (base::CommandLine::ForCurrentProcess()->HasSwitch( switches::kLogMissingUnloadACK)) { LOG(ERROR) << "Missing unload ACK for " << (IsOutermostMainFrame() ? "main frame" : "subframe") << ": " << GetLastCommittedURL(); } } void RenderFrameHostImpl::OnNavigationUnloadTimeout() { MaybeLogMissingUnloadAck(); OnUnloaded(); } void RenderFrameHostImpl::OnUnloaded() { CHECK(is_waiting_for_unload_ack_); if (unload_event_monitor_timeout_) { unload_event_monitor_timeout_->Stop(); } base::WeakPtr self = GetWeakPtr(); ClearWebUI(); // See https://crbug.com/1308391. Calling `ClearWebUI()` indirectly call // content's embedders via a chain of destructors. Some might destroy the // whole WebContents. if (!self) { return; } bool deleted = GetFrameTreeNodeForUnload()->render_manager()->DeleteFromPendingList( this); CHECK(deleted); } void RenderFrameHostImpl::DisableUnloadTimerForTesting() { unload_event_monitor_timeout_.reset(); } void RenderFrameHostImpl::SimulateDiscardShutdownKeepAliveTimeoutForTesting() { DiscardedRFHProcessHelper::GetForRenderProcessHost(GetProcess()) ->SimulateKeepAliveTimeoutForTesting(); } bool RenderFrameHostImpl::IsBackForwardCacheEvictionTimeRunningForTesting() const { return back_forward_cache_eviction_timer_.IsRunning(); } void RenderFrameHostImpl::SetSubframeUnloadTimeoutForTesting( const base::TimeDelta& timeout) { subframe_unload_timeout_ = timeout; } bool RenderFrameHostImpl::AncestorsAllowSameSiteNoneCookiesOverride( const url::Origin& frame_origin) const { // Use precursor for cases where the current or parent frames are sandboxed // and have an opaque origin. const url::SchemeHostPort scheme_host_port = frame_origin.GetTupleOrPrecursorTupleIfOpaque(); // Use |parent_| (not `GetParentOrOuterDocument()`) when checking ancestor // frames are same-site since the `allow-same-site-none-cookies` value is // disallowed in Fenced Frame contexts. for (const RenderFrameHostImpl* frame = parent_; frame; frame = frame->parent_) { url::SchemeHostPort parent_scheme_host_port = frame->last_committed_origin_.GetTupleOrPrecursorTupleIfOpaque(); if ((scheme_host_port != parent_scheme_host_port) || (net::SchemefulSite(scheme_host_port.GetURL()) != net::SchemefulSite(parent_scheme_host_port.GetURL()))) { return false; } } return true; } void RenderFrameHostImpl::OnKeepAliveRequestCreated( const network::ResourceRequest& resource_request) { if (delegate_) { delegate_->OnKeepAliveRequestCreated(resource_request, this); } } #if BUILDFLAG(IS_ANDROID) void RenderFrameHostImpl::RequestSmartClipExtract( ExtractSmartClipDataCallback callback, gfx::Rect rect) { int32_t callback_id = smart_clip_callbacks_.Add( std::make_unique(std::move(callback))); GetAssociatedLocalFrame()->ExtractSmartClipData( rect, base::BindOnce(&RenderFrameHostImpl::OnSmartClipDataExtracted, base::Unretained(this), callback_id)); } void RenderFrameHostImpl::OnSmartClipDataExtracted(int32_t callback_id, const std::u16string& text, const std::u16string& html, const gfx::Rect& clip_rect) { std::move(*smart_clip_callbacks_.Lookup(callback_id)) .Run(text, html, clip_rect); smart_clip_callbacks_.Remove(callback_id); } #endif // BUILDFLAG(IS_ANDROID) void RenderFrameHostImpl::RunModalAlertDialog( const std::u16string& alert_message, bool disable_third_party_subframe_suppresion, RunModalAlertDialogCallback response_callback) { auto dialog_closed_callback = base::BindOnce( [](RunModalAlertDialogCallback response_callback, bool success, const std::u16string& response) { // The response string is unused but we use a generic mechanism for // closing the javascript dialog that returns two arguments. std::move(response_callback).Run(); }, std::move(response_callback)); RunJavaScriptDialog(alert_message, std::u16string(), JAVASCRIPT_DIALOG_TYPE_ALERT, disable_third_party_subframe_suppresion, std::move(dialog_closed_callback)); } void RenderFrameHostImpl::RunModalConfirmDialog( const std::u16string& alert_message, bool disable_third_party_subframe_suppresion, RunModalConfirmDialogCallback response_callback) { auto dialog_closed_callback = base::BindOnce( [](RunModalConfirmDialogCallback response_callback, bool success, const std::u16string& response) { // The response string is unused but we use a generic mechanism for // closing the javascript dialog that returns two arguments. std::move(response_callback).Run(success); }, std::move(response_callback)); RunJavaScriptDialog(alert_message, std::u16string(), JAVASCRIPT_DIALOG_TYPE_CONFIRM, disable_third_party_subframe_suppresion, std::move(dialog_closed_callback)); } void RenderFrameHostImpl::RunModalPromptDialog( const std::u16string& alert_message, const std::u16string& default_value, bool disable_third_party_subframe_suppresion, RunModalPromptDialogCallback response_callback) { RunJavaScriptDialog( alert_message, default_value, JAVASCRIPT_DIALOG_TYPE_PROMPT, disable_third_party_subframe_suppresion, std::move(response_callback)); } void RenderFrameHostImpl::RunJavaScriptDialog( const std::u16string& message, const std::u16string& default_prompt, JavaScriptDialogType dialog_type, bool disable_third_party_subframe_suppresion, JavaScriptDialogCallback ipc_response_callback) { // Sandboxed frames should only be allowed to show modal dialogs when they // have the "allow-modals" attribute. This should have already been checked // by the renderer process (see LocalDOMWindow::alert/confirm/prompt), and // this browser-side check defends against compromised renderers. if (IsSandboxed(network::mojom::WebSandboxFlags::kModals)) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_MODAL_DIALOG_FROM_SANDBOXED_FRAME); return; } // Don't show the dialog if it's triggered on a non-active RenderFrameHost // or is contained in a Fenced Frame. if (!IsActive() || IsNestedWithinFencedFrame()) { std::move(ipc_response_callback).Run(/*success=*/false, std::u16string()); return; } // While a JS message dialog is showing, tabs in the same process shouldn't // process input events. GetProcess()->SetBlocked(true); delegate_->RunJavaScriptDialog( this, message, default_prompt, dialog_type, disable_third_party_subframe_suppresion, base::BindOnce(&RenderFrameHostImpl::JavaScriptDialogClosed, weak_ptr_factory_.GetWeakPtr(), std::move(ipc_response_callback))); } void RenderFrameHostImpl::RunBeforeUnloadConfirm( bool is_reload, RunBeforeUnloadConfirmCallback ipc_response_callback) { TRACE_EVENT1("navigation", "RenderFrameHostImpl::OnRunBeforeUnloadConfirm", "render_frame_host", this); // Don't show the dialog if it's triggered on a non-active RenderFrameHost // or is contained in a Fenced Frame. if (!IsActive() || IsNestedWithinFencedFrame()) { std::move(ipc_response_callback).Run(/*success=*/false); return; } // Don't show the dialog and indicate navigation should continue. if (GetContentClient()->browser()->ShouldSkipBeforeUnloadDialog(this)) { std::move(ipc_response_callback).Run(/*success=*/true); return; } // Check if this frame could legally display a dialog. if (base::FeatureList::IsEnabled( features::kEnforceUserActivationForBeforeUnload) && !CouldDisplayBeforeUnloadDialog()) { SendInterventionReport( "BeforeUnloadNoGesture", "Blocked attempt to show a 'beforeunload' confirmation panel for a " "frame that never had a user gesture since its load. " "https://www.chromestatus.com/feature/5082396709879808", /*child_frame=*/nullptr); std::move(ipc_response_callback).Run(/*success=*/true); return; } // Allow at most one attempt to show a beforeunload dialog per navigation. RenderFrameHostImpl* beforeunload_initiator = GetBeforeUnloadInitiator(); if (beforeunload_initiator) { // If the running beforeunload handler wants to display a dialog and the // before-unload type wants to ignore it, then short-circuit the request and // respond as if the user decided to stay on the page, canceling the unload. if (beforeunload_initiator->beforeunload_dialog_request_cancels_unload_) { std::move(ipc_response_callback).Run(/*success=*/false); return; } if (beforeunload_initiator->has_shown_beforeunload_dialog_) { // TODO(alexmos): Pass enough data back to renderer to record histograms // for Document.BeforeUnloadDialog and add the intervention console // message to match renderer-side behavior in // Document::DispatchBeforeUnloadEvent(). std::move(ipc_response_callback).Run(/*success=*/true); return; } beforeunload_initiator->has_shown_beforeunload_dialog_ = true; } else { // TODO(alexmos): If a renderer-initiated beforeunload shows a dialog, it // won't find a |beforeunload_initiator|. This can happen for a // renderer-initiated navigation or window.close(). We should ensure that // when the browser process later kicks off subframe unload handlers (if // any), they won't be able to show additional dialogs. However, we can't // just set |has_shown_beforeunload_dialog_| because we don't know which // frame is navigating/closing here. Plumb enough information here to fix // this. } // While a JS beforeunload dialog is showing, tabs in the same process // shouldn't process input events. GetProcess()->SetBlocked(true); // The beforeunload dialog for this frame may have been triggered by a // browser-side request to this frame or a frame up in the frame hierarchy. // Stop any timers that are waiting. for (RenderFrameHostImpl* frame = this; frame; frame = frame->GetParent()) { if (frame->beforeunload_timeout_) { frame->beforeunload_timeout_->Stop(); } } auto ipc_callback_wrapper = base::BindOnce( [](RunBeforeUnloadConfirmCallback response_callback, bool success, const std::u16string& response) { // The response string is unused but we use a generic mechanism for // closing the javascript dialog that returns two arguments. std::move(response_callback).Run(success); }, std::move(ipc_response_callback)); auto dialog_closed_callback = base::BindOnce( &RenderFrameHostImpl::JavaScriptDialogClosed, weak_ptr_factory_.GetWeakPtr(), std::move(ipc_callback_wrapper)); delegate_->RunBeforeUnloadConfirm(this, is_reload, std::move(dialog_closed_callback)); } void RenderFrameHostImpl::MaybeStartOutermostMainFrameNavigation( const std::vector& urls) { static const bool kWarmUpEnabled = base::FeatureList::IsEnabled( blink::features::kSpeculativeServiceWorkerWarmUp); static const bool kHttpDiskCachePrewarmingEnabled = base::FeatureList::IsEnabled(blink::features::kHttpDiskCachePrewarming) && !blink::features::kHttpDiskCachePrewarmingTriggerOnNavigation.Get(); if (!kWarmUpEnabled && !kHttpDiskCachePrewarmingEnabled) { return; } TRACE_EVENT0("navigation", "RenderFrameHostImpl::MaybeStartOutermostMainFrameNavigation"); // Disallow service worker start-up nor warm-up when there are other // windows that might script with this frame to mitigate security and // privacy concerns. if (site_instance_->GetRelatedActiveContentsCount() > 1u) { return; } ServiceWorkerContextWrapper* context = GetStoragePartition()->GetServiceWorkerContext(); if (!context) { return; } for (const auto& url : urls) { GURL filtered_url(url); if (GetProcess()->FilterURL(/*empty_allowed=*/false, &filtered_url) == RenderProcessHost::FilterURLResult::kBlocked) { continue; } if (filtered_url.SchemeIsHTTPOrHTTPS()) { GetContentClient()->browser()->MaybePrewarmHttpDiskCache( *GetBrowserContext(), GetLastCommittedOrigin(), filtered_url); } if (!OriginCanAccessServiceWorkers(filtered_url)) { continue; } const blink::StorageKey key = blink::StorageKey::CreateFirstParty(url::Origin::Create(filtered_url)); if (!context->MaybeHasRegistrationForStorageKey(key)) { continue; } // Ask the service worker context to speculatively warm-up a service worker // for the request URL if necessary for optimization purposes. There are // cases where we have already started the service worker (e.g, Prerendering // or the previous navigation already started the service worker), but this // call does nothing if the service worker already started for the URL. if (kWarmUpEnabled) { context->WarmUpServiceWorker(filtered_url, key, base::DoNothing()); } } } // TODO(crbug.com/40183812): Move this method to content::PageImpl. void RenderFrameHostImpl::UpdateFaviconURL( std::vector favicon_urls, blink::mojom::FaviconUpdateReason reason) { // This message should only be sent for top-level frames. Suppress favicon // updates if the message was sent for a discarded document. CHECK(!GetParent()); if (document_associated_data_->is_discarded()) { return; } GetPage().set_favicon_urls(std::move(favicon_urls)); delegate_->UpdateFaviconURL(this, GetPage().favicon_urls(), reason); } float RenderFrameHostImpl::GetPageScaleFactor() const { CHECK(!GetParent()); return page_scale_factor_; } void RenderFrameHostImpl::ScaleFactorChanged(float scale) { // TODO(526685428): CHECK-exclusion: Convert to a CHECK once we are confident // it won't be triggered. DCHECK(!GetParent()); page_scale_factor_ = scale; delegate_->OnPageScaleFactorChanged(GetPage()); } void RenderFrameHostImpl::ContentsPreferredSizeChanged( const gfx::Size& pref_size) { // Do not try to handle the message in inactive RenderFrameHosts for // simplicity. If this RenderFrameHost belongs to a bfcached or prerendered // page, the page will be deleted. We predict that it will not significantly // impact coverage because renderers only send this message when running in // `PreferredSizeChanged` mode. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kContentsPreferredSizeChanged)) { return; } // Ignore the request if we are aren't the outermost main frame. if (GetParentOrOuterDocument()) { return; } delegate_->UpdateWindowPreferredSize(this, pref_size); } void RenderFrameHostImpl::FocusPage() { render_view_host_->OnFocus(); } void RenderFrameHostImpl::TakeFocus(bool reverse) { // TODO(crbug.com/40188381): Consider moving this to PageImpl. CHECK(is_main_frame()); // Do not update the parent on behalf of the inactive document. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kDispatchLoad)) { return; } // If we are representing an inner frame tree call advance on our outer // delegate's parent's RenderFrameHost. RenderFrameHostImpl* parent_or_outer_document = GetParentOrOuterDocumentOrEmbedder(); if (parent_or_outer_document) { RenderFrameProxyHost* proxy_host = GetProxyToOuterDelegate(); CHECK(proxy_host); if (HasTransientUserActivation() || FocusSourceHasTransientUserActivation()) { parent_or_outer_document->ActivateFocusSourceUserActivation(); focus_source_user_activation_state_.Deactivate(); } parent_or_outer_document->DidFocusFrame(); parent_or_outer_document->AdvanceFocus( reverse ? blink::mojom::FocusType::kBackward : blink::mojom::FocusType::kForward, proxy_host); return; } render_view_host_->OnTakeFocus(reverse); } void RenderFrameHostImpl::UpdateTargetURL( const GURL& url, blink::mojom::LocalMainFrameHost::UpdateTargetURLCallback callback) { // An inactive document should ignore to update the target url. if (!IsActive()) { std::move(callback).Run(); return; } delegate_->UpdateTargetURL(this, url); std::move(callback).Run(); } void RenderFrameHostImpl::RequestClose() { // The renderer already ensures that this can only be called on an outermost // main frame - see DOMWindow::Close(). Terminate the renderer if this is // not the case. if (!IsOutermostMainFrame()) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_WINDOW_CLOSE_ON_NON_OUTERMOST_FRAME); return; } // If the renderer is telling us to close, it has already run the unload // events, and we can take the fast path. ClosePageIgnoringUnloadEvents(ClosePageSource::kRenderer); } bool RenderFrameHostImpl::HasStickyUserActivation() const { return user_activation_state_.HasBeenActive(); } bool RenderFrameHostImpl::IsActiveUserActivation() const { return user_activation_state_.IsActive(); } void RenderFrameHostImpl::ClearUserActivation() { user_activation_state_.Clear(); history_user_activation_state_.Clear(); GetMainFrame()->honor_sticky_activation_for_history_intervention_ = true; last_user_activation_consumed_time_ = base::TimeTicks(); } void RenderFrameHostImpl::ConsumeTransientUserActivation() { if (user_activation_state_.ConsumeIfActive()) { last_user_activation_consumed_time_ = base::TimeTicks::Now(); } } void RenderFrameHostImpl::ActivateUserActivation( blink::mojom::UserActivationNotificationType notification_type, bool sticky_only) { if (sticky_only) { user_activation_state_.SetHasBeenActive(); } else { user_activation_state_.Activate(notification_type); history_user_activation_state_.Activate(); } GetMainFrame()->honor_sticky_activation_for_history_intervention_ = true; } void RenderFrameHostImpl::ActivateFocusSourceUserActivation() { focus_source_user_activation_state_.Activate(); } bool RenderFrameHostImpl::IsHistoryUserActivationActive() const { return history_user_activation_state_.IsActive(); } void RenderFrameHostImpl::ConsumeHistoryUserActivation() { history_user_activation_state_.Consume(); } void RenderFrameHostImpl::DeactivateFocusSourceUserActivation() { focus_source_user_activation_state_.Deactivate(); } bool RenderFrameHostImpl::HasStickyUserActivationForHistoryIntervention() const { CHECK(is_main_frame()); if (honor_sticky_activation_for_history_intervention_) { return HasStickyUserActivation(); } return false; } void RenderFrameHostImpl::ClosePage( ClosePageSource source, base::RepeatingClosure completion_callback) { // This path is taken when tab/window close is initiated by either the // browser process or via a window.close() call through a proxy. In both // cases, we need to tell the main frame's renderer process to run unload // handlers and prepare for page close. // // This should only be called on outermost main frames. If this // RenderFrameHost is no longer an active main frame (e.g., if it was placed // into back-forward cache or became pending deletion just before getting // here), we should not close the active tab if the request to close came from // the renderer, so return early in that case. We proceed with closing // regardless if the request came from the browser so that renderers can't // avoid closing via navigation. CHECK(is_main_frame()); CHECK(IsOutermostMainFrame()); if (!IsActive() && source == ClosePageSource::kRenderer) { return; } page_close_state_ = PageCloseState::kRunningUnloadHandlers; if (IsRenderFrameLive() && !IsPageReadyToBeClosed()) { close_timeout_ = std::make_unique( base::BindRepeating(&RenderFrameHostImpl::ClosePageTimeout, weak_ptr_factory_.GetWeakPtr(), source, completion_callback), GetUIThreadTaskRunner({BrowserTaskType::kUserInput})); close_timeout_->Start(kUnloadTimeout); GetAssociatedLocalMainFrame()->ClosePage(base::BindOnce( &RenderFrameHostImpl::ClosePageIgnoringUnloadEvents, weak_ptr_factory_.GetWeakPtr(), source, completion_callback)); } else { // This RenderFrameHost doesn't have a live renderer (or has already run // unload handlers), so just skip the close event and close the page. ClosePageIgnoringUnloadEvents(source, completion_callback); } } void RenderFrameHostImpl::ClosePageIgnoringUnloadEvents( ClosePageSource source, base::RepeatingClosure completion_callback) { if (close_timeout_) { close_timeout_->Stop(); close_timeout_.reset(); } // For prerendered pages, if window.close is called, it should be cancelled. if (lifecycle_state_ == LifecycleStateImpl::kPrerendering && source == ClosePageSource::kRenderer) { CancelPrerendering( PrerenderCancellationReason(PrerenderFinalStatus::kWindowClosed)); } // If this RenderFrameHost is no longer active (e.g., if it // was replaced by another frame while waiting for the ClosePage ACK or // timeout), there's no need to close the active tab if the request to close // came from the renderer, so return early in that case. We proceed with // closing regardless if the request came from the browser so that renderers // can't avoid closing via navigation. if (!IsActive() && source == ClosePageSource::kRenderer) { page_close_state_ = PageCloseState::kNotClosing; return; } page_close_state_ = PageCloseState::kReadyToBeClosed; // If this is triggered by an intended prerender cancellation, it should not // close the WebContents. For the same tab case, closing WebContents will // close the initiator. As for the new tab case, WebContents will be destroyed // with `PrerenderNewTabHandle`, so no need to close it explicitly. if (lifecycle_state_ == LifecycleStateImpl::kPrerendering && source == ClosePageSource::kPrerenderDiscard) { completion_callback.Run(); return; } delegate_->Close(this); } bool RenderFrameHostImpl::IsPageReadyToBeClosed() { if (lifecycle_state_ != LifecycleStateImpl::kPrerendering) { CHECK(IsInPrimaryMainFrame()); } // If there is a JavaScript dialog up, don't bother sending the renderer the // close event because it is known unresponsive, waiting for the reply from // the dialog. return page_close_state_ == PageCloseState::kReadyToBeClosed || delegate_->IsJavaScriptDialogShowing() || BeforeUnloadTimedOut(); } void RenderFrameHostImpl::ClosePageTimeout( ClosePageSource source, base::RepeatingClosure completion_callback) { if (source == ClosePageSource::kRenderer && delegate_->ShouldIgnoreUnresponsiveRenderer()) { return; } ClosePageIgnoringUnloadEvents(source, completion_callback); } void RenderFrameHostImpl::SetWindowRect(const gfx::Rect& bounds, SetWindowRectCallback callback) { // Prerendering pages should not reach this code. if (lifecycle_state_ == LifecycleStateImpl::kPrerendering) { local_main_frame_host_receiver_.ReportBadMessage( "SetWindowRect called during prerendering."); return; } // Always ack the renderer so it can clear its pending window rect, even on // the early-return paths below. base::ScopedClosureRunner ack(std::move(callback)); // An inactive document (e.g. one that has entered the back/forward cache) // must not move or resize the window, which now hosts a different primary // main frame. We use ValidateOutermostMainFrameWindowChange to evict the // page from BFCache if this happens, to prevent the renderer from getting // out of sync with the browser's window bounds if the page is later // restored. See https://crbug.com/502232151. if (!ValidateOutermostMainFrameWindowChange("SetWindowRect")) { return; } delegate_->SetWindowRect(bounds); } void RenderFrameHostImpl::MoveWindowTo(const gfx::Point& origin, MoveWindowToCallback callback) { if (!base::FeatureList::IsEnabled(blink::features::kMoveResizeWindowToIPCs)) { local_main_frame_host_receiver_.ReportBadMessage( "MoveWindowTo received while kMoveResizeWindowToIPCs is disabled."); return; } // Always ack the renderer so it can clear its pending window rect, even on // the early-return paths below. base::ScopedClosureRunner ack(std::move(callback)); if (!ValidateOutermostMainFrameWindowChange("MoveWindowTo")) { return; } delegate_->MoveWindowTo(origin); } void RenderFrameHostImpl::ResizeWindowTo(const gfx::Size& size, ResizeWindowToCallback callback) { if (!base::FeatureList::IsEnabled(blink::features::kMoveResizeWindowToIPCs)) { local_main_frame_host_receiver_.ReportBadMessage( "ResizeWindowTo received while kMoveResizeWindowToIPCs is disabled."); return; } // Always ack the renderer so it can clear its pending window rect, even on // the early-return paths below. base::ScopedClosureRunner ack(std::move(callback)); if (!ValidateOutermostMainFrameWindowChange("ResizeWindowTo")) { return; } delegate_->ResizeWindowTo(size); } bool RenderFrameHostImpl::ValidateOutermostMainFrameWindowChange( std::string_view method_name) { if (GetParentOrOuterDocument()) { local_main_frame_host_receiver_.ReportBadMessage( base::StrCat({method_name, " called from child frame."})); return false; } // BFCache / pending deletion / crashed renderer: not a renderer fault, // just stale state. Drop the request silently. See crbug.com/512533947. if (!IsRenderFrameLive() || IsInactiveAndDisallowActivation( DisallowActivationReasonId::kWindowPlacement)) { return false; } return true; } void RenderFrameHostImpl::DidFirstVisuallyNonEmptyPaint() { // TODO(crbug.com/40188381): Consider moving this to PageImpl. CHECK(is_main_frame()); GetPage().OnFirstVisuallyNonEmptyPaint(); } void RenderFrameHostImpl::DownloadURL( blink::mojom::DownloadURLParamsPtr blink_parameters) { // TODO(crbug.com/40180431): We should defer the download until the // prerendering page is activated, and it will comply with the prerendering // spec. if (CancelPrerendering( PrerenderCancellationReason(PrerenderFinalStatus::kDownload))) { return; } if (!VerifyDownloadUrlParams(GetProcess(), *blink_parameters)) { return; } net::NetworkTrafficAnnotationTag traffic_annotation = net::DefineNetworkTrafficAnnotation("renderer_initiated_download", R"( semantics { sender: "Download from Renderer" description: "The frame has either navigated to a URL that was determined to be " "a download via one of the renderer's classification mechanisms, " "or WebView has requested a or element at a " "specific location be to downloaded." trigger: "The user navigated to a destination that was categorized as a " "download, or WebView triggered saving a or tag." data: "Only the URL we are attempting to download." destination: WEBSITE } policy { cookies_allowed: YES cookies_store: "user" setting: "This feature cannot be disabled by settings." chrome_policy { DownloadRestrictions { DownloadRestrictions: 3 } } })"); std::unique_ptr parameters = CreateDownloadUrlParameters(blink_parameters->url, traffic_annotation); // Downloads arriving through this IPC handler always originate from web // content. parameters->set_content_initiated(true); parameters->set_has_user_gesture(blink_parameters->has_user_gesture && HasTransientUserActivation()); parameters->set_suggested_name( blink_parameters->suggested_name.value_or(std::u16string())); parameters->set_prompt(blink_parameters->should_prompt_for_save_location); parameters->set_cross_origin_redirects( blink_parameters->cross_origin_redirects); parameters->set_referrer( blink_parameters->referrer ? blink_parameters->referrer->url : GURL()); parameters->set_referrer_policy(Referrer::ReferrerPolicyForUrlRequest( blink_parameters->referrer ? blink_parameters->referrer->policy : network::mojom::ReferrerPolicy::kDefault)); parameters->set_initiator( blink_parameters->initiator_origin.value_or(url::Origin())); parameters->set_download_source(download::DownloadSource::FROM_RENDERER); if (blink_parameters->data_url_blob) { DataURLBlobReader::ReadDataURLFromBlob( std::move(blink_parameters->data_url_blob), base::BindOnce(&OnDataURLRetrieved, std::move(parameters))); return; } scoped_refptr blob_url_loader_factory; if (blink_parameters->blob_url_token) { blob_url_loader_factory = ChromeBlobStorageContext::URLLoaderFactoryForToken( GetStoragePartition(), std::move(blink_parameters->blob_url_token)); } devtools_instrumentation::ApplyNetworkOverridesForDownload(this, parameters.get()); StartDownload(std::move(parameters), std::move(blob_url_loader_factory)); } void RenderFrameHostImpl::ShowCaptionSettings() { // Showing caption settings is a user-visible action, so it should not happen // for a frame that is prerendering or in the BFCache. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kShowCaptionSettings)) { return; } if (!HasTransientUserActivation()) { // Require user gesture to show caption settings. return; } // Depending on the platform, the embedder either opens a native dialog or // navigates a new tab to the caption settings page. Neither should be // reachable from a frame sandboxed without "allow-popups". if (IsSandboxed(network::mojom::WebSandboxFlags::kPopups)) { return; } GetContentClient()->browser()->ShowCaptionSettings(this); } void RenderFrameHostImpl::ReportNoBinderForInterface(const std::string& error) { CHECK(broker_holder_); broker_holder_->broker_receiver().ReportBadMessage( error + " for the frame/document scope"); } ukm::SourceId RenderFrameHostImpl::GetPageUkmSourceId() { CHECK(!IsInLifecycleState(LifecycleState::kPrerendering)); // This id for all subframes or fenced frames is the same as the id for the // outermost main frame. int64_t navigation_id = GetOutermostMainFrame()->last_committed_cross_document_navigation_id_; if (navigation_id == -1) { return ukm::kInvalidSourceId; } return ukm::ConvertToSourceId(navigation_id, ukm::SourceIdType::NAVIGATION_ID); } BrowserContext* RenderFrameHostImpl::GetBrowserContext() { return GetProcess()->GetBrowserContext(); } // TODO(crbug.com/40134294): Would be better to do this directly in the chrome // layer. See referenced bug for further details. void RenderFrameHostImpl::ReportInspectorIssue( blink::mojom::InspectorIssueInfoPtr info) { devtools_instrumentation::BuildAndReportBrowserInitiatedIssue( this, std::move(info)); } void RenderFrameHostImpl::WriteIntoTrace( perfetto::TracedProto proto) const { proto.Set(TraceProto::kRenderFrameHostId, GetGlobalId()); proto->set_frame_tree_node_id(GetFrameTreeNodeId().value()); proto->set_lifecycle_state(LifecycleStateToProto()); proto->set_frame_type(GetFrameTypeProto()); proto->set_origin(GetLastCommittedOrigin().GetDebugString()); proto->set_url(GetLastCommittedURL().possibly_invalid_spec()); proto.Set(TraceProto::kProcess, GetProcess()); proto.Set(TraceProto::kSiteInstance, GetSiteInstance()); if (auto* parent = GetParent()) { proto.Set(TraceProto::kParent, parent); } else if (auto* outer_document = GetParentOrOuterDocument()) { proto.Set(TraceProto::kOuterDocument, outer_document); outer_document->WriteIntoTrace(proto.WriteNestedMessage( perfetto::protos::pbzero::RenderFrameHost::kOuterDocument)); } else if (auto* embedder = GetParentOrOuterDocumentOrEmbedder()) { proto.Set(TraceProto::kEmbedder, embedder); embedder->WriteIntoTrace(proto.WriteNestedMessage( perfetto::protos::pbzero::RenderFrameHost::kEmbedder)); } proto.Set(TraceProto::kBrowsingContextState, browsing_context_state_); } perfetto::protos::pbzero::RenderFrameHost::LifecycleState RenderFrameHostImpl::LifecycleStateToProto() const { using RFHProto = perfetto::protos::pbzero::RenderFrameHost; switch (lifecycle_state()) { case LifecycleStateImpl::kSpeculative: return RFHProto::SPECULATIVE; case LifecycleStateImpl::kPendingCommit: return RFHProto::PENDING_COMMIT; case LifecycleStateImpl::kPrerendering: return RFHProto::PRERENDERING; case LifecycleStateImpl::kActive: return RFHProto::ACTIVE; case LifecycleStateImpl::kInBackForwardCache: return RFHProto::IN_BACK_FORWARD_CACHE; case LifecycleStateImpl::kRunningUnloadHandlers: return RFHProto::RUNNING_UNLOAD_HANDLERS; case LifecycleStateImpl::kReadyToBeDeleted: return RFHProto::READY_TO_BE_DELETED; } return RFHProto::UNSPECIFIED; } perfetto::protos::pbzero::FrameTreeNodeInfo::FrameType RenderFrameHostImpl::GetFrameTypeProto() const { using RFHProto = perfetto::protos::pbzero::FrameTreeNodeInfo; if (GetParent()) { return RFHProto::SUBFRAME; } if (GetPage().IsPrimary()) { return RFHProto::PRIMARY_MAIN_FRAME; } if (lifecycle_state() == LifecycleStateImpl::kPrerendering) { return RFHProto::PRERENDER_MAIN_FRAME; } if (IsFencedFrameRoot()) { return RFHProto::FENCED_FRAME_ROOT; } // It returns a different value from FrameTreeNode::GetFrameType() when // - `this` is a speculative RFH or // - `this` is not in a frame tree (e.g., IsInBackForwardCache() or // IsPendingDeletion()). return RFHProto::UNSPECIFIED_FRAME_TYPE; } StoragePartitionImpl* RenderFrameHostImpl::GetStoragePartition() { // Both RenderProcessHostImpl and MockRenderProcessHost obtain the // StoragePartition instance through BrowserContext::GetStoragePartition() // call. That method does not support creating TestStoragePartition // instances and always vends StoragePartitionImpl objects. It is therefore // safe to static cast the result here. return static_cast( GetProcess()->GetStoragePartition()); } void RenderFrameHostImpl::RequestTextSurroundingSelection( blink::mojom::LocalFrame::GetTextSurroundingSelectionCallback callback, int max_length) { CHECK(!callback.is_null()); GetAssociatedLocalFrame()->GetTextSurroundingSelection(max_length, std::move(callback)); } bool RenderFrameHostImpl::HasCommittingNavigationRequestForOrigin( const url::Origin& origin, NavigationRequest* navigation_request_to_exclude) { for (const auto& it : navigation_requests_) { NavigationRequest* request = it.first; if (request != navigation_request_to_exclude && request->HasCommittingOrigin(origin)) { return true; } } // Note: this function excludes |same_document_navigation_requests_|, which // should be ok since these cannot change the origin. return false; } void RenderFrameHostImpl::SendInterventionReport(const std::string& id, const std::string& message, RenderFrameHost* child_frame) { if (!child_frame) { GetAssociatedLocalFrame()->SendInterventionReport( id, message, /*child_frame_token=*/std::nullopt); return; } CHECK_EQ(child_frame->GetParent(), this); RenderFrameProxyHost* child_frame_proxy_host = static_cast(child_frame)->GetProxyToParent(); blink::FrameToken child_frame_token; if (child_frame_proxy_host) { child_frame_token = child_frame_proxy_host->GetFrameToken(); } else { child_frame_token = child_frame->GetFrameToken(); } GetAssociatedLocalFrame()->SendInterventionReport(id, message, child_frame_token); } WebUI* RenderFrameHostImpl::GetWebUI() { return web_ui(); } void RenderFrameHostImpl::AllowBindings(BindingsPolicySet bindings) { // Never grant any bindings to browser plugin guests. if (GetProcess()->IsForGuestsOnly()) { NOTREACHED() << "Never grant bindings to a guest process."; } TRACE_EVENT2("navigation", "RenderFrameHostImpl::AllowBindings", "render_frame_host", this, "bindings_flags", bindings.ToEnumBitmask()); BindingsPolicySet webui_bindings = Intersection(bindings, kWebUIBindingsPolicySet); // Ensure callers that specify non-zero WebUI bindings are doing so on a // RenderFrameHost that has WebUI associated with it. If we run the renderer // code in-process, the security invariant cannot be enforced, therefore it // should be skipped in that case. if (!webui_bindings.empty() && !RenderProcessHost::run_renderer_in_process()) { ProcessLock process_lock = GetProcess()->GetProcessLock(); if (!process_lock.IsLockedToSite() || !std::ranges::contains(URLDataManagerBackend::GetWebUISchemes(), process_lock.GetProcessLockURL().GetScheme())) { SCOPED_CRASH_KEY_STRING256("AllowBindings", "process_lock", process_lock.ToString()); NOTREACHED() << "Calling AllowBindings for a process not locked to WebUI:" << process_lock; } } // The bindings being granted here should not differ from the bindings that // the associated WebUI requires. if (web_ui_) { CHECK_EQ(web_ui_->GetBindings(), webui_bindings); } // Ensure we aren't granting WebUI bindings to a process that has already been // used to host other content. if (!webui_bindings.empty() && GetProcess()->IsInitializedAndNotDead() && !ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings( GetProcess()->GetDeprecatedID())) { // This process has no bindings yet. Make sure it does not have any frames // that have committed a navigation, since bindings should always be granted // prior to committing the first WebUI navigation in a process. This is a // defense-in-depth check complementing the site isolation process lock // checks above and in places like RenderProcessHostImpl::IsSuitableHost(). // --single-process only has one renderer, so it is exempt from this check. size_t non_empty_frame_count = 0; GetProcess()->ForEachRenderFrameHost( [&non_empty_frame_count](RenderFrameHost* rfh) { if (!static_cast(rfh) ->is_initial_empty_document()) { ++non_empty_frame_count; } }); if (non_empty_frame_count > 0 && !base::CommandLine::ForCurrentProcess()->HasSwitch( switches::kSingleProcess)) { return; } } if (!webui_bindings.empty()) { ChildProcessSecurityPolicyImpl::GetInstance()->GrantWebUIBindings( GetProcess()->GetDeprecatedID(), webui_bindings); } enabled_bindings_.PutAll(bindings); if (is_render_frame_created()) { GetFrameBindingsControl()->AllowBindings(enabled_bindings_.ToEnumBitmask()); if (web_ui_ && enabled_bindings_.Has(BindingsPolicyValue::kWebUi)) { web_ui_->SetUpMojoConnection(); } } } BindingsPolicySet RenderFrameHostImpl::GetEnabledBindings() { return enabled_bindings_; } void RenderFrameHostImpl::SetWebUIProperty(const std::string& name, const std::string& value) { // WebUI allows to register SetProperties only for the outermost main frame. if (GetParentOrOuterDocument()) { return; } // This is a sanity check before telling the renderer to enable the property. // It could lie and send the corresponding IPC messages anyway, but we will // not act on them if enabled_bindings_ doesn't agree. If we get here without // WebUI bindings, terminate the renderer process. if (enabled_bindings_.Has(BindingsPolicyValue::kWebUi)) { web_ui_->SetProperty(name, value); } else { ReceivedBadMessage(GetProcess(), bad_message::RVH_WEB_UI_BINDINGS_MISMATCH); } } bool RenderFrameHostImpl::CouldDisplayBeforeUnloadDialog() const { return has_before_unload_handler_ && HasStickyUserActivation(); } void RenderFrameHostImpl::DisableBeforeUnloadHangMonitorForTesting() { beforeunload_timeout_.reset(); } bool RenderFrameHostImpl::IsBeforeUnloadHangMonitorDisabledForTesting() { return !beforeunload_timeout_; } void RenderFrameHostImpl::DoNotDeleteForTesting() { do_not_delete_for_testing_ = true; } void RenderFrameHostImpl::ResumeDeletionForTesting() { do_not_delete_for_testing_ = false; } void RenderFrameHostImpl::DetachForTesting() { do_not_delete_for_testing_ = false; RenderFrameHostImpl::Detach(); } bool RenderFrameHostImpl::IsFeatureEnabled( network::mojom::PermissionsPolicyFeature feature) { return permissions_policy_ && permissions_policy_->IsFeatureEnabledForOrigin( feature, GetLastCommittedOrigin()); } const network::PermissionsPolicy* RenderFrameHostImpl::GetPermissionsPolicy() { return permissions_policy_.get(); } const network::ParsedPermissionsPolicy& RenderFrameHostImpl::GetPermissionsPolicyHeader() { return permissions_policy_header_; } void RenderFrameHostImpl::ViewSource() { delegate_->ViewSource(this); } void RenderFrameHostImpl::FlushNetworkAndNavigationInterfacesForTesting( bool do_nothing_if_no_network_service_connection) { if (do_nothing_if_no_network_service_connection && !network_service_disconnect_handler_holder_) { return; } CHECK(network_service_disconnect_handler_holder_); network_service_disconnect_handler_holder_.FlushForTesting(); // IN-TEST CHECK(IsRenderFrameLive()); CHECK(frame_); frame_.FlushForTesting(); // IN-TEST } void RenderFrameHostImpl::PrepareForInnerWebContentsAttach( PrepareForInnerWebContentsAttachCallback callback) { // TODO(crbug.com/40252449) Explain why `owner_` exists. CHECK(owner_); owner_->GetRenderFrameHostManager().PrepareForInnerDelegateAttach( std::move(callback)); } // UpdateSubresourceLoaderFactories may be called (internally/privately), when // RenderFrameHostImpl detects a NetworkService crash after pushing a // NetworkService-based factory to the renderer process. It may also be called // when DevTools wants to send to the renderer process a fresh factory bundle // (e.g. after injecting DevToolsURLLoaderInterceptor) - the latter scenario may // happen even if `this` RenderFrameHostImpl has not pushed any NetworkService // factories to the renderer process (DevTools is agnostic to this). void RenderFrameHostImpl::UpdateSubresourceLoaderFactories() { // Disregard this if frame is being destroyed. if (!frame_) { return; } // Disregard if the IPC payload would have been empty. // // Examples of when this can happen: // 1. DevTools tries to inject its proxies by calling this method on *all* // frames, regardless of whether a frame has actually used one or more // NetworkService-based URLLoaderFactory. See also // RenderFrameDevToolsAgentHost::UpdateResourceLoaderFactories. // 2. The RenderFrameHostImpl::CreateNetworkServiceDefaultFactory method // (exposed via //content/public) is called on a frame that doesn't // actually use a NetworkService-backed URLLoaderFactory. This means // that CreateNetworkServiceDefaultFactoryAndObserve sets up // `network_service_disconnect_handler_holder_`, but // `recreate_default_url_loader_factory_after_network_service_crash_` is // false. if (!recreate_default_url_loader_factory_after_network_service_crash_ && isolated_worlds_requiring_separate_url_loader_factory_.empty()) { return; } // The `subresource_loader_factories_config` of the new factories might need // to depend on the pending (rather than the last committed) navigation, // because we can't predict if an in-flight Commit IPC might be present when // an extension injects a content script and MarkIsolatedWorlds... is called. // See also the doc comment for the ForPendingOrLastCommittedNavigation // method. auto subresource_loader_factories_config = SubresourceLoaderFactoriesConfig::ForPendingOrLastCommittedNavigation( *this); mojo::PendingRemote default_factory_remote; bool bypass_redirect_checks = false; if (recreate_default_url_loader_factory_after_network_service_crash_) { CHECK(!IsOutOfProcessNetworkService() || network_service_disconnect_handler_holder_.is_bound()); bypass_redirect_checks = CreateNetworkServiceDefaultFactoryAndObserve( CreateURLLoaderFactoryParamsForMainWorld( subresource_loader_factories_config, "RFHI::UpdateSubresourceLoaderFactories"), subresource_loader_factories_config.ukm_source_id(), default_factory_remote.InitWithNewPipeAndPassReceiver()); } std::unique_ptr subresource_loader_factories = std::make_unique( std::move(default_factory_remote), blink::PendingURLLoaderFactoryBundle::SchemeMap(), CreateURLLoaderFactoriesForIsolatedWorlds( subresource_loader_factories_config, isolated_worlds_requiring_separate_url_loader_factory_), /*local_resource_loader_config=*/nullptr, bypass_redirect_checks); GetMojomFrameInRenderer()->UpdateSubresourceLoaderFactories( std::move(subresource_loader_factories)); // UpdateSubresourceLoaderFactories() above will not be able to update the // factory used by fetch keepalive requests after https://crbug.com/1356128. // The following block replaces the in-browser fetch keepalive factory (shared // with other subresource loading, e.g. prefetch) with a new dedicated and // intercepted factory. if (document_associated_data_->keep_alive_url_loader_factory_context()) { auto keep_alive_url_loader_factory_bundle = std::make_unique(); keep_alive_url_loader_factory_bundle->set_bypass_redirect_checks( CreateNetworkServiceDefaultFactory( keep_alive_url_loader_factory_bundle->pending_default_factory() .InitWithNewPipeAndPassReceiver())); document_associated_data_->keep_alive_url_loader_factory_context() ->UpdateFactory(network::SharedURLLoaderFactory::Create( std::move(keep_alive_url_loader_factory_bundle))); } } void RenderFrameHostImpl::UpdateLocalResourceLoader( blink::mojom::LocalResourceLoaderConfigPtr loader_config) { local_resource_loader_config_ = loader_config.Clone(); } blink::FrameOwnerElementType RenderFrameHostImpl::GetFrameOwnerElementType() { return frame_owner_element_type_; } bool RenderFrameHostImpl::HasTransientUserActivation() { return user_activation_state_.IsActive(); } bool RenderFrameHostImpl::FocusSourceHasTransientUserActivation() { return focus_source_user_activation_state_.IsActive(); } void RenderFrameHostImpl::NotifyUserActivation( blink::mojom::UserActivationNotificationType notification_type) { GetAssociatedLocalFrame()->NotifyUserActivation(notification_type); } void RenderFrameHostImpl::DidAccessInitialMainDocument() { frame_tree_->DidAccessInitialMainDocument(); } void RenderFrameHostImpl::DidChangeThemeColor( std::optional theme_color) { // TODO(crbug.com/40188381): Consider moving this to PageImpl. GetPage().OnThemeColorChanged(theme_color); } void RenderFrameHostImpl::DidChangeBackgroundColor( const SkColor4f& background_color, bool color_adjust) { // TODO(crbug.com/40188381): Consider moving this to PageImpl. GetPage().DidChangeBackgroundColor(background_color, color_adjust); } void RenderFrameHostImpl::DidChangeName(const std::string& name, const std::string& unique_name) { // Frame name updates used to occur in the FrameTreeNode; however, as they // now occur in RenderFrameHostImpl (and by extension, BrowsingContextState), // ensure that invalid updates (i.e. when in the BackForwardCache or in a // pending deletion state) are not applied. if (IsInBackForwardCache() || IsPendingDeletion()) { return; } if (GetParent() != nullptr) { // TODO(lukasza): Call ReceivedBadMessage when |unique_name| is empty. CHECK(!unique_name.empty()); } TRACE_EVENT2("navigation", "RenderFrameHostImpl::OnDidChangeName", "render_frame_host", this, "name", name); std::string old_name = browsing_context_state_->frame_name(); browsing_context_state_->SetFrameName(name, unique_name); if (old_name.empty() && !name.empty()) { frame_tree_node_->render_manager()->CreateProxiesForNewNamedFrame( browsing_context_state_); } delegate_->DidChangeName(this, name); } void RenderFrameHostImpl::EnforceInsecureRequestPolicy( blink::mojom::InsecureRequestPolicy policy) { if (!CanApplyFrameReplicationUpdate( this, BackForwardCacheMetrics::NotRestoredReason:: kRfhEnforceInsecureRequestPolicy)) { return; } browsing_context_state_->SetInsecureRequestPolicy(policy); } void RenderFrameHostImpl::EnforceInsecureNavigationsSet( const std::vector& set) { if (!CanApplyFrameReplicationUpdate( this, BackForwardCacheMetrics::NotRestoredReason:: kRfhEnforceInsecureNavigationsSet)) { return; } browsing_context_state_->SetInsecureNavigationsSet(set); } FrameTreeNode* RenderFrameHostImpl::FindAndVerifyChild( int32_t child_frame_routing_id, bad_message::BadMessageReason reason) { auto child_frame_or_proxy = LookupRenderFrameHostOrProxy( GetProcess()->GetDeprecatedID(), child_frame_routing_id); return FindAndVerifyChildInternal(child_frame_or_proxy, reason); } FrameTreeNode* RenderFrameHostImpl::FindAndVerifyChild( const blink::FrameToken& child_frame_token, bad_message::BadMessageReason reason) { auto child_frame_or_proxy = LookupRenderFrameHostOrProxy( GetProcess()->GetDeprecatedID(), child_frame_token); return FindAndVerifyChildInternal(child_frame_or_proxy, reason); } FrameTreeNode* RenderFrameHostImpl::FindAndVerifyChildInternal( RenderFrameHostOrProxy child_frame_or_proxy, bad_message::BadMessageReason reason) { // A race can result in |child| to be nullptr. Avoid killing the renderer in // that case. if (!child_frame_or_proxy) { return nullptr; } if (&child_frame_or_proxy.GetFrameTreeNode()->frame_tree() != frame_tree()) { // Ignore the cases when the child lives in a different frame tree. // This is possible when we create a proxy for inner WebContents so the // |child_frame_or_proxy| points to the root frame of the nested // WebContents, which is in a different tree. // TODO(altimin, lfg): Reconsider what the correct behaviour here should be. return nullptr; } if (child_frame_or_proxy.GetFrameTreeNode()->parent() != this) { bad_message::ReceivedBadMessage(GetProcess(), reason); return nullptr; } return child_frame_or_proxy.GetFrameTreeNode(); } void RenderFrameHostImpl::UpdateTitle( const std::optional& title) { // This message should only be sent for top-level frames. Suppress title // updates if the message was sent for a discarded document. if (!is_main_frame() || document_associated_data_->is_discarded()) { return; } std::u16string received_title; if (title.has_value()) { received_title = title.value(); } if (received_title.length() > blink::mojom::kMaxTitleChars) { mojo::ReportBadMessage("Renderer sent too many characters in title."); return; } delegate_->UpdateTitle(this, received_title); } // Update application title. void RenderFrameHostImpl::UpdateApplicationTitle( const std::u16string& application_title) { delegate_->UpdateApplicationTitle(this, application_title); } void RenderFrameHostImpl::DidInferColorScheme( blink::mojom::PreferredColorScheme color_scheme) { if (is_main_frame()) { GetPage().DidInferColorScheme(color_scheme); } } void RenderFrameHostImpl::OnFirstContentfulPaint( base::TimeTicks presentation_time) { GetPage().SetFirstContentfulPaintInMainDocumentTime(presentation_time); NotifyFirstContentfulPaint(presentation_time); } void RenderFrameHostImpl::NotifyFirstContentfulPaint( base::TimeTicks presentation_time) { if (IsInPrimaryMainFrame()) { // Notify the delegates of the FCP. Note that the notifications for // prerendering pages will be deferred until activation. delegate_->OnFirstContentfulPaintInPrimaryMainFrame(presentation_time); } } void RenderFrameHostImpl::OnLargestContentfulPaint( base::TimeTicks presentation_time) { if (IsInPrimaryMainFrame()) { // Notify the delegates of the LCP candidate update. Note that, unlike FCP, // candidate updates that occur while prerendering are not re-dispatched on // activation; they are simply not forwarded. delegate_->OnLargestContentfulPaintInPrimaryMainFrame(presentation_time); } } void RenderFrameHostImpl::SetStorageAccessApiStatus( net::StorageAccessApiStatus status) { switch (status) { case net::StorageAccessApiStatus::kNone: document_associated_data_->RemoveCookieSettingOverride( net::CookieSettingOverride::kStorageAccessGrantEligible); return; case net::StorageAccessApiStatus::kAccessViaAPI: document_associated_data_->PutCookieSettingOverride( net::CookieSettingOverride::kStorageAccessGrantEligible); return; } NOTREACHED(); } std::unique_ptr RenderFrameHostImpl::CreateDownloadUrlParameters( const GURL& url, const net::NetworkTrafficAnnotationTag& traffic_annotation) const { return std::make_unique( base::PassKey(), url, std::optional(GetLastCommittedOrigin()), GetProcess()->GetDeprecatedID(), GetRoutingID(), traffic_annotation); } void RenderFrameHostImpl::UpdateEncoding(const std::string& encoding_name) { if (!is_main_frame()) { mojo::ReportBadMessage("Renderer sent updated encoding for a subframe."); return; } GetPage().UpdateEncoding(encoding_name); } void RenderFrameHostImpl::FullscreenStateChanged( bool is_fullscreen, blink::mojom::FullscreenOptionsPtr options) { if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kFullScreenStateChanged)) { return; } delegate_->FullscreenStateChanged(this, is_fullscreen, std::move(options)); } #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS) bool RenderFrameHostImpl::CanUseWindowingControls( std::string_view js_api_name) { if (!base::FeatureList::IsEnabled( blink::features::kDesktopPWAsAdditionalWindowingControls)) { mojo::ReportBadMessage(base::StrCat( {"API called without Additional Windowing Controls feature enabled: ", js_api_name})); return false; } if (!IsInPrimaryMainFrame()) { mojo::ReportBadMessage(base::StrCat( {"API called from a non-primary-main frame: ", js_api_name})); return false; } if (!IsActive()) { mojo::ReportBadMessage( base::StrCat({"API called from a non-active frame: ", js_api_name})); return false; } // These checks don't kill RFH, instead they log to the developer console. if (!IsWindowManagementGranted(this)) { AddMessageToConsole( blink::mojom::ConsoleMessageLevel::kWarning, base::StrCat({"API called without `window-management` permission " "being granted: ", js_api_name})); return false; } return delegate_->CanUseWindowingControls(this); } void RenderFrameHostImpl::Maximize() { if (!CanUseWindowingControls("window.maximize")) { return; } delegate_->Maximize(); } void RenderFrameHostImpl::Minimize() { if (!CanUseWindowingControls("window.minimize")) { return; } delegate_->Minimize(); } void RenderFrameHostImpl::Restore() { if (!CanUseWindowingControls("window.restore")) { return; } delegate_->Restore(); } void RenderFrameHostImpl::SetResizable(bool resizable) { if (!CanUseWindowingControls("window.setResizable")) { return; } delegate_->SetResizable(resizable); } #endif // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS) void RenderFrameHostImpl::DraggableRegionsChanged( std::vector regions) { if (!IsInPrimaryMainFrame()) { return; } delegate_->DraggableRegionsChanged(std::move(regions)); } void RenderFrameHostImpl::NotifyDocumentInteractive() { if (IsInPrimaryMainFrame()) { double trigger_rate = GetConfidenceRandomizedTriggerRate(); blink::mojom::ConfidenceLevel randomized_confidence = GenerateRandomizedConfidenceLevel( trigger_rate, document_associated_data_->navigation_confidence()); GetAssociatedLocalMainFrame()->FinalizeNavigationConfidence( trigger_rate, randomized_confidence); } } void RenderFrameHostImpl::RegisterProtocolHandler(const std::string& scheme, const GURL& url, bool user_gesture) { delegate_->RegisterProtocolHandler(this, scheme, url, user_gesture); } void RenderFrameHostImpl::UnregisterProtocolHandler(const std::string& scheme, const GURL& url, bool user_gesture) { delegate_->UnregisterProtocolHandler(this, scheme, url, user_gesture); } void RenderFrameHostImpl::DidDisplayInsecureContent() { frame_tree_->controller().ssl_manager()->DidDisplayMixedContent(); } void RenderFrameHostImpl::DidContainInsecureFormAction() { frame_tree_->controller().ssl_manager()->DidContainInsecureFormAction(); } void RenderFrameHostImpl::MainDocumentElementAvailable( bool uses_temporary_zoom_level) { if (!is_main_frame()) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_INVALID_CALL_FROM_NOT_MAIN_FRAME); return; } GetPage().set_is_main_document_element_available(true); GetPage().set_uses_temporary_zoom_level(uses_temporary_zoom_level); // Don't dispatch PrimaryMainDocumentElementAvailable for non-primary // RenderFrameHosts. As most of the observers are interested only in taking // into account and can interact with or send IPCs to only the current // document in the primary main frame. Since the WebContents could be hosting // more than one main frame (e.g., fenced frame, prerender pages or pending // delete RFHs), return early for other cases. if (!IsInPrimaryMainFrame()) { return; } delegate_->PrimaryMainDocumentElementAvailable(); if (!uses_temporary_zoom_level) { return; } #if !BUILDFLAG(IS_ANDROID) HostZoomMapImpl* host_zoom_map = static_cast(HostZoomMap::Get(GetSiteInstance())); host_zoom_map->SetTemporaryZoomLevel(GetGlobalId(), host_zoom_map->GetDefaultZoomLevel()); #endif // !BUILDFLAG(IS_ANDROID) } void RenderFrameHostImpl::SetNeedsOcclusionTracking(bool needs_tracking) { // Do not update the parent on behalf of inactive RenderFrameHost. See also // https://crbug.com/972566. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kSetNeedsOcclusionTracking)) { return; } RenderFrameProxyHost* proxy = GetProxyToParent(); if (!proxy) { bad_message::ReceivedBadMessage(GetProcess(), bad_message::RFH_NO_PROXY_TO_PARENT); return; } if (proxy->is_render_frame_proxy_live()) { proxy->GetAssociatedRemoteFrame()->SetNeedsOcclusionTracking( needs_tracking); } } void RenderFrameHostImpl::SetVirtualKeyboardMode( ui::mojom::VirtualKeyboardMode mode) { // TODO(crbug.com/40188381): Consider moving this to PageImpl. if (GetOutermostMainFrame() != this) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFHI_SET_OVERLAYS_CONTENT_NOT_OUTERMOST_FRAME); return; } GetPage().SetVirtualKeyboardMode(mode); } #if BUILDFLAG(IS_ANDROID) void RenderFrameHostImpl::UpdateUserGestureCarryoverInfo() { // This should not occur for prerenders but may occur for pages in // the BackForwardCache depending on timing. if (!IsActive()) { return; } delegate_->UpdateUserGestureCarryoverInfo(); } #endif void RenderFrameHostImpl::VisibilityChanged( blink::mojom::FrameVisibility visibility) { visibility_ = visibility; delegate_->OnFrameVisibilityChanged(this, visibility_); } void RenderFrameHostImpl::SetCommitCallbackInterceptorForTesting( CommitCallbackInterceptor* interceptor) { // This CHECK aims to avoid unexpected replacement of an interceptor. // If this becomes a legitimate use case, feel free to remove. CHECK(!commit_callback_interceptor_ || !interceptor); commit_callback_interceptor_ = interceptor; } void RenderFrameHostImpl::SetUnloadACKCallbackForTesting( const UnloadACKCallbackForTesting& callback) { // This CHECK aims to avoid unexpected replacement of a callback. CHECK(!unload_ack_callback_ || !callback); unload_ack_callback_ = callback; } const network::mojom::URLResponseHead* RenderFrameHostImpl::GetLastResponseHead() { // This shouldn't be called before committing the document as this value is // set during call to RenderFrameHostImpl::DidNavigate which happens after // commit. CHECK_NE(lifecycle_state(), LifecycleStateImpl::kSpeculative); CHECK_NE(lifecycle_state(), LifecycleStateImpl::kPendingCommit); return last_response_head_.get(); } void RenderFrameHostImpl::DidBlockNavigation( const GURL& blocked_url, blink::mojom::NavigationBlockedReason reason) { // Silently drop notifications from inactive or fenced frames. In-flight IPCs // can race with lifecycle transitions, and subframes in fenced frames trigger // this IPC legitimately without expecting tab-level UI. if (!IsActive() || IsNestedWithinFencedFrame()) { return; } // Do not allow renderers to show off-limits URLs in the blocked dialog. GURL validated_blocked_url = blocked_url; RenderProcessHost* process = GetProcess(); process->FilterURL(/*empty_allowed=*/false, &validated_blocked_url); delegate_->OnDidBlockNavigation(validated_blocked_url, GetLastCommittedURL(), GetLastCommittedOrigin(), reason); } void RenderFrameHostImpl::DidChangeLoadProgress(double load_progress) { if (!is_main_frame()) { return; } if (load_progress < GetPage().load_progress()) { return; } GetPage().set_load_progress(load_progress); delegate_->DidChangeLoadProgressForMainFrame(this); } void RenderFrameHostImpl::DidFinishLoad(const GURL& validated_url) { // In case of prerendering, we dispatch DidFinishLoad on activation. This is // done to avoid notifying observers about a load event triggered from a // inactive RenderFrameHost. if (lifecycle_state() == LifecycleStateImpl::kPrerendering) { document_associated_data_->set_pending_did_finish_load_url_for_prerendering( validated_url); return; } delegate_->OnDidFinishLoad(this, validated_url); } void RenderFrameHostImpl::DispatchLoad() { TRACE_EVENT1("navigation", "RenderFrameHostImpl::DispatchLoad", "render_frame_host", this); // Only active and prerendered documents are allowed to dispatch load events // to the parent. if (lifecycle_state() != LifecycleStateImpl::kPrerendering) { // If we ignored the last commit callback, this RenderFrameHost might be // stuck on the kPendingCommit stage. In this case, just ignore the load. if (did_ignore_last_commit_callback_) { return; } // Don't forward the load event to the parent on behalf of inactive // RenderFrameHost, which can happen in a race where this inactive // RenderFrameHost finishes loading just after the frame navigates away. // See https://crbug.com/626802. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kDispatchLoad)) { return; } } // TODO(https://crbug.com/526541236): CHECK-exclusion: Convert to CHECK once // we are sure this isn't hit. DCHECK(lifecycle_state() == LifecycleStateImpl::kActive || lifecycle_state() == LifecycleStateImpl::kPrerendering); // Only frames with an out-of-process parent frame should be sending this // message. RenderFrameProxyHost* proxy = GetProxyToParent(); if (!proxy) { bad_message::ReceivedBadMessage(GetProcess(), bad_message::RFH_NO_PROXY_TO_PARENT); return; } if (proxy->is_render_frame_proxy_live()) { proxy->GetAssociatedRemoteFrame()->DispatchLoadEventForFrameOwner(); } } void RenderFrameHostImpl::GoToEntryAtOffset( int32_t offset, bool has_user_gesture, base::TimeTicks actual_navigation_start, std::optional soft_navigation_heuristics_task_id) { OPTIONAL_TRACE_EVENT2("content", "RenderFrameHostImpl::GoToEntryAtOffset", "render_frame_host", this, "offset", offset); // Non-user initiated navigations coming from the renderer should be ignored // if there is an ongoing browser-initiated navigation. // See https://crbug.com/879965. // TODO(arthursonzogni): See if this should check for ongoing navigations in // the frame(s) affected by the session history navigation, rather than just // the main frame. if (Navigator::ShouldIgnoreIncomingRendererRequest( frame_tree_->root()->navigation_request(), has_user_gesture)) { return; } // Only active and prerendered documents are allowed to start navigation in // their frame. if (lifecycle_state() != LifecycleStateImpl::kPrerendering) { // If this is reached in case the RenderFrameHost is in BackForwardCache // evict the document from BackForwardCache. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kBeginNavigation)) { return; } } // All frames are allowed to navigate the global history. if (delegate_->IsAllowedToGoToEntryAtOffset(offset)) { frame_tree_->controller().GoToOffsetFromRenderer( offset, this, soft_navigation_heuristics_task_id, actual_navigation_start); } } void RenderFrameHostImpl::NavigateToNavigationApiKey( const std::string& key, bool has_user_gesture, base::TimeTicks actual_navigation_start, std::optional task_id) { // Non-user initiated navigations coming from the renderer should be ignored // if there is an ongoing browser-initiated navigation. // See https://crbug.com/879965. // TODO(arthursonzogni): See if this should check for ongoing navigations in // the frame(s) affected by the session history navigation, rather than just // the main frame. if (Navigator::ShouldIgnoreIncomingRendererRequest( frame_tree_->root()->navigation_request(), has_user_gesture)) { return; } // Only active and prerendered documents are allowed to start navigation in // their frame. if (lifecycle_state() != LifecycleStateImpl::kPrerendering) { // If this is reached in case the RenderFrameHost is in BackForwardCache // evict the document from BackForwardCache. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kBeginNavigation)) { return; } } frame_tree_->controller().NavigateToNavigationApiKey(this, task_id, key, actual_navigation_start); } void RenderFrameHostImpl::NavigateEventHandlerPresenceChanged(bool present) { has_navigate_event_handler_ = present; } void RenderFrameHostImpl::HandleAccessibilityFindInPageResult( blink::mojom::FindInPageResultAXParamsPtr params) { // Only update FindInPageResult on active RenderFrameHost. Note that, it is // safe to ignore this call for BackForwardCache, as we terminate the // FindInPage session once the page enters BackForwardCache. if (lifecycle_state() != LifecycleStateImpl::kActive) { return; } ui::BrowserAccessibilityManager* manager = GetOrCreateBrowserAccessibilityManager(); if (manager) { manager->OnFindInPageResult(params->request_id, params->match_index, params->start_id, params->start_offset, params->end_id, params->end_offset); } } void RenderFrameHostImpl::HandleAccessibilityFindInPageTermination() { // Only update FindInPageTermination on active RenderFrameHost. Note that, it // is safe to ignore this call for BackForwardCache, as we terminate the // FindInPage session once the page enters BackForwardCache. if (lifecycle_state() != LifecycleStateImpl::kActive) { return; } ui::BrowserAccessibilityManager* manager = GetOrCreateBrowserAccessibilityManager(); if (manager) { manager->OnFindInPageTermination(); } } // TODO(crbug.com/40183812): Move this method to content::PageImpl. void RenderFrameHostImpl::DocumentOnLoadCompleted() { if (!is_main_frame()) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_INVALID_CALL_FROM_NOT_MAIN_FRAME); return; } GetPage().set_is_on_load_completed_in_main_document(true); // This may be called when the main frame document is replaced with the empty // document during discard. Suppress document load notifications in this case. if (document_associated_data_->is_discarded()) { CleanupRenderProcessForDiscardIfPossible(); return; } // This message is only sent for main-level frames and will be filtered // out in the delegate. // // TODO(avi): when frame tree mirroring works correctly, add a check here // to enforce it. delegate_->DocumentOnLoadCompleted(this); } void RenderFrameHostImpl::ForwardResourceTimingToParent( blink::mojom::ResourceTimingInfoPtr timing) { // Only active and prerendered documents are allowed to forward the resource // timing information to the parent. if (lifecycle_state() != LifecycleStateImpl::kPrerendering) { // Don't forward the resource timing of the parent on behalf of inactive // RenderFrameHost. This can happen in a race where this RenderFrameHost // finishes loading just after the frame navigates away. See // https://crbug.com/626802. if (IsInactiveAndDisallowActivation( DisallowActivationReasonId::kForwardResourceTimingToParent)) { return; } } CHECK(lifecycle_state() == LifecycleStateImpl::kActive || lifecycle_state() == LifecycleStateImpl::kPrerendering); RenderFrameProxyHost* proxy = GetProxyToParent(); if (!proxy) { bad_message::ReceivedBadMessage(GetProcess(), bad_message::RFH_NO_PROXY_TO_PARENT); return; } if (proxy->is_render_frame_proxy_live()) { proxy->GetAssociatedRemoteFrame()->AddResourceTimingFromChild( std::move(timing)); } } bool RenderFrameHostImpl::Reload() { // Reloading the document frame will delete the currently active one. // We expected this function to be used only when this RenderFrameHost // is the currently active one. RenderFrameHost pending deletion, or // in the BackForwardCache are not expected to have side effect on the // current page. CHECK(IsActive()); return owner_->Reload(); } void RenderFrameHostImpl::SendAccessibilityEventsToManager( ui::AXUpdatesAndEvents& details) { if (!browser_accessibility_manager_) { return; } CHECK(delegate_->GetAccessibilityMode().has_mode(ui::AXMode::kNativeAPIs)); bool accessibility_error = !browser_accessibility_manager_->OnAccessibilityEvents(details); if (accessibility_error) { // OnAccessibilityEvents returns false in IPC error conditions. UnrecoverableAccessibilityError(); } #if AX_FAIL_FAST_BUILD() // Don't exercise the accessibility tree when we either had an // accessibility failure or if we are not allowed to fire events if (!accessibility_error && browser_accessibility_manager_->CanFireEvents()) { ExerciseAccessibilityForTest(); } #endif } void RenderFrameHostImpl::ExerciseAccessibilityForTest() { #if AX_FAIL_FAST_BUILD() // When running a debugging/sanitizer build (but not a perf test) with // --force-renderer-accessibility, exercise the properties for every node, to // ensure no crashes or assertions are triggered. This helpfully runs for all // web tests on builder linux-blink-web-tests-force-accessibility-rel, as well // as for some clusterfuzz runs. static int g_max_ax_tree_exercise_iterations = 3; // Avoid timeouts. static int count = 0; const int ax_tree_size = browser_accessibility_manager_->ax_tree()->size(); int max_ax_tree_exercise_iterations = ax_tree_size >= 1500 ? 1 : g_max_ax_tree_exercise_iterations; if (browser_accessibility_manager_->GetBrowserAccessibilityRoot() ->GetChildCount() > 0 && !browser_accessibility_manager_->GetBrowserAccessibilityRoot() ->GetBoolAttribute(ax::mojom::BoolAttribute::kBusy) && ++count <= max_ax_tree_exercise_iterations) { base::CommandLine* command_line = base::CommandLine::ForCurrentProcess(); if (command_line->HasSwitch(::switches::kForceRendererAccessibility) && !command_line->HasSwitch(switches::kTraceStartupOwner)) { std::unique_ptr formatter( AXInspectFactory::CreatePlatformFormatter()); formatter->SetPropertyFilters({{"*", ui::AXPropertyFilter::ALLOW}}); std::string formatted_tree = formatter->Format( browser_accessibility_manager_->GetBrowserAccessibilityRoot()); VLOG(1) << "\n\n******** Formatted tree ********\n\n" << formatted_tree << "\n*********************************\n\n"; } } #endif } bool RenderFrameHostImpl::IsInactiveAndDisallowActivation(uint64_t reason) { TRACE_EVENT1("navigation", "RenderFrameHostImpl::IsInactiveAndDisallowActivation", "render_frame_host", this); switch (lifecycle_state_) { case LifecycleStateImpl::kRunningUnloadHandlers: case LifecycleStateImpl::kReadyToBeDeleted: return true; case LifecycleStateImpl::kInBackForwardCache: { // This function should not be called with kAXEvent when the page is in // back/forward cache, because |HandleAXevents()| will continue to process // accessibility events without evicting. CHECK_NE(reason, kAXEvent); // This function should not be called with kAXLocationChange when the // page is in back/forward cache, because `HandleAXLocationChange()` will // continue to process accessibility location changes unless // kDoNotEvictOnAXLocationChange is off. if (base::FeatureList::IsEnabled( features::kDoNotEvictOnAXLocationChange)) { CHECK_NE(reason, kAXLocationChange); } BackForwardCacheCanStoreDocumentResult can_store_flat; can_store_flat.NoDueToDisallowActivation(reason); EvictFromBackForwardCacheWithFlattenedReasons(can_store_flat); } return true; case LifecycleStateImpl::kPrerendering: // Since the page in prerendering state is able to handle IndexedDB event, // the prerendering should not be cancelled because of that. CHECK_NE(reason, DisallowActivationReasonId::kIndexedDBEvent); CancelPrerendering( PrerenderCancellationReason::BuildForDisallowActivationState(reason)); return true; case LifecycleStateImpl::kSpeculative: // We do not expect speculative or pending commit RenderFrameHosts to // generate events that require an active/inactive check. Don't crash the // browser process in case it comes from a compromised renderer, but kill // the renderer to avoid further confusion. bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_INACTIVE_CHECK_FROM_SPECULATIVE_RFH); return false; case LifecycleStateImpl::kPendingCommit: // TODO(crbug.com/40174540): Understand the expected behaviour to // disallow activation for kPendingCommit RenderFrameHosts and update // accordingly. bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_INACTIVE_CHECK_FROM_PENDING_COMMIT_RFH); return false; case LifecycleStateImpl::kActive: return false; } } void RenderFrameHostImpl::EvictFromBackForwardCache( blink::mojom::RendererEvictionReason reason, blink::mojom::ScriptSourceLocationPtr source) { if (base::FeatureList::IsEnabled( blink::features::kCaptureJSExecutionLocation) && reason == blink::mojom::RendererEvictionReason::kJavaScriptExecution) { if (source.is_null()) { mojo::ReportBadMessage( "Source location must be provided if it's JavaScript execution"); } } else { // If `kCaptureJSExecutionLocation` is disabled, the renderer side will // never capture source location for any reason. if (!source.is_null()) { mojo::ReportBadMessage( "Source location must not be provided in this condition."); } } // TODO(crbug.com/41485693): Use `source` to report the source location of // JavaScript execution. EvictFromBackForwardCacheWithReason( RendererEvictionReasonToNotRestoredReason(reason)); } void RenderFrameHostImpl::EvictFromBackForwardCacheWithReason( BackForwardCacheMetrics::NotRestoredReason reason) { // kIgnoreEventAndEvict should never be a reason on its own without further // details. CHECK_NE(reason, BackForwardCacheMetrics::NotRestoredReason::kIgnoreEventAndEvict); BackForwardCacheCanStoreDocumentResult flattened_reasons; flattened_reasons.No(reason); EvictFromBackForwardCacheWithFlattenedReasons(flattened_reasons); } void RenderFrameHostImpl::EvictFromBackForwardCacheWithFlattenedReasons( BackForwardCacheCanStoreDocumentResult can_store_flat) { // Create a NotRestoredReasons tree that has |can_store_flat| as a reason // for |this| RenderFrameHost. auto can_store = BackForwardCacheImpl::CreateEvictionBackForwardCacheCanStoreTreeResult( *this, can_store_flat); EvictFromBackForwardCacheWithFlattenedAndTreeReasons(can_store); } void RenderFrameHostImpl::EvictFromBackForwardCacheWithFlattenedAndTreeReasons( BackForwardCacheCanStoreDocumentResultWithTree& can_store) { TRACE_EVENT2("navigation", "RenderFrameHostImpl::EvictFromBackForwardCache", "can_store", can_store.flattened_reasons.ToString(), "rfh", static_cast(this)); TRACE_EVENT("navigation", "RenderFrameHostImpl::" "EvictFromBackForwardCacheWithFlattenedAndTreeReasons", ChromeTrackEvent::kBackForwardCacheCanStoreDocumentResult, can_store.flattened_reasons); base::trace_event::EmitNamedTrigger("bfcache-eviction-detected"); // TODO(523032062): CHECK-exclusion: Convert to a CHECK once we are confident // it won't be triggered. DCHECK(IsBackForwardCacheEnabled()); RenderFrameHostImpl* top_document = GetOutermostMainFrame(); if (top_document->is_evicted_from_back_forward_cache_) { return; } bool in_back_forward_cache = IsInBackForwardCache(); // TODO(hajimehoshi): Record the 'race condition' by JavaScript execution when // |in_back_forward_cache| is false. BackForwardCacheMetrics* metrics = top_document->GetBackForwardCacheMetrics(); if (in_back_forward_cache && metrics) { metrics->SetNotRestoredReasons(can_store); } if (!in_back_forward_cache) { TRACE_EVENT0("navigation", "BackForwardCache_EvictAfterDocumentRestored"); // TODO(crbug.com/40163285): We should no longer get into this branch thanks // to https://crrev.com/c/2563674 but we do. We should eventually replace // this with a CHECK. BackForwardCacheMetrics::RecordEvictedAfterDocumentRestored( BackForwardCacheMetrics::EvictedAfterDocumentRestoredReason:: kByJavaScript); CaptureTraceForNavigationDebugScenario( DebugScenario::kDebugBackForwardCacheEvictRestoreRace); // A document is evicted from the BackForwardCache, but it has already been // restored. The current document should be reloaded, because it is not // salvageable. top_document->frame_tree()->controller().Reload(ReloadType::NORMAL, false); return; } // Check if there is an in-flight navigation restoring the document that is // being evicted. NavigationRequest* in_flight_navigation_request = top_document->frame_tree_node()->navigation_request(); if (in_flight_navigation_request && in_flight_navigation_request ->GetRenderFrameHostRestoredFromBackForwardCache() == top_document) { // If we are currently navigating to the document that was just evicted, we // must restart the navigation. This is important because restarting the // navigation deletes the `NavigationRequest` associated with the evicted // document (preventing use-after-free). // Restarting the navigation should also happen asynchronously as eviction // might happen in the middle of another navigation - we should not try to // restart the navigation in that case. top_document->frame_tree_node()->RestartBackForwardCachedNavigationAsync( in_flight_navigation_request->nav_entry_id()); } // Evict the frame and schedule it to be destroyed. Eviction happens // immediately, but destruction is delayed, so that callers don't have to // worry about use-after-free of |this|. top_document->is_evicted_from_back_forward_cache_ = true; GetBackForwardCache().PostTaskToDestroyEvictedFrames(); if (auto* view = GetView()) { view->ActivatedOrEvictedFromBackForwardCache(); } } void RenderFrameHostImpl:: UseDummyStickyBackForwardCacheDisablingFeatureForTesting() { OnBackForwardCacheDisablingFeatureUsed( BackForwardCacheDisablingFeature::kDummy); } bool RenderFrameHostImpl::HasSeenRecentXrOverlaySetup() { static constexpr base::TimeDelta kMaxInterval = base::Seconds(1); bool found_recent_setup = false; // Iterate the frame subtree because an ancestor frame entering fullscreen on // behalf of a child OOPIF will check its own RenderFrameHostImpl, but the XR // overlay setup timestamp was recorded on the child OOPIF's RenderFrameHost. ForEachRenderFrameHostImpl([&found_recent_setup](RenderFrameHostImpl* rfh) { base::TimeDelta delta = base::TimeTicks::Now() - rfh->last_xr_overlay_setup_time_; if (delta <= kMaxInterval) { found_recent_setup = true; } }); DVLOG(2) << __func__ << ": return " << found_recent_setup; return found_recent_setup; } void RenderFrameHostImpl::SetIsXrOverlaySetup() { DVLOG(2) << __func__; last_xr_overlay_setup_time_ = base::TimeTicks::Now(); } void RenderFrameHostImpl::EnterFullscreen( blink::mojom::FullscreenOptionsPtr options, EnterFullscreenCallback callback) { const bool had_fullscreen_token = fullscreen_request_token_.IsActive(); // Validate the is_xr_overlay flag against browser-authoritative state. if (options->is_xr_overlay) { const bool is_valid = HasSeenRecentXrOverlaySetup(); base::UmaHistogramBoolean("XR.DOMOverlay.IsXrOverlayFullscreenValid", is_valid); if (!is_valid) { options->is_xr_overlay = false; } } // Frames (possibly a subframe) that are not active nor belonging to a primary // page should not enter fullscreen. if (!IsActive() || !GetPage().IsPrimary()) { std::move(callback).Run(/*granted=*/false); return; } // Enforce the fullscreen Permissions Policy browser-side. Cross-origin // iframes without the "allowfullscreen" attribute (or an explicit // Permissions-Policy delegation) must not be able to enter fullscreen, even // if the renderer-side check is bypassed by a compromised renderer. if (!IsFeatureEnabled( network::mojom::PermissionsPolicyFeature::kFullscreen)) { bad_message::ReceivedBadMessage( GetProcess(), bad_message::RFH_ENTER_FULLSCREEN_PERMISSION_DENIED); return; } // Entering fullscreen generally requires a transient user activation signal, // or another feature-specific transient allowance. if (delegate_->IsTransientActivationRequiredForHtmlFullscreen() && !HasSeenRecentXrOverlaySetup()) { // Reject requests made without transient user activation or a token. // TODO(lanwei): Investigate whether we can terminate the renderer when // transient user activation and the delegated token are both inactive. CHECK(owner_); // See `owner_` invariants about `IsActive()`. // Consume any transient user activation and delegated fullscreen token. const bool consumed_activation = owner_->UpdateUserActivationState( blink::mojom::UserActivationUpdateType::kConsumeTransientActivation, blink::mojom::UserActivationNotificationType::kNone); const bool consumed_token = fullscreen_request_token_.ConsumeIfActive(); if (!consumed_activation && !consumed_token) { DLOG(ERROR) << "Cannot enter fullscreen without a transient activation, " << "orientation change, XR overlay, or delegated capability."; std::move(callback).Run(/*granted=*/false); return; } } if (!delegate_->CanEnterFullscreenMode(this)) { std::move(callback).Run(/*granted=*/false); return; } base::RecordAction(base::UserMetricsAction("EnterFullscreen_API")); // Allow sites with the Window Management permission to open a popup window // after requesting fullscreen on a specific screen of a multi-screen device. // This enables multi-screen content experiences from a single user gesture. const display::Screen* screen = display::Screen::Get(); display::Display display; if (screen && screen->GetNumDisplays() > 1 && screen->GetDisplayWithDisplayId(options->display_id, &display) && IsWindowManagementGranted(this)) { transient_allow_popup_.Activate(); } std::move(callback).Run(/*granted=*/true); // Entering fullscreen from a cross-process subframe also affects all // renderers for ancestor frames, which will need to apply fullscreen CSS to // appropriate ancestor