From d9aa61b3685b6993f0d79acfc9b9ba7828f31209 Mon Sep 17 00:00:00 2001 From: Pedro Pontes Date: Thu, 12 Nov 2020 22:55:56 +0100 Subject: [PATCH 1/2] chore: cherry-pick c244270e23 from chromium. --- patches/chromium/.patches | 1 + ...tindexinparent_returns_base_optional.patch | 2 +- ..._into_an_editable_combobox_s_listbox.patch | 2 +- patches/chromium/command-ismediakey.patch | 2 +- .../crash_allow_setting_more_options.patch | 4 +- .../disable_compositor_recycling.patch | 2 +- ...dit-cmds-to-sent-focused-WebContents.patch | 8 +- ...use_key_listener_for_internal_chrome.patch | 2 +- ...hostimpl_detach_for_speculative_rfhs.patch | 162 ++++++++++++++++++ ..._macos_os_version_numbers_consistent.patch | 2 +- patches/chromium/mas-cfisobjc.patch | 6 +- .../chromium/mas_blink_no_private_api.patch | 6 +- .../mas_disable_custom_window_frame.patch | 16 +- .../mas_disable_remote_accessibility.patch | 26 +-- .../chromium/mas_disable_remote_layer.patch | 10 +- patches/chromium/mas_no_private_api.patch | 54 +++--- .../render_widget_host_view_mac.patch | 8 +- patches/chromium/webview_cross_drag.patch | 2 +- 18 files changed, 239 insertions(+), 76 deletions(-) create mode 100644 patches/chromium/ignore_renderframehostimpl_detach_for_speculative_rfhs.patch diff --git a/patches/chromium/.patches b/patches/chromium/.patches index 1259cd0499d46..f66a85e393d3f 100644 --- a/patches/chromium/.patches +++ b/patches/chromium/.patches @@ -152,3 +152,4 @@ cherry-pick-1ed869ad4bb3.patch cherry-pick-8f24f935c903.patch crashpad-initialize-logging.patch make_macos_os_version_numbers_consistent.patch +ignore_renderframehostimpl_detach_for_speculative_rfhs.patch diff --git a/patches/chromium/a11y_axplatformnodebase_getindexinparent_returns_base_optional.patch b/patches/chromium/a11y_axplatformnodebase_getindexinparent_returns_base_optional.patch index 5a35a5c0ee5d8..4c310793f946f 100644 --- a/patches/chromium/a11y_axplatformnodebase_getindexinparent_returns_base_optional.patch +++ b/patches/chromium/a11y_axplatformnodebase_getindexinparent_returns_base_optional.patch @@ -211,7 +211,7 @@ diff --git a/ui/accessibility/platform/ax_platform_node_mac.mm b/ui/accessibilit index 0454164364c6a4a1b1c11011603af5978d2b8ef5..bd9e17f1e21bd17a68988ee3c9ab08f2a1d99b2e 100644 --- a/ui/accessibility/platform/ax_platform_node_mac.mm +++ b/ui/accessibility/platform/ax_platform_node_mac.mm -@@ -1257,11 +1257,6 @@ void AXPlatformNodeMac::AnnounceText(const base::string16& text) { +@@ -1257,11 +1257,6 @@ - (NSRange)accessibilityRangeForPosition:(NSPoint)point { [native_node_ AXWindow], false); } diff --git a/patches/chromium/allow_focus_to_move_into_an_editable_combobox_s_listbox.patch b/patches/chromium/allow_focus_to_move_into_an_editable_combobox_s_listbox.patch index d0af6721b8117..856e64c99f487 100644 --- a/patches/chromium/allow_focus_to_move_into_an_editable_combobox_s_listbox.patch +++ b/patches/chromium/allow_focus_to_move_into_an_editable_combobox_s_listbox.patch @@ -23,7 +23,7 @@ diff --git a/content/browser/accessibility/browser_accessibility_manager_mac.mm index 33324bbca5953f6f2f9d829e4c7b5d7daa3f49ea..a27cacfd303706ef3ee637107d2de0c8839bfa20 100644 --- a/content/browser/accessibility/browser_accessibility_manager_mac.mm +++ b/content/browser/accessibility/browser_accessibility_manager_mac.mm -@@ -143,11 +143,6 @@ BrowserAccessibility* BrowserAccessibilityManagerMac::GetFocus() const { +@@ -143,11 +143,6 @@ if (!focus) return nullptr; diff --git a/patches/chromium/command-ismediakey.patch b/patches/chromium/command-ismediakey.patch index e21f44fd3cedc..6f61a88aeaf82 100644 --- a/patches/chromium/command-ismediakey.patch +++ b/patches/chromium/command-ismediakey.patch @@ -74,7 +74,7 @@ index 85378bb565de617b1bd611d28c8714361747a357..36de4c0b0353be2418dacd388e92d7c3 } return VKEY_UNKNOWN; } -@@ -192,7 +198,10 @@ CGEventRef MediaKeysListenerImpl::EventTapCallback(CGEventTapProxy proxy, +@@ -192,7 +198,10 @@ static CGEventRef EventTapCallback(CGEventTapProxy proxy, int key_code = (data1 & 0xFFFF0000) >> 16; if (key_code != NX_KEYTYPE_PLAY && key_code != NX_KEYTYPE_NEXT && key_code != NX_KEYTYPE_PREVIOUS && key_code != NX_KEYTYPE_FAST && diff --git a/patches/chromium/crash_allow_setting_more_options.patch b/patches/chromium/crash_allow_setting_more_options.patch index d503dfbc12fb6..80aaf5ad4bf4b 100644 --- a/patches/chromium/crash_allow_setting_more_options.patch +++ b/patches/chromium/crash_allow_setting_more_options.patch @@ -139,7 +139,7 @@ diff --git a/components/crash/core/app/crashpad_mac.mm b/components/crash/core/a index b579521d55860823722df2ee849f6b1628b3c950..f4f71e5174cf8fb706a2f8385252ba877d1a03a7 100644 --- a/components/crash/core/app/crashpad_mac.mm +++ b/components/crash/core/app/crashpad_mac.mm -@@ -67,6 +67,8 @@ std::map GetProcessSimpleAnnotations() { +@@ -67,6 +67,8 @@ } // @autoreleasepool return process_annotations; }(); @@ -148,7 +148,7 @@ index b579521d55860823722df2ee849f6b1628b3c950..f4f71e5174cf8fb706a2f8385252ba87 return annotations; } -@@ -140,9 +142,17 @@ base::FilePath PlatformCrashpadInitialization( +@@ -140,9 +142,17 @@ void DumpProcessWithoutCrashing(task_t task_port) { #else std::string url; #endif diff --git a/patches/chromium/disable_compositor_recycling.patch b/patches/chromium/disable_compositor_recycling.patch index 86c9fb563bd92..2387649150777 100644 --- a/patches/chromium/disable_compositor_recycling.patch +++ b/patches/chromium/disable_compositor_recycling.patch @@ -9,7 +9,7 @@ diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/cont index f293a15c6145422707c22aeb5a254ad71a31900c..472869202ff8a62d854c9ca39ca9f14e2f91e8cf 100644 --- a/content/browser/renderer_host/render_widget_host_view_mac.mm +++ b/content/browser/renderer_host/render_widget_host_view_mac.mm -@@ -472,7 +472,11 @@ void RenderWidgetHostViewMac::WasOccluded() { +@@ -472,7 +472,11 @@ return; host()->WasHidden(); diff --git a/patches/chromium/fix-ensure-edit-cmds-to-sent-focused-WebContents.patch b/patches/chromium/fix-ensure-edit-cmds-to-sent-focused-WebContents.patch index 7914ffd680dc8..956e3fe71b740 100644 --- a/patches/chromium/fix-ensure-edit-cmds-to-sent-focused-WebContents.patch +++ b/patches/chromium/fix-ensure-edit-cmds-to-sent-focused-WebContents.patch @@ -105,7 +105,7 @@ diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/cont index 472869202ff8a62d854c9ca39ca9f14e2f91e8cf..17e3fe40522e088057eaf01a290b658a0b6d1d01 100644 --- a/content/browser/renderer_host/render_widget_host_view_mac.mm +++ b/content/browser/renderer_host/render_widget_host_view_mac.mm -@@ -1799,15 +1799,15 @@ void RenderWidgetHostViewMac::ExecuteEditCommand(const std::string& command) { +@@ -1799,15 +1799,15 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback, } void RenderWidgetHostViewMac::Undo() { @@ -127,7 +127,7 @@ index 472869202ff8a62d854c9ca39ca9f14e2f91e8cf..17e3fe40522e088057eaf01a290b658a } void RenderWidgetHostViewMac::Cut() { -@@ -1835,9 +1835,9 @@ void RenderWidgetHostViewMac::Paste() { +@@ -1835,9 +1835,9 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback, } void RenderWidgetHostViewMac::PasteAndMatchStyle() { @@ -144,7 +144,7 @@ diff --git a/content/browser/renderer_host/render_widget_host_view_mac_editcomma index 760e47e9edd7b92b7bc6074f6da9c76048be8f28..2b0f1135e584852048081629eb6297e4e1fcc574 100644 --- a/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm +++ b/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm -@@ -91,9 +91,12 @@ class RenderWidgetHostDelegateEditCommandCounter +@@ -91,9 +91,12 @@ void ExecuteEditCommand( const base::Optional& value) override { edit_command_message_count_++; } @@ -161,7 +161,7 @@ diff --git a/content/browser/renderer_host/text_input_client_mac_unittest.mm b/c index 158e0507af7433e16c47227e7519b12e14554f1b..e7b8109cdc78e76d737bd0c067f8d33e0c171117 100644 --- a/content/browser/renderer_host/text_input_client_mac_unittest.mm +++ b/content/browser/renderer_host/text_input_client_mac_unittest.mm -@@ -40,9 +40,12 @@ class MockRenderWidgetHostDelegate : public RenderWidgetHostDelegate { +@@ -40,9 +40,12 @@ void ExecuteEditCommand( const std::string& command, const base::Optional& value) override {} diff --git a/patches/chromium/fix_use_the_new_mediaplaypause_key_listener_for_internal_chrome.patch b/patches/chromium/fix_use_the_new_mediaplaypause_key_listener_for_internal_chrome.patch index e88af03151bfd..fb5868f45618c 100644 --- a/patches/chromium/fix_use_the_new_mediaplaypause_key_listener_for_internal_chrome.patch +++ b/patches/chromium/fix_use_the_new_mediaplaypause_key_listener_for_internal_chrome.patch @@ -12,7 +12,7 @@ diff --git a/chrome/browser/extensions/global_shortcut_listener_mac.mm b/chrome/ index befe726af9c10b1563a7fc0bb77cc55f65943d5c..bac51f33f35f96fe4ecc764cf5ca887176642f74 100644 --- a/chrome/browser/extensions/global_shortcut_listener_mac.mm +++ b/chrome/browser/extensions/global_shortcut_listener_mac.mm -@@ -39,7 +39,7 @@ GlobalShortcutListenerMac::GlobalShortcutListenerMac() +@@ -39,7 +39,7 @@ // global MediaKeysListener to receive media keys. if (!content::MediaKeysListenerManager::IsMediaKeysListenerManagerEnabled()) { media_keys_listener_ = ui::MediaKeysListener::Create( diff --git a/patches/chromium/ignore_renderframehostimpl_detach_for_speculative_rfhs.patch b/patches/chromium/ignore_renderframehostimpl_detach_for_speculative_rfhs.patch new file mode 100644 index 0000000000000..b128bc8ebc9f5 --- /dev/null +++ b/patches/chromium/ignore_renderframehostimpl_detach_for_speculative_rfhs.patch @@ -0,0 +1,162 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Cheng +Date: Wed, 11 Nov 2020 00:54:41 +0000 +Subject: Ignore RenderFrameHostImpl::Detach() for speculative RFHs. + +Currently, this all happens to work by chance, because the speculative +RFH or the entire FTN happens to be torn down before the browser process +ever processes a Detach() IPC for a speculative RFH. + +However, there are a number of followup CLs that restructure how +provisional RenderFrames are managed and owned in the renderer process. +To simplify those CLs, explicitly branch in Detach() based on whether or +not the RFH is speculative. In the future, additional logic may be added +to the speculative branch (e.g. cancelling the navigation, if +appropriate). + +(cherry picked from commit cf054220a2e1570a9149220494de8826c2e9d4db) + +Bug: 1146709 +Change-Id: I6490a90f7b447422d698676665b52f6f3a6f8ffd +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2524280 +Commit-Queue: Daniel Cheng +Reviewed-by: Nasko Oskov +Cr-Original-Commit-Position: refs/heads/master@{#825903} +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2530189 +Reviewed-by: Adrian Taylor +Cr-Commit-Position: refs/branch-heads/4240@{#1430} +Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218} + +diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc +index 8a3afc59f96e0f29997d0e239726217d490189d8..0c71cf19a2d8587e3e341d963da72c03a092b453 100644 +--- a/content/browser/frame_host/render_frame_host_impl.cc ++++ b/content/browser/frame_host/render_frame_host_impl.cc +@@ -2403,6 +2403,9 @@ void RenderFrameHostImpl::UpdateRenderProcessHostFramePriorities() { + } + + void RenderFrameHostImpl::OnDetach() { ++ if (frame_tree_node_->render_manager()->speculative_frame_host() == this) ++ return; ++ + if (!parent_) { + bad_message::ReceivedBadMessage(GetProcess(), + bad_message::RFH_DETACH_MAIN_FRAME); +diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc +index 1e8f9b19e4bdeb0b6a371e384e30e10b7986137e..7770582317986869ff38658e2abfd4ba836c5bca 100644 +--- a/content/browser/site_per_process_browsertest.cc ++++ b/content/browser/site_per_process_browsertest.cc +@@ -10362,6 +10362,36 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, + EXPECT_EQ("opener-ping-reply", response); + } + ++IN_PROC_BROWSER_TEST_P(SitePerProcessBrowserTest, ++ DetachSpeculativeRenderFrameHost) { ++ // Commit a page with one iframe. ++ GURL main_url(embedded_test_server()->GetURL( ++ "a.com", "/cross_site_iframe_factory.html?a(a)")); ++ EXPECT_TRUE(NavigateToURL(shell(), main_url)); ++ ++ // Start a cross-site navigation. ++ GURL cross_site_url(embedded_test_server()->GetURL("b.com", "/title2.html")); ++ TestNavigationManager nav_manager(shell()->web_contents(), cross_site_url); ++ BeginNavigateIframeToURL(web_contents(), "child-0", cross_site_url); ++ ++ // Wait for the request, but don't commit it yet. This should create a ++ // speculative RenderFrameHost. ++ ASSERT_TRUE(nav_manager.WaitForRequestStart()); ++ FrameTreeNode* root = web_contents()->GetFrameTree()->root(); ++ RenderFrameHostImpl* speculative_rfh = root->current_frame_host() ++ ->child_at(0) ++ ->render_manager() ++ ->speculative_frame_host(); ++ EXPECT_TRUE(speculative_rfh); ++ ++ // Currently, the browser process never handles an explicit Detach() for a ++ // speculative RFH, since the speculative RFH or the entire FTN is always ++ // destroyed before the renderer sends this IPC. ++ speculative_rfh->Detach(); ++ ++ // Passes if there is no crash. ++} ++ + #if defined(OS_ANDROID) + + namespace { +diff --git a/content/public/test/browser_test_utils.cc b/content/public/test/browser_test_utils.cc +index d7f88a819505305d690e35b3b78862c1b9fd8f5e..9b2f0bb265293549b84d37279ba1e2e7c314a737 100644 +--- a/content/public/test/browser_test_utils.cc ++++ b/content/public/test/browser_test_utils.cc +@@ -624,15 +624,21 @@ bool NavigateToURL(WebContents* web_contents, + bool NavigateIframeToURL(WebContents* web_contents, + const std::string& iframe_id, + const GURL& url) { ++ TestNavigationObserver load_observer(web_contents); ++ bool result = BeginNavigateIframeToURL(web_contents, iframe_id, url); ++ load_observer.Wait(); ++ return result; ++} ++ ++bool BeginNavigateIframeToURL(WebContents* web_contents, ++ const std::string& iframe_id, ++ const GURL& url) { + std::string script = base::StringPrintf( + "setTimeout(\"" + "var iframes = document.getElementById('%s');iframes.src='%s';" + "\",0)", + iframe_id.c_str(), url.spec().c_str()); +- TestNavigationObserver load_observer(web_contents); +- bool result = ExecuteScript(web_contents, script); +- load_observer.Wait(); +- return result; ++ return ExecuteScript(web_contents, script); + } + + void NavigateToURLBlockUntilNavigationsComplete(WebContents* web_contents, +diff --git a/content/public/test/browser_test_utils.h b/content/public/test/browser_test_utils.h +index 8c2e904462c655c9a587e5243572e60b8327ad1c..d4b16a127f92559469f386b734ffa1e6d20eb51e 100644 +--- a/content/public/test/browser_test_utils.h ++++ b/content/public/test/browser_test_utils.h +@@ -137,6 +137,12 @@ bool NavigateIframeToURL(WebContents* web_contents, + const std::string& iframe_id, + const GURL& url); + ++// Similar to |NavigateIframeToURL()| but returns as soon as the navigation is ++// initiated. ++bool BeginNavigateIframeToURL(WebContents* web_contents, ++ const std::string& iframe_id, ++ const GURL& url); ++ + // Generate a URL for a file path including a query string. + GURL GetFileUrlWithQuery(const base::FilePath& path, + const std::string& query_string); +diff --git a/content/test/data/cross_site_iframe_factory.html b/content/test/data/cross_site_iframe_factory.html +index 959f45a6be7f233082e364f90d6875d125ae6fe6..e4807d1ad3f7526d7b21843ba8f49e50f7ed8d7e 100644 +--- a/content/test/data/cross_site_iframe_factory.html ++++ b/content/test/data/cross_site_iframe_factory.html +@@ -10,12 +10,12 @@ Example usage in a browsertest, explained: + When you navigate to the above URL, the outer document (on a.com) will create a + single iframe: + +-