Make WebChannelIPCTransport into a RenderFrameObserver

As of version 63, Chromium creates proxy frames also for the main frame in the
frame tree during cross-process navigations. This leads to a segmentation fault
in WebChannelIPCTransport because we assume that all main frames are local.

See https://crrev.com/27caae83cb530daaf49f9a38793e427cdf493a65 for details.

This patch refactors the renderer-side WebChannelIPCTransport from a
RenderViewObserver into a RenderFrameObserver, which prevents the segmentation
fault since the RenderFrameObserver is not created for proxy frames. Most likely
this would have to be done eventually anyway since the RenderView and
RenderViewObserver classes are deprecated and will likely be removed as part of
the Site Isolation project.

Installation is changed to follow Chromium's RenderFrameImpl in the sense of
performing the installation from RenderFrameObserver::DidClearWindowObject
instead of ContentRendererClient::RunScriptsAtDocumentStart. This has the
benefit of avoiding the ScriptForbiddenScope DCHECK.

Additionally there are the following minor changes:

  - The deprecated parameterless version of v8::Value::ToObject() method is
    replaced with v8::Value::IsObject() check and v8::Local::Cast.

  - The deprecated v8::Handle typedef is replaced with v8::Local.

  - The deprecated single-parameter WebContentsObserver::OnMessageReceived is
    replaced with the new two-parameter version.

  - blink::MainThreadIsolate() is used instead of v8::Isolate::GetCurrent() for
    Install/Uninstall since we know we are executing on the main thread.

  - WebChannelIPCTransportHost is changed to ignore messages from unexpected
    renderers in case something goes wrong with the renderers.

  - Logging is added to WebChannelIPCTransportHost for debugging purposes.

Some new unit tests are added, all of which fail with the old version.

Task-number: QTBUG-66333
Change-Id: I936d142fb042d9f936a3f9d08d4328ecba595f1f
Reviewed-by: Michal Klocek <michal.klocek@qt.io>

2 files changed, 67 insertions, 54 deletions

diff --git a/src/core/renderer_host/web_channel_ipc_transport_host.cpp b/src/core/renderer_host/web_channel_ipc_transport_host.cpp
index b624d7e45..6b32093a6 100644
--- a/src/core/renderer_host/web_channel_ipc_transport_host.cpp
+++ b/src/core/renderer_host/web_channel_ipc_transport_host.cpp
@@ -1,6 +1,6 @@
 /****************************************************************************
 **
-** Copyright (C) 2016 The Qt Company Ltd.
+** Copyright (C) 2018 The Qt Company Ltd.
 ** Contact: https://www.qt.io/licensing/
 **
 ** This file is part of the QtWebEngine module of the Qt Toolkit.
@@ -39,70 +39,71 @@
 
 #include "web_channel_ipc_transport_host.h"
 
-#include "base/strings/string16.h"
-#include "content/public/browser/render_view_host.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 
 #include "common/qt_messages.h"
-#include "type_conversion.h"
 
 #include <QJsonDocument>
 #include <QJsonObject>
+#include <QLoggingCategory>
 
 namespace QtWebEngineCore {
 
+Q_LOGGING_CATEGORY(log, "qt.webengine.webchanneltransport");
+
+inline QDebug operator<<(QDebug stream, content::RenderFrameHost *frame)
+{
+    return stream << "frame " << frame->GetRoutingID() << " in process " << frame->GetProcess()->GetID();
+}
+
+template <class T>
+inline QDebug operator<<(QDebug stream, const base::Optional<T> &opt)
+{
+    if (opt)
+        return stream << *opt;
+    else
+        return stream << "nullopt";
+}
+
 WebChannelIPCTransportHost::WebChannelIPCTransportHost(content::WebContents *contents, uint worldId, QObject *parent)
     : QWebChannelAbstractTransport(parent)
     , content::WebContentsObserver(contents)
-    , m_worldId(worldId)
 {
-    contents->GetRenderViewHost()->Send(
-                new WebChannelIPCTransport_Install(
-                    contents->GetRenderViewHost()->GetRoutingID(),
-                    m_worldId));
+    setWorldId(worldId);
 }
 
 WebChannelIPCTransportHost::~WebChannelIPCTransportHost()
 {
+    setWorldId(base::nullopt);
 }
 
-void WebChannelIPCTransportHost::RenderViewHostChanged(content::RenderViewHost *oldHost, content::RenderViewHost *)
-{
-    if (oldHost)
-        oldHost->Send(new WebChannelIPCTransport_Uninstall(oldHost->GetRoutingID(), m_worldId));
-}
-
-void WebChannelIPCTransportHost::RenderViewCreated(content::RenderViewHost *view_host)
+void WebChannelIPCTransportHost::sendMessage(const QJsonObject &message)
 {
-    // Make sure the new view knows a webchannel is installed and in which world.
-    view_host->Send(new WebChannelIPCTransport_Install(view_host->GetRoutingID(), m_worldId));
+    QJsonDocument doc(message);
+    int size = 0;
+    const char *rawData = doc.rawData(&size);
+    content::RenderFrameHost *frame = web_contents()->GetMainFrame();
+    qCDebug(log).nospace() << "sending webchannel message to " << frame << ": " << doc;
+    frame->Send(new WebChannelIPCTransport_Message(frame->GetRoutingID(), std::vector<char>(rawData, rawData + size), *m_worldId));
 }
 
-void WebChannelIPCTransportHost::setWorldId(uint worldId)
+void WebChannelIPCTransportHost::setWorldId(base::Optional<uint> worldId)
 {
-    if (worldId == m_worldId)
+    if (m_worldId == worldId)
         return;
-    web_contents()->GetRenderViewHost()->Send(
-                new WebChannelIPCTransport_Uninstall(
-                    web_contents()->GetRenderViewHost()->GetRoutingID(),
-                    m_worldId));
+    for (content::RenderFrameHost *frame : web_contents()->GetAllFrames())
+        setWorldId(frame, worldId);
     m_worldId = worldId;
-    web_contents()->GetRenderViewHost()->Send(
-                new WebChannelIPCTransport_Install(
-                    web_contents()->GetRenderViewHost()->GetRoutingID(),
-                    m_worldId));
 }
 
-void WebChannelIPCTransportHost::sendMessage(const QJsonObject &message)
+void WebChannelIPCTransportHost::setWorldId(content::RenderFrameHost *frame, base::Optional<uint> worldId)
 {
-    QJsonDocument doc(message);
-    int size = 0;
-    const char *rawData = doc.rawData(&size);
-    web_contents()->GetRenderViewHost()->Send(
-                new WebChannelIPCTransport_Message(
-                    web_contents()->GetRenderViewHost()->GetRoutingID(),
-                    std::vector<char>(rawData, rawData + size),
-                    m_worldId));
+    if (!frame->IsRenderFrameLive())
+        return;
+    qCDebug(log).nospace() << "sending setWorldId(" << worldId << ") message to " << frame;
+    frame->Send(new WebChannelIPCTransport_SetWorldId(frame->GetRoutingID(), worldId));
 }
 
 void WebChannelIPCTransportHost::onWebChannelMessage(const std::vector<char> &message)
@@ -110,11 +111,21 @@ void WebChannelIPCTransportHost::onWebChannelMessage(const std::vector<char> &me
     Q_ASSERT(!message.empty());
     QJsonDocument doc = QJsonDocument::fromRawData(message.data(), message.size(), QJsonDocument::BypassValidation);
     Q_ASSERT(doc.isObject());
+    content::RenderFrameHost *frame = web_contents()->GetMainFrame();
+    qCDebug(log).nospace() << "received webchannel message from " << frame << ": " << doc;
     Q_EMIT messageReceived(doc.object(), this);
 }
 
-bool WebChannelIPCTransportHost::OnMessageReceived(const IPC::Message &message)
+void WebChannelIPCTransportHost::RenderFrameCreated(content::RenderFrameHost *frame)
 {
+    setWorldId(frame, m_worldId);
+}
+
+bool WebChannelIPCTransportHost::OnMessageReceived(const IPC::Message& message, content::RenderFrameHost *receiver)
+{
+    if (receiver != web_contents()->GetMainFrame())
+        return false;
+
     bool handled = true;
     IPC_BEGIN_MESSAGE_MAP(WebChannelIPCTransportHost, message)
         IPC_MESSAGE_HANDLER(WebChannelIPCTransportHost_SendMessage, onWebChannelMessage)
@@ -123,4 +134,4 @@ bool WebChannelIPCTransportHost::OnMessageReceived(const IPC::Message &message)
     return handled;
 }
 
-} // namespace
+} // namespace QtWebEngineCore
diff --git a/src/core/renderer_host/web_channel_ipc_transport_host.h b/src/core/renderer_host/web_channel_ipc_transport_host.h
index a1e697a91..3a814a794 100644
--- a/src/core/renderer_host/web_channel_ipc_transport_host.h
+++ b/src/core/renderer_host/web_channel_ipc_transport_host.h
@@ -1,6 +1,6 @@
 /****************************************************************************
 **
-** Copyright (C) 2016 The Qt Company Ltd.
+** Copyright (C) 2018 The Qt Company Ltd.
 ** Contact: https://www.qt.io/licensing/
 **
 ** This file is part of the QtWebEngine module of the Qt Toolkit.
@@ -40,38 +40,40 @@
 #ifndef WEB_CHANNEL_IPC_TRANSPORT_H
 #define WEB_CHANNEL_IPC_TRANSPORT_H
 
+#include "qtwebenginecoreglobal.h"
 
-#include <QtWebChannel/QWebChannelAbstractTransport>
 #include "content/public/browser/web_contents_observer.h"
 
-#include "qtwebenginecoreglobal.h"
-#include <QtCore/QObject>
+#include <QWebChannelAbstractTransport>
 
 QT_FORWARD_DECLARE_CLASS(QString)
 
 namespace QtWebEngineCore {
 
 class WebChannelIPCTransportHost : public QWebChannelAbstractTransport
-        , public content::WebContentsObserver
-{
+                                 , private content::WebContentsObserver {
 public:
-    WebChannelIPCTransportHost(content::WebContents *, uint worldId = 0, QObject *parent = 0);
+    WebChannelIPCTransportHost(content::WebContents *webContents, uint worldId = 0, QObject *parent = nullptr);
     virtual ~WebChannelIPCTransportHost();
 
-    // WebContentsObserver
-    void RenderViewHostChanged(content::RenderViewHost* old_host, content::RenderViewHost* new_host) override;
-    void RenderViewCreated(content::RenderViewHost* render_view_host) override;
+    void setWorldId(uint worldId) { setWorldId(base::Optional<uint>(worldId)); }
+    uint worldId() const { return *m_worldId; }
 
     // QWebChannelAbstractTransport
     void sendMessage(const QJsonObject &message) override;
 
-    void setWorldId(uint worldId);
-    uint worldId() const { return m_worldId; }
-
 private:
-    bool OnMessageReceived(const IPC::Message& message) override;
+    void setWorldId(base::Optional<uint> worldId);
+    void setWorldId(content::RenderFrameHost *frame, base::Optional<uint> worldId);
     void onWebChannelMessage(const std::vector<char> &message);
-    uint m_worldId;
+
+    // WebContentsObserver
+    void RenderFrameCreated(content::RenderFrameHost *frame) override;
+    bool OnMessageReceived(const IPC::Message& message, content::RenderFrameHost *receiver) override;
+
+    // Empty only during construction/destruction. Synchronized to all the
+    // WebChannelIPCTransports/RenderFrames in the observed WebContents.
+    base::Optional<uint> m_worldId;
 };
 
 } // namespace