From ba46b8c53ed0f46cec82a1aebaec173784deb6e4 Mon Sep 17 00:00:00 2001
From: Marshall Greenblatt <magreenblatt@gmail.com>
Date: Mon, 7 Jun 2021 13:31:39 -0700
Subject: [PATCH] Fix CefBrowser::GetMainFrame assumptions in the renderer
 process (see issue #2421)

ClientAppRenderer::Delegate callbacks are executed for all tests. In this case
CorsTest.IframeAllowScriptsCustomNonStandardSchemeToServer was crashing on Linux
because CefBrowser::GetMainFrame() returns nullptr in the renderer process when
called from a cross-origin sub-frame.
---
 include/capi/cef_browser_capi.h           | 8 +++++---
 include/cef_browser.h                     | 4 +++-
 tests/ceftests/message_router_unittest.cc | 2 +-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/include/capi/cef_browser_capi.h b/include/capi/cef_browser_capi.h
index aa1edaa47..e4661b997 100644
--- a/include/capi/cef_browser_capi.h
+++ b/include/capi/cef_browser_capi.h
@@ -33,7 +33,7 @@
 // by hand. See the translator.README.txt file in the tools directory for
 // more information.
 //
-// $hash=bb01bd8418e5fb715a7a6bd53e962e11a0d04993$
+// $hash=6e192c6e8a59c37e98e458578a287dd36b8ed90f$
 //
 
 #ifndef CEF_INCLUDE_CAPI_CEF_BROWSER_CAPI_H_
@@ -147,8 +147,10 @@ typedef struct _cef_browser_t {
   ///
   // Returns the main (top-level) frame for the browser. In the browser process
   // this will return a valid object until after
-  // cef_life_span_handler_t::OnBeforeClose is called. The main frame object
-  // will change during cross-origin navigation or re-navigation after renderer
+  // cef_life_span_handler_t::OnBeforeClose is called. In the renderer process
+  // this will return NULL if the main frame is hosted in a different renderer
+  // process (e.g. for cross-origin sub-frames). The main frame object will
+  // change during cross-origin navigation or re-navigation after renderer
   // process termination (due to crashes, etc).
   ///
   struct _cef_frame_t*(CEF_CALLBACK* get_main_frame)(
diff --git a/include/cef_browser.h b/include/cef_browser.h
index a665c12c2..303937434 100644
--- a/include/cef_browser.h
+++ b/include/cef_browser.h
@@ -151,7 +151,9 @@ class CefBrowser : public virtual CefBaseRefCounted {
   ///
   // Returns the main (top-level) frame for the browser. In the browser process
   // this will return a valid object until after
-  // CefLifeSpanHandler::OnBeforeClose is called. The main frame object will
+  // CefLifeSpanHandler::OnBeforeClose is called. In the renderer process this
+  // will return NULL if the main frame is hosted in a different renderer
+  // process (e.g. for cross-origin sub-frames). The main frame object will
   // change during cross-origin navigation or re-navigation after renderer
   // process termination (due to crashes, etc).
   ///
diff --git a/tests/ceftests/message_router_unittest.cc b/tests/ceftests/message_router_unittest.cc
index d90473436..ca848dc6c 100644
--- a/tests/ceftests/message_router_unittest.cc
+++ b/tests/ceftests/message_router_unittest.cc
@@ -163,7 +163,7 @@ class MRRenderDelegate : public ClientAppRenderer::Delegate {
                                 CefRefPtr<CefFrame> frame,
                                 CefProcessId source_process,
                                 CefRefPtr<CefProcessMessage> message) override {
-    const std::string& url = browser->GetMainFrame()->GetURL();
+    const std::string& url = frame->GetURL();
     if (url.find(kTestDomainRoot) != 0)
       return false;