bcarrella/cef
1
0
Fork 0
mirror of https://bitbucket.org/chromiumembedded/cef synced 2025-06-05 21:39:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix routing of frame messages after cross-origin navigation (fixes issue #2849)

Browse Source 
When navigating cross-origin a speculative RenderFrameHost (RFH) and
CefFrameHostImpl is created in the browser process for the new frame object
created in a new renderer process. The FrameAttached message then arrives for
the speculative RFH, and as a consequence interfaces are bound between the new
CefFrameHostImpl and the speculative RFH. If the pending navigation commits
then the existing RFH will be replaced with the previously speculative RFH.
Since interfaces are already bound we must keep the new CefFrameHostImpl. This
means that frame objects (including for the main frame) will now always change
after cross-origin navigation, and the old frame object will be invalidated.
This commit is contained in:
Marshall Greenblatt
2021-05-18 20:45:05 -04:00
parent ebee84755e
commit d9efaee9b9
6 changed files with 34 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libcef/browser/browser_frame.cc
View File

@ -41,7 +41,9 @@ void CefBrowserFrame::SendMessage(const std::string& name,
}
void CefBrowserFrame::FrameAttached() {
if (auto host = GetFrameHost()) {
// Always send to the newly created RFH, which may be speculative when
// navigating cross-origin.
if (auto host = GetFrameHost(/*prefer_speculative=*/true)) {
host->FrameAttached();
}
}
@ -60,11 +62,13 @@ void CefBrowserFrame::UpdateDraggableRegions(
}
}
CefRefPtr<CefFrameHostImpl> CefBrowserFrame::GetFrameHost() const {
CefRefPtr<CefFrameHostImpl> CefBrowserFrame::GetFrameHost(
bool prefer_speculative) const {
CEF_REQUIRE_UIT();
auto rfh = render_frame_host();
if (auto browser = CefBrowserHostBase::GetBrowserForHost(rfh)) {
return browser->browser_info()->GetFrameForHost(rfh);
return browser->browser_info()->GetFrameForHost(rfh, nullptr,
prefer_speculative);
}
NOTREACHED();
return nullptr;