blob: 267e14330ad421be35548284176b86efe8588b3e [file] [log] [blame]
Avi Drissman4e1b7bc32022-09-15 14:03:501// Copyright 2013 The Chromium Authors
danakjc492bf82020-09-09 20:02:442// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef CONTENT_BROWSER_RENDERER_HOST_FRAME_TREE_NODE_H_
6#define CONTENT_BROWSER_RENDERER_HOST_FRAME_TREE_NODE_H_
7
8#include <stddef.h>
9
10#include <memory>
11#include <string>
David Sanders2c1194d92022-04-19 23:32:3212#include <utility>
danakjc492bf82020-09-09 20:02:4413
14#include "base/gtest_prod_util.h"
Keishi Hattori0e45c022021-11-27 09:25:5215#include "base/memory/raw_ptr.h"
David Sanders2c1194d92022-04-19 23:32:3216#include "base/memory/scoped_refptr.h"
David Sandersd4bf5eb2022-03-17 07:12:0517#include "base/observer_list.h"
Daniel Cheng390e2a72022-09-28 06:07:5318#include "content/browser/renderer_host/navigation_discard_reason.h"
danakjc492bf82020-09-09 20:02:4419#include "content/browser/renderer_host/navigator.h"
20#include "content/browser/renderer_host/render_frame_host_impl.h"
21#include "content/browser/renderer_host/render_frame_host_manager.h"
Miyoung Shin7cf88b42022-11-07 13:22:3022#include "content/browser/renderer_host/render_frame_host_owner.h"
danakjc492bf82020-09-09 20:02:4423#include "content/common/content_export.h"
Julie Jeongeun Kimf38c1eca2021-12-14 07:46:5524#include "content/public/browser/frame_type.h"
danakjc492bf82020-09-09 20:02:4425#include "services/network/public/mojom/content_security_policy.mojom-forward.h"
Lei Zhang698df03c2021-05-21 04:23:3426#include "third_party/abseil-cpp/absl/types/optional.h"
Kevin McNee43fe8292021-10-04 22:59:4127#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
danakjc492bf82020-09-09 20:02:4428#include "third_party/blink/public/common/frame/frame_policy.h"
danakjc492bf82020-09-09 20:02:4429#include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
Gyuyoung Kimc16e52e92021-03-19 02:45:3730#include "third_party/blink/public/mojom/frame/frame_replication_state.mojom-forward.h"
Daniel Cheng6ac128172021-05-25 18:49:0131#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom.h"
David Sanders2c1194d92022-04-19 23:32:3232#include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom-forward.h"
danakjc492bf82020-09-09 20:02:4433
Gabriel Charetted87f10f2022-03-31 00:44:2234#include "base/time/time.h"
danakjc492bf82020-09-09 20:02:4435#include "url/gurl.h"
36#include "url/origin.h"
37
38namespace content {
39
40class NavigationRequest;
41class RenderFrameHostImpl;
42class NavigationEntryImpl;
Paul Semel3e241042022-10-11 12:57:3143class FrameTree;
danakjc492bf82020-09-09 20:02:4444
45// When a page contains iframes, its renderer process maintains a tree structure
46// of those frames. We are mirroring this tree in the browser process. This
47// class represents a node in this tree and is a wrapper for all objects that
48// are frame-specific (as opposed to page-specific).
49//
50// Each FrameTreeNode has a current RenderFrameHost, which can change over
51// time as the frame is navigated. Any immediate subframes of the current
52// document are tracked using FrameTreeNodes owned by the current
53// RenderFrameHost, rather than as children of FrameTreeNode itself. This
54// allows subframe FrameTreeNodes to stay alive while a RenderFrameHost is
55// still alive - for example while pending deletion, after a new current
56// RenderFrameHost has replaced it.
Miyoung Shin7cf88b42022-11-07 13:22:3057class CONTENT_EXPORT FrameTreeNode : public RenderFrameHostOwner {
danakjc492bf82020-09-09 20:02:4458 public:
59 class Observer {
60 public:
61 // Invoked when a FrameTreeNode is being destroyed.
62 virtual void OnFrameTreeNodeDestroyed(FrameTreeNode* node) {}
63
64 // Invoked when a FrameTreeNode becomes focused.
65 virtual void OnFrameTreeNodeFocused(FrameTreeNode* node) {}
66
Arthur Hemerye4659282022-03-28 08:36:1567 // Invoked when a FrameTreeNode moves to a different BrowsingInstance and
68 // the popups it opened should be disowned.
69 virtual void OnFrameTreeNodeDisownedOpenee(FrameTreeNode* node) {}
70
Fergal Dalya1d569972021-03-16 03:24:5371 virtual ~Observer() = default;
danakjc492bf82020-09-09 20:02:4472 };
73
74 static const int kFrameTreeNodeInvalidId;
75
76 // Returns the FrameTreeNode with the given global |frame_tree_node_id|,
77 // regardless of which FrameTree it is in.
78 static FrameTreeNode* GloballyFindByID(int frame_tree_node_id);
79
80 // Returns the FrameTreeNode for the given |rfh|. Same as
81 // rfh->frame_tree_node(), but also supports nullptrs.
82 static FrameTreeNode* From(RenderFrameHost* rfh);
83
84 // Callers are are expected to initialize sandbox flags separately after
85 // calling the constructor.
86 FrameTreeNode(
87 FrameTree* frame_tree,
88 RenderFrameHostImpl* parent,
Daniel Cheng6ac128172021-05-25 18:49:0189 blink::mojom::TreeScopeType tree_scope_type,
danakjc492bf82020-09-09 20:02:4490 bool is_created_by_script,
danakjc492bf82020-09-09 20:02:4491 const blink::mojom::FrameOwnerProperties& frame_owner_properties,
Kevin McNee43fe8292021-10-04 22:59:4192 blink::FrameOwnerElementType owner_type,
Dominic Farolino08662c82021-06-11 07:36:3493 const blink::FramePolicy& frame_owner);
danakjc492bf82020-09-09 20:02:4494
Peter Boström828b9022021-09-21 02:28:4395 FrameTreeNode(const FrameTreeNode&) = delete;
96 FrameTreeNode& operator=(const FrameTreeNode&) = delete;
97
Miyoung Shin7cf88b42022-11-07 13:22:3098 ~FrameTreeNode() override;
danakjc492bf82020-09-09 20:02:4499
100 void AddObserver(Observer* observer);
101 void RemoveObserver(Observer* observer);
102
Ian Vollick25a9d032022-04-12 23:20:17103 // Frame trees may be nested so it can be the case that IsMainFrame() is true,
104 // but is not the outermost main frame. In particular, !IsMainFrame() cannot
105 // be used to check if the frame is an embedded frame -- use
106 // !IsOutermostMainFrame() instead. NB: this does not escape guest views;
107 // IsOutermostMainFrame will be true for the outermost main frame in an inner
108 // guest view.
danakjc492bf82020-09-09 20:02:44109 bool IsMainFrame() const;
Ian Vollick25a9d032022-04-12 23:20:17110 bool IsOutermostMainFrame();
danakjc492bf82020-09-09 20:02:44111
arthursonzogni76098e52020-11-25 14:18:45112 // Clears any state in this node which was set by the document itself (CSP &
113 // UserActivationState) and notifies proxies as appropriate. Invoked after
114 // committing navigation to a new document (since the new document comes with
115 // a fresh set of CSP).
116 // TODO(arthursonzogni): Remove this function. The frame/document must not be
117 // left temporarily with lax state.
Hiroki Nakagawaab309622021-05-19 16:38:13118 void ResetForNavigation();
danakjc492bf82020-09-09 20:02:44119
120 FrameTree* frame_tree() const { return frame_tree_; }
Paul Semel3e241042022-10-11 12:57:31121 Navigator& navigator();
danakjc492bf82020-09-09 20:02:44122
123 RenderFrameHostManager* render_manager() { return &render_manager_; }
Alexander Timin33e2e2c12022-03-03 04:21:33124 const RenderFrameHostManager* render_manager() const {
125 return &render_manager_;
126 }
danakjc492bf82020-09-09 20:02:44127 int frame_tree_node_id() const { return frame_tree_node_id_; }
Yuzu Saijo03dbf9b2022-07-22 04:29:45128 // This reflects window.name, which is initially set to the the "name"
129 // attribute. But this won't reflect changes of 'name' attribute and instead
130 // reflect changes to the Window object's name property.
131 // This is different from IframeAttributes' name in that this will not get
132 // updated when 'name' attribute gets updated.
Harkiran Bolaria4eacb3a2021-12-13 20:03:47133 const std::string& frame_name() const {
134 return render_manager_.current_replication_state().name;
135 }
danakjc492bf82020-09-09 20:02:44136
137 const std::string& unique_name() const {
Harkiran Bolaria4eacb3a2021-12-13 20:03:47138 return render_manager_.current_replication_state().unique_name;
danakjc492bf82020-09-09 20:02:44139 }
140
danakjc492bf82020-09-09 20:02:44141 size_t child_count() const { return current_frame_host()->child_count(); }
142
danakjc492bf82020-09-09 20:02:44143 RenderFrameHostImpl* parent() const { return parent_; }
144
Dave Tapuskac8de3b02021-12-03 21:51:01145 // See `RenderFrameHost::GetParentOrOuterDocument()` for
146 // documentation.
147 RenderFrameHostImpl* GetParentOrOuterDocument();
148
149 // See `RenderFrameHostImpl::GetParentOrOuterDocumentOrEmbedder()` for
150 // documentation.
151 RenderFrameHostImpl* GetParentOrOuterDocumentOrEmbedder();
152
danakjc492bf82020-09-09 20:02:44153 FrameTreeNode* opener() const { return opener_; }
154
Rakina Zata Amni3a48ae42022-05-05 03:39:56155 FrameTreeNode* first_live_main_frame_in_original_opener_chain() const {
156 return first_live_main_frame_in_original_opener_chain_;
157 }
danakjc492bf82020-09-09 20:02:44158
Anton Bikineevf62d1bf2021-05-15 17:56:07159 const absl::optional<base::UnguessableToken>& opener_devtools_frame_token() {
Wolfgang Beyerd8809db2020-09-30 15:29:39160 return opener_devtools_frame_token_;
161 }
162
Julie Jeongeun Kimf38c1eca2021-12-14 07:46:55163 // Returns the type of the frame. Refer to frame_type.h for the details.
164 FrameType GetFrameType() const;
165
danakjc492bf82020-09-09 20:02:44166 // Assigns a new opener for this node and, if |opener| is non-null, registers
167 // an observer that will clear this node's opener if |opener| is ever
168 // destroyed.
169 void SetOpener(FrameTreeNode* opener);
170
171 // Assigns the initial opener for this node, and if |opener| is non-null,
172 // registers an observer that will clear this node's opener if |opener| is
173 // ever destroyed. The value set here is the root of the tree.
174 //
175 // It is not possible to change the opener once it was set.
176 void SetOriginalOpener(FrameTreeNode* opener);
177
Wolfgang Beyerd8809db2020-09-30 15:29:39178 // Assigns an opener frame id for this node. This string id is only set once
179 // and cannot be changed. It persists, even if the |opener| is destroyed. It
180 // is used for attribution in the DevTools frontend.
181 void SetOpenerDevtoolsFrameToken(
182 base::UnguessableToken opener_devtools_frame_token);
183
danakjc492bf82020-09-09 20:02:44184 FrameTreeNode* child_at(size_t index) const {
185 return current_frame_host()->child_at(index);
186 }
187
188 // Returns the URL of the last committed page in the current frame.
189 const GURL& current_url() const {
190 return current_frame_host()->GetLastCommittedURL();
191 }
192
Abhijeet Kandalkarb86993b2022-11-22 05:17:40193 // Note that the current RenderFrameHost might not exist yet when calling this
194 // during FrameTreeNode initialization. In this case the FrameTreeNode must be
195 // on the initial empty document. Refer RFHI::is_initial_empty_document for a
196 // more details.
Rakina Zata Amni86c88fa2021-11-01 01:27:30197 bool is_on_initial_empty_document() const {
Abhijeet Kandalkarb86993b2022-11-22 05:17:40198 return current_frame_host()
199 ? current_frame_host()->is_initial_empty_document()
200 : true;
Rakina Zata Amnifc4cc3d42021-06-10 09:03:56201 }
202
danakjc492bf82020-09-09 20:02:44203 // Returns whether the frame's owner element in the parent document is
204 // collapsed, that is, removed from the layout as if it did not exist, as per
205 // request by the embedder (of the content/ layer).
206 bool is_collapsed() const { return is_collapsed_; }
207
208 // Sets whether to collapse the frame's owner element in the parent document,
209 // that is, to remove it from the layout as if it did not exist, as per
210 // request by the embedder (of the content/ layer). Cannot be called for main
211 // frames.
212 //
213 // This only has an effect for <iframe> owner elements, and is a no-op when
214 // called on sub-frames hosted in <frame>, <object>, and <embed> elements.
215 void SetCollapsed(bool collapsed);
216
217 // Returns the origin of the last committed page in this frame.
218 // WARNING: To get the last committed origin for a particular
219 // RenderFrameHost, use RenderFrameHost::GetLastCommittedOrigin() instead,
220 // which will behave correctly even when the RenderFrameHost is not the
221 // current one for this frame (such as when it's pending deletion).
222 const url::Origin& current_origin() const {
Harkiran Bolaria4eacb3a2021-12-13 20:03:47223 return render_manager_.current_replication_state().origin;
danakjc492bf82020-09-09 20:02:44224 }
225
danakjc492bf82020-09-09 20:02:44226 // Returns the latest frame policy (sandbox flags and container policy) for
227 // this frame. This includes flags inherited from parent frames and the latest
228 // flags from the <iframe> element hosting this frame. The returned policies
229 // may not yet have taken effect, since "sandbox" and "allow" attribute
230 // updates in an <iframe> element take effect on next navigation. To retrieve
231 // the currently active policy for this frame, use effective_frame_policy().
232 const blink::FramePolicy& pending_frame_policy() const {
233 return pending_frame_policy_;
234 }
235
236 // Update this frame's sandbox flags and container policy. This is called
237 // when a parent frame updates the "sandbox" attribute in the <iframe> element
238 // for this frame, or any of the attributes which affect the container policy
239 // ("allowfullscreen", "allowpaymentrequest", "allow", and "src".)
240 // These policies won't take effect until next navigation. If this frame's
241 // parent is itself sandboxed, the parent's sandbox flags are combined with
242 // those in |frame_policy|.
243 // Attempting to change the container policy on the main frame will have no
244 // effect.
245 void SetPendingFramePolicy(blink::FramePolicy frame_policy);
246
247 // Returns the currently active frame policy for this frame, including the
248 // sandbox flags which were present at the time the document was loaded, and
Charlie Hu5130d25e2021-03-05 21:53:39249 // the permissions policy container policy, which is set by the iframe's
danakjc492bf82020-09-09 20:02:44250 // allowfullscreen, allowpaymentrequest, and allow attributes, along with the
251 // origin of the iframe's src attribute (which may be different from the URL
252 // of the document currently loaded into the frame). This does not include
253 // policy changes that have been made by updating the containing iframe
254 // element attributes since the frame was last navigated; use
255 // pending_frame_policy() for those.
256 const blink::FramePolicy& effective_frame_policy() const {
Harkiran Bolaria4eacb3a2021-12-13 20:03:47257 return render_manager_.current_replication_state().frame_policy;
danakjc492bf82020-09-09 20:02:44258 }
259
danakjc492bf82020-09-09 20:02:44260 const blink::mojom::FrameOwnerProperties& frame_owner_properties() {
261 return frame_owner_properties_;
262 }
263
264 void set_frame_owner_properties(
265 const blink::mojom::FrameOwnerProperties& frame_owner_properties) {
266 frame_owner_properties_ = frame_owner_properties;
267 }
268
Yuzu Saijo03dbf9b2022-07-22 04:29:45269 // Reflects the attributes of the corresponding iframe html element, such
Arthur Sonzogni64457592022-11-22 11:08:59270 // as 'credentialless', 'id', 'name' and 'src'. These values should not be
Yuzu Saijo03dbf9b2022-07-22 04:29:45271 // exposed to cross-origin renderers.
272 const network::mojom::ContentSecurityPolicy* csp_attribute() const {
273 return attributes_->parsed_csp_attribute.get();
danakjc492bf82020-09-09 20:02:44274 }
Arthur Sonzogni64457592022-11-22 11:08:59275 bool credentialless() const { return attributes_->credentialless; }
Yuzu Saijo03dbf9b2022-07-22 04:29:45276 const std::string& html_id() const { return attributes_->id; }
277 // This tracks iframe's 'name' attribute instead of window.name, which is
278 // tracked in FrameReplicationState. See the comment for frame_name() for
279 // more details.
280 const std::string& html_name() const { return attributes_->name; }
281 const std::string& html_src() const { return attributes_->src; }
danakjc492bf82020-09-09 20:02:44282
Yuzu Saijo03dbf9b2022-07-22 04:29:45283 void SetAttributes(blink::mojom::IframeAttributesPtr attributes);
Antonio Sartori5abc8de2021-07-13 08:42:47284
danakjc492bf82020-09-09 20:02:44285 bool HasSameOrigin(const FrameTreeNode& node) const {
Harkiran Bolaria4eacb3a2021-12-13 20:03:47286 return render_manager_.current_replication_state().origin.IsSameOriginWith(
287 node.current_replication_state().origin);
danakjc492bf82020-09-09 20:02:44288 }
289
Gyuyoung Kimc16e52e92021-03-19 02:45:37290 const blink::mojom::FrameReplicationState& current_replication_state() const {
Harkiran Bolaria4eacb3a2021-12-13 20:03:47291 return render_manager_.current_replication_state();
danakjc492bf82020-09-09 20:02:44292 }
293
294 RenderFrameHostImpl* current_frame_host() const {
295 return render_manager_.current_frame_host();
296 }
297
danakjc492bf82020-09-09 20:02:44298 // Returns true if this node is in a loading state.
299 bool IsLoading() const;
300
Alex Moshchuk9b0fd822020-10-26 23:08:15301 // Returns true if this node has a cross-document navigation in progress.
302 bool HasPendingCrossDocumentNavigation() const;
303
danakjc492bf82020-09-09 20:02:44304 NavigationRequest* navigation_request() { return navigation_request_.get(); }
305
306 // Transfers the ownership of the NavigationRequest to |render_frame_host|.
307 // From ReadyToCommit to DidCommit, the NavigationRequest is owned by the
308 // RenderFrameHost that is committing the navigation.
309 void TransferNavigationRequestOwnership(
310 RenderFrameHostImpl* render_frame_host);
311
312 // Takes ownership of |navigation_request| and makes it the current
313 // NavigationRequest of this frame. This corresponds to the start of a new
314 // navigation. If there was an ongoing navigation request before calling this
315 // function, it is canceled. |navigation_request| should not be null.
316 void CreatedNavigationRequest(
317 std::unique_ptr<NavigationRequest> navigation_request);
318
Rakina Zata Amnif8f2bb62022-11-23 05:54:32319 // Resets the navigation request owned by `this` (which shouldn't have reached
320 // the "pending commit" stage yet) and any state created by it, including the
Rakina Zata Amni33175cb92022-11-24 02:46:03321 // speculative RenderFrameHost (if there are no other navigations associated
322 // with it). Note that this does not affect navigations that have reached the
323 // "pending commit" stage, which are owned by their corresponding
324 // RenderFrameHosts instead.
Daniel Cheng390e2a72022-09-28 06:07:53325 void ResetNavigationRequest(NavigationDiscardReason reason);
326
Rakina Zata Amnif8f2bb62022-11-23 05:54:32327 // Similar to `ResetNavigationRequest()`, but keeps the state created by the
Daniel Cheng390e2a72022-09-28 06:07:53328 // NavigationRequest (e.g. speculative RenderFrameHost, loading state).
329 void ResetNavigationRequestButKeepState();
danakjc492bf82020-09-09 20:02:44330
331 // A RenderFrameHost in this node started loading.
Nate Chapin9aabf5f2021-11-12 00:31:19332 // |should_show_loading_ui| indicates whether this navigation should be
333 // visible in the UI. True for cross-document navigations and navigations
Nate Chapin24295252022-09-27 18:31:08334 // intercepted by the navigation API's intercept().
danakjc492bf82020-09-09 20:02:44335 // |was_previously_loading| is false if the FrameTree was not loading before.
336 // The caller is required to provide this boolean as the delegate should only
337 // be notified if the FrameTree went from non-loading to loading state.
338 // However, when it is called, the FrameTree should be in a loading state.
Nate Chapin9aabf5f2021-11-12 00:31:19339 void DidStartLoading(bool should_show_loading_ui,
340 bool was_previously_loading);
danakjc492bf82020-09-09 20:02:44341
342 // A RenderFrameHost in this node stopped loading.
343 void DidStopLoading();
344
345 // The load progress for a RenderFrameHost in this node was updated to
346 // |load_progress|. This will notify the FrameTree which will in turn notify
347 // the WebContents.
348 void DidChangeLoadProgress(double load_progress);
349
350 // Called when the user directed the page to stop loading. Stops all loads
351 // happening in the FrameTreeNode. This method should be used with
352 // FrameTree::ForEach to stop all loads in the entire FrameTree.
353 bool StopLoading();
354
355 // Returns the time this frame was last focused.
356 base::TimeTicks last_focus_time() const { return last_focus_time_; }
357
358 // Called when this node becomes focused. Updates the node's last focused
359 // time and notifies observers.
360 void DidFocus();
361
362 // Called when the user closed the modal dialogue for BeforeUnload and
363 // cancelled the navigation. This should stop any load happening in the
364 // FrameTreeNode.
365 void BeforeUnloadCanceled();
366
danakjc492bf82020-09-09 20:02:44367 // Returns the sandbox flags currently in effect for this frame. This includes
368 // flags inherited from parent frames, the currently active flags from the
369 // <iframe> element hosting this frame, as well as any flags set from a
370 // Content-Security-Policy HTTP header. This does not include flags that have
371 // have been updated in an <iframe> element but have not taken effect yet; use
372 // pending_frame_policy() for those. To see the flags which will take effect
373 // on navigation (which does not include the CSP-set flags), use
374 // effective_frame_policy().
375 network::mojom::WebSandboxFlags active_sandbox_flags() const {
Harkiran Bolaria4eacb3a2021-12-13 20:03:47376 return render_manager_.current_replication_state().active_sandbox_flags;
danakjc492bf82020-09-09 20:02:44377 }
378
danakjc492bf82020-09-09 20:02:44379 // Returns whether the frame received a user gesture on a previous navigation
380 // on the same eTLD+1.
381 bool has_received_user_gesture_before_nav() const {
Harkiran Bolaria4eacb3a2021-12-13 20:03:47382 return render_manager_.current_replication_state()
383 .has_received_user_gesture_before_nav;
danakjc492bf82020-09-09 20:02:44384 }
385
386 // When a tab is discarded, WebContents sets was_discarded on its
387 // root FrameTreeNode.
388 // In addition, when a child frame is created, this bit is passed on from
389 // parent to child.
390 // When a navigation request is created, was_discarded is passed on to the
391 // request and reset to false in FrameTreeNode.
392 void set_was_discarded() { was_discarded_ = true; }
393 bool was_discarded() const { return was_discarded_; }
394
Miyoung Shin8a66ec022022-11-28 23:50:09395 // Deprecated. Use directly HasStickyUserActivation in RFHI.
danakjc492bf82020-09-09 20:02:44396 // Returns the sticky bit of the User Activation v2 state of the
397 // |FrameTreeNode|.
398 bool HasStickyUserActivation() const {
Miyoung Shin8a66ec022022-11-28 23:50:09399 return current_frame_host()->HasStickyUserActivation();
danakjc492bf82020-09-09 20:02:44400 }
401
Miyoung Shin8a66ec022022-11-28 23:50:09402 // Deprecated. Use directly HasStickyUserActivation in RFHI.
danakjc492bf82020-09-09 20:02:44403 // Returns the transient bit of the User Activation v2 state of the
404 // |FrameTreeNode|.
405 bool HasTransientUserActivation() {
Miyoung Shin8a66ec022022-11-28 23:50:09406 return current_frame_host()->HasTransientUserActivation();
danakjc492bf82020-09-09 20:02:44407 }
408
409 // Remove history entries for all frames created by script in this frame's
410 // subtree. If a frame created by a script is removed, then its history entry
411 // will never be reused - this saves memory.
412 void PruneChildFrameNavigationEntries(NavigationEntryImpl* entry);
413
Abhijeet Kandalkarb43affa72022-09-27 16:48:01414 using FencedFrameStatus = RenderFrameHostImpl::FencedFrameStatus;
Abhijeet Kandalkar3f29bc42022-09-23 12:39:58415 FencedFrameStatus fenced_frame_status() const { return fenced_frame_status_; }
416
Kevin McNee43fe8292021-10-04 22:59:41417 blink::FrameOwnerElementType frame_owner_element_type() const {
Daniel Cheng9bd90f92021-04-23 20:49:45418 return frame_owner_element_type_;
danakjc492bf82020-09-09 20:02:44419 }
danakjc492bf82020-09-09 20:02:44420
Daniel Cheng6ac128172021-05-25 18:49:01421 blink::mojom::TreeScopeType tree_scope_type() const {
422 return tree_scope_type_;
423 }
424
arthursonzogni034bb9c2020-10-01 08:29:56425 // The initial popup URL for new window opened using:
426 // `window.open(initial_popup_url)`.
427 // An empty GURL otherwise.
428 //
429 // [WARNING] There is no guarantee the FrameTreeNode will ever host a
430 // document served from this URL. The FrameTreeNode always starts hosting the
431 // initial empty document and attempts a navigation toward this URL. However
432 // the navigation might be delayed, redirected and even cancelled.
433 void SetInitialPopupURL(const GURL& initial_popup_url);
434 const GURL& initial_popup_url() const { return initial_popup_url_; }
435
436 // The origin of the document that used window.open() to create this frame.
437 // Otherwise, an opaque Origin with a nonce different from all previously
438 // existing Origins.
439 void SetPopupCreatorOrigin(const url::Origin& popup_creator_origin);
440 const url::Origin& popup_creator_origin() const {
441 return popup_creator_origin_;
442 }
443
Harkiran Bolaria59290d62021-03-17 01:53:01444 // Sets the associated FrameTree for this node. The node can change FrameTrees
445 // when blink::features::Prerender2 is enabled, which allows a page loaded in
446 // the prerendered FrameTree to be used for a navigation in the primary frame
447 // tree.
448 void SetFrameTree(FrameTree& frame_tree);
449
Alexander Timin074cd182022-03-23 18:11:22450 using TraceProto = perfetto::protos::pbzero::FrameTreeNodeInfo;
Alexander Timinf785f342021-03-18 00:00:56451 // Write a representation of this object into a trace.
Alexander Timin074cd182022-03-23 18:11:22452 void WriteIntoTrace(perfetto::TracedProto<TraceProto> proto) const;
Alexander Timinf785f342021-03-18 00:00:56453
Carlos Caballero76711352021-03-24 17:38:21454 // Returns true the node is navigating, i.e. it has an associated
455 // NavigationRequest.
456 bool HasNavigation();
457
shivanigithubf3ddff52021-07-03 22:06:30458 // Fenced frames (meta-bug crbug.com/1111084):
shivanigithub4cd016a2021-09-20 21:10:30459 // Note that these two functions cannot be invoked from a FrameTree's or
460 // its root node's constructor since they require the frame tree and the
461 // root node to be completely constructed.
462 //
shivanigithubf3ddff52021-07-03 22:06:30463 // Returns false if fenced frames are disabled. Returns true if the feature is
464 // enabled and if |this| is a fenced frame. Returns false for
465 // iframes embedded in a fenced frame. To clarify: for the MPArch
466 // implementation this only returns true if |this| is the actual
467 // root node of the inner FrameTree and not the proxy FrameTreeNode in the
468 // outer FrameTree.
Dominic Farolino4bc10ee2021-08-31 00:37:36469 bool IsFencedFrameRoot() const;
shivanigithubf3ddff52021-07-03 22:06:30470
471 // Returns false if fenced frames are disabled. Returns true if the
472 // feature is enabled and if |this| or any of its ancestor nodes is a
473 // fenced frame.
474 bool IsInFencedFrameTree() const;
475
shivanigithub4cd016a2021-09-20 21:10:30476 // Returns a valid nonce if `IsInFencedFrameTree()` returns true for `this`.
Garrett Tanzer34cb92fe2022-09-28 17:50:54477 // Returns nullopt otherwise.
478 //
479 // Nonce used in the net::IsolationInfo and blink::StorageKey for a fenced
480 // frame and any iframes nested within it. Not set if this frame is not in a
481 // fenced frame's FrameTree. Note that this could be a field in FrameTree for
482 // the MPArch version but for the shadow DOM version we need to keep it here
483 // since the fenced frame root is not a main frame for the latter. The value
484 // of the nonce will be the same for all of the the iframes inside a fenced
485 // frame tree. If there is a nested fenced frame it will have a different
486 // nonce than its parent fenced frame. The nonce will stay the same across
487 // navigations initiated from the fenced frame tree because it is always used
488 // in conjunction with other fields of the keys and would be good to access
489 // the same storage across same-origin navigations. If the navigation is
490 // same-origin/site then the same network stack partition/storage will be
491 // reused and if it's cross-origin/site then other parts of the key will
492 // change and so, even with the same nonce, another partition will be used.
493 // But if the navigation is initiated from the embedder, the nonce will be
494 // reinitialized irrespective of same or cross origin such that there is no
495 // privacy leak via storage shared between two embedder initiated navigations.
496 // Note that this reinitialization is implemented for all embedder-initiated
497 // navigations in MPArch, but only urn:uuid navigations in ShadowDOM.
498 absl::optional<base::UnguessableToken> GetFencedFrameNonce();
shivanigithub4cd016a2021-09-20 21:10:30499
Garrett Tanzer34cb92fe2022-09-28 17:50:54500 // If applicable, initialize the default fenced frame properties. Right now,
501 // this means setting a new fenced frame nonce. See comment on
shivanigithub4cd016a2021-09-20 21:10:30502 // fenced_frame_nonce() for when it is set to a non-null value. Invoked
503 // by FrameTree::Init() or FrameTree::AddFrame().
Garrett Tanzer34cb92fe2022-09-28 17:50:54504 void SetFencedFramePropertiesIfNeeded();
shivanigithub4cd016a2021-09-20 21:10:30505
Garrett Tanzera42fdef2022-06-13 16:09:14506 // Returns the mode attribute set on the fenced frame root if this frame is
507 // in a fenced frame tree, otherwise returns `absl::nullopt`.
Nan Line376738a2022-03-25 22:05:41508 absl::optional<blink::mojom::FencedFrameMode> GetFencedFrameMode();
Nan Lin171fe9a2022-02-17 16:42:16509
Dave Tapuskac8de3b02021-12-03 21:51:01510 // Helper for GetParentOrOuterDocument/GetParentOrOuterDocumentOrEmbedder.
511 // Do not use directly.
512 RenderFrameHostImpl* GetParentOrOuterDocumentHelper(bool escape_guest_view);
513
Harkiran Bolariab4437fd2021-08-11 17:51:22514 // Sets the unique_name and name fields on replication_state_. To be used in
515 // prerender activation to make sure the FrameTreeNode replication state is
516 // correct after the RenderFrameHost is moved between FrameTreeNodes. The
517 // renderers should already have the correct value, so unlike
518 // FrameTreeNode::SetFrameName, we do not notify them here.
Harkiran Bolaria4eacb3a2021-12-13 20:03:47519 // TODO(https://crbug.com/1237091): Remove this once the BrowsingContextState
520 // is implemented to utilize the new path.
Harkiran Bolariab4437fd2021-08-11 17:51:22521 void set_frame_name_for_activation(const std::string& unique_name,
522 const std::string& name) {
Harkiran Bolaria0b3bdef02022-03-10 13:04:40523 current_frame_host()->browsing_context_state()->set_frame_name(unique_name,
524 name);
Harkiran Bolariab4437fd2021-08-11 17:51:22525 }
526
Nan Linaaf84f72021-12-02 22:31:56527 // Returns true if error page isolation is enabled.
528 bool IsErrorPageIsolationEnabled() const;
529
W. James MacLean81b8d01f2022-01-25 20:50:59530 // Functions to store and retrieve a frame's srcdoc value on this
531 // FrameTreeNode.
532 void SetSrcdocValue(const std::string& srcdoc_value);
533 const std::string& srcdoc_value() const { return srcdoc_value_; }
534
Garrett Tanzerc69f4642022-08-15 22:15:14535 void set_fenced_frame_properties(
536 absl::optional<FencedFrameURLMapping::FencedFrameProperties>&
537 fenced_frame_properties) {
Garrett Tanzer2975eeac2022-08-22 16:34:01538 // TODO(crbug.com/1262022): Reenable this DCHECK once ShadowDOM and
539 // loading urns in iframes (for FLEDGE OT) are gone.
540 // DCHECK_EQ(fenced_frame_status_,
541 // RenderFrameHostImpl::FencedFrameStatus::kFencedFrameRoot);
Garrett Tanzerc69f4642022-08-15 22:15:14542 fenced_frame_properties_ = fenced_frame_properties;
543 }
544
Garrett Tanzer34cb92fe2022-09-28 17:50:54545 // Return the fenced frame properties for this fenced frame tree (if any).
546 // That is to say, this function returns the `fenced_frame_properties_`
547 // variable attached to the fenced frame root FrameTreeNode, which may be
548 // either this node or an ancestor of it.
Garrett Tanzerc69f4642022-08-15 22:15:14549 const absl::optional<FencedFrameURLMapping::FencedFrameProperties>&
Garrett Tanzer34cb92fe2022-09-28 17:50:54550 GetFencedFrameProperties();
Garrett Tanzerc69f4642022-08-15 22:15:14551
Yao Xiaoa2337ad2022-10-12 20:59:29552 // Return the number of fenced frame boundaries above this frame. The
553 // outermost main frame's frame tree has fenced frame depth 0, a topmost
554 // fenced frame tree embedded in the outermost main frame has fenced frame
555 // depth 1, etc.
556 size_t GetFencedFrameDepth();
557
558 // Traverse up from this node. Return all valid
559 // `node->fenced_frame_properties_->shared_storage_budget_metadata` (i.e. this
560 // node is subjected to the shared storage budgeting associated with those
561 // metadata). Every node that originates from sharedStorage.selectURL() will
562 // have an associated metadata. This indicates that the metadata can only
563 // possibly be associated with a fenced frame root, unless when
564 // `kAllowURNsInIframes` is enabled in which case they could be be associated
565 // with any node.
566 std::vector<const FencedFrameURLMapping::SharedStorageBudgetMetadata*>
Yao Xiao1ac702d2022-06-08 17:20:49567 FindSharedStorageBudgetMetadata();
568
Harkiran Bolariaebbe7702022-02-22 19:19:03569 // Accessor to BrowsingContextState for subframes only. Only main frame
570 // navigations can change BrowsingInstances and BrowsingContextStates,
571 // therefore for subframes associated BrowsingContextState never changes. This
572 // helper method makes this more explicit and guards against calling this on
573 // main frames (there an appropriate BrowsingContextState should be obtained
574 // from RenderFrameHost or from RenderFrameProxyHost as e.g. during
575 // cross-BrowsingInstance navigations multiple BrowsingContextStates exist in
576 // the same frame).
577 const scoped_refptr<BrowsingContextState>&
578 GetBrowsingContextStateForSubframe() const;
579
Arthur Hemerye4659282022-03-28 08:36:15580 // Clears the opener property of popups referencing this FrameTreeNode as
581 // their opener.
582 void ClearOpenerReferences();
583
Liam Bradyd2a41e152022-07-19 13:58:48584 // Calculates whether one of the ancestor frames or this frame has a CSPEE
585 // in place. This is eventually sent over to LocalFrame in the renderer where
586 // it will be used by HTMLFencedFrameElement::canLoadOpaqueURL for information
587 // it can't get on its own.
588 bool AncestorOrSelfHasCSPEE() const;
589
Miyoung Shin7cf88b42022-11-07 13:22:30590 // RenderFrameHostOwner implementation:
591 void RestartNavigationAsCrossDocument(
592 std::unique_ptr<NavigationRequest> navigation_request) override;
Julie Jeongeun Kimc1b07c32022-11-11 10:26:32593 Navigator& GetCurrentNavigator() override;
Miyoung Shine16cd2262022-11-30 05:52:16594 RenderFrameHostManager& GetRenderFrameHostManager() override;
Julie Jeongeun Kim2132b37f82022-11-23 08:30:46595 void SetFocusedFrame(SiteInstanceGroup* source) override;
Miyoung Shin7cf88b42022-11-07 13:22:30596
Miyoung Shin8a66ec022022-11-28 23:50:09597 // Updates the user activation state in the browser frame tree and in the
598 // frame trees in all renderer processes except the renderer for this node
599 // (which initiated the update). Returns |false| if the update tries to
600 // consume an already consumed/expired transient state, |true| otherwise. See
601 // the comment on `user_activation_state_` in RenderFrameHostImpl.
602 //
603 // The |notification_type| parameter is used for histograms, only for the case
604 // |update_state == kNotifyActivation|.
605 bool UpdateUserActivationState(
606 blink::mojom::UserActivationUpdateType update_type,
607 blink::mojom::UserActivationNotificationType notification_type) override;
608
Miyoung Shinff13ed22022-11-30 09:21:47609 std::unique_ptr<NavigationRequest>
610 CreateNavigationRequestForSynchronousRendererCommit(
611 RenderFrameHostImpl* render_frame_host,
612 bool is_same_document,
613 const GURL& url,
614 const url::Origin& origin,
615 const net::IsolationInfo& isolation_info_for_subresources,
616 blink::mojom::ReferrerPtr referrer,
617 const ui::PageTransition& transition,
618 bool should_replace_current_entry,
619 const std::string& method,
620 bool has_transient_activation,
621 bool is_overriding_user_agent,
622 const std::vector<GURL>& redirects,
623 const GURL& original_url,
624 std::unique_ptr<CrossOriginEmbedderPolicyReporter> coep_reporter,
625 std::unique_ptr<WebBundleNavigationInfo> web_bundle_navigation_info,
626 std::unique_ptr<SubresourceWebBundleNavigationInfo>
627 subresource_web_bundle_navigation_info,
628 int http_response_code) override;
629
danakjc492bf82020-09-09 20:02:44630 private:
Yuzu Saijo03dbf9b2022-07-22 04:29:45631 friend class CSPEmbeddedEnforcementUnitTest;
Charlie Hubb5943d2021-03-09 19:46:12632 FRIEND_TEST_ALL_PREFIXES(SitePerProcessPermissionsPolicyBrowserTest,
danakjc492bf82020-09-09 20:02:44633 ContainerPolicyDynamic);
Charlie Hubb5943d2021-03-09 19:46:12634 FRIEND_TEST_ALL_PREFIXES(SitePerProcessPermissionsPolicyBrowserTest,
danakjc492bf82020-09-09 20:02:44635 ContainerPolicySandboxDynamic);
Yuzu Saijo03dbf9b2022-07-22 04:29:45636 FRIEND_TEST_ALL_PREFIXES(NavigationRequestTest, StorageKeyToCommit);
Arthur Sonzogni64457592022-11-22 11:08:59637 FRIEND_TEST_ALL_PREFIXES(
638 NavigationRequestTest,
639 NavigationToCredentiallessDocumentNetworkIsolationInfo);
Yuzu Saijo03dbf9b2022-07-22 04:29:45640 FRIEND_TEST_ALL_PREFIXES(RenderFrameHostImplTest,
Arthur Sonzogni64457592022-11-22 11:08:59641 ChildOfCredentiallessIsCredentialless);
Yifan Luo86a79f42022-08-16 18:38:27642 FRIEND_TEST_ALL_PREFIXES(ContentPasswordManagerDriverTest,
Arthur Sonzogni64457592022-11-22 11:08:59643 PasswordAutofillDisabledOnCredentiallessIframe);
danakjc492bf82020-09-09 20:02:44644
Dominic Farolino8a2187b2021-12-24 20:44:21645 // Called by the destructor. When `this` is an outer dummy FrameTreeNode
646 // representing an inner FrameTree, this method destroys said inner FrameTree.
647 void DestroyInnerFrameTreeIfExists();
648
danakjc492bf82020-09-09 20:02:44649 class OpenerDestroyedObserver;
650
danakjc492bf82020-09-09 20:02:44651 // The |notification_type| parameter is used for histograms only.
652 bool NotifyUserActivation(
653 blink::mojom::UserActivationNotificationType notification_type);
654
655 bool ConsumeTransientUserActivation();
656
657 bool ClearUserActivation();
658
659 // Verify that the renderer process is allowed to set user activation on this
660 // frame by checking whether this frame's RenderWidgetHost had previously seen
661 // an input event that might lead to user activation. If user activation
662 // should be allowed, this returns true and also clears corresponding pending
663 // user activation state in the widget. Otherwise, this returns false.
664 bool VerifyUserActivation();
665
666 // The next available browser-global FrameTreeNode ID.
667 static int next_frame_tree_node_id_;
668
669 // The FrameTree that owns us.
Keishi Hattori0e45c022021-11-27 09:25:52670 raw_ptr<FrameTree> frame_tree_; // not owned.
danakjc492bf82020-09-09 20:02:44671
danakjc492bf82020-09-09 20:02:44672 // A browser-global identifier for the frame in the page, which stays stable
673 // even if the frame does a cross-process navigation.
674 const int frame_tree_node_id_;
675
676 // The RenderFrameHost owning this FrameTreeNode, which cannot change for the
677 // life of this FrameTreeNode. |nullptr| if this node is the root.
Keishi Hattori0e45c022021-11-27 09:25:52678 const raw_ptr<RenderFrameHostImpl> parent_;
danakjc492bf82020-09-09 20:02:44679
danakjc492bf82020-09-09 20:02:44680 // The frame that opened this frame, if any. Will be set to null if the
681 // opener is closed, or if this frame disowns its opener by setting its
682 // window.opener to null.
Keishi Hattori0e45c022021-11-27 09:25:52683 raw_ptr<FrameTreeNode> opener_ = nullptr;
danakjc492bf82020-09-09 20:02:44684
685 // An observer that clears this node's |opener_| if the opener is destroyed.
686 // This observer is added to the |opener_|'s observer list when the |opener_|
687 // is set to a non-null node, and it is removed from that list when |opener_|
688 // changes or when this node is destroyed. It is also cleared if |opener_|
689 // is disowned.
690 std::unique_ptr<OpenerDestroyedObserver> opener_observer_;
691
Rakina Zata Amni3a48ae42022-05-05 03:39:56692 // Unlike `opener_`, the "original opener chain" doesn't reflect
693 // window.opener, which can be suppressed or updated. The "original opener"
694 // is the main frame of the actual opener of this frame. This traces the all
695 // the way back, so if the original opener was closed (deleted or severed due
696 // to COOP), but _it_ had an original opener, this will return the original
697 // opener's original opener, etc. So this value will always be set as long as
698 // there is at least one live frame in the chain whose connection is not
699 // severed due to COOP.
700 raw_ptr<FrameTreeNode> first_live_main_frame_in_original_opener_chain_ =
701 nullptr;
danakjc492bf82020-09-09 20:02:44702
Wolfgang Beyerd8809db2020-09-30 15:29:39703 // The devtools frame token of the frame which opened this frame. This is
704 // not cleared even if the opener is destroyed or disowns the frame.
Anton Bikineevf62d1bf2021-05-15 17:56:07705 absl::optional<base::UnguessableToken> opener_devtools_frame_token_;
Wolfgang Beyerd8809db2020-09-30 15:29:39706
Rakina Zata Amni3a48ae42022-05-05 03:39:56707 // An observer that updates this node's
708 // |first_live_main_frame_in_original_opener_chain_| to the next original
709 // opener in the chain if the original opener is destroyed.
danakjc492bf82020-09-09 20:02:44710 std::unique_ptr<OpenerDestroyedObserver> original_opener_observer_;
711
arthursonzogni034bb9c2020-10-01 08:29:56712 // When created by an opener, the URL specified in window.open(url)
713 // Please refer to {Get,Set}InitialPopupURL() documentation.
714 GURL initial_popup_url_;
715
716 // When created using window.open, the origin of the creator.
717 // Please refer to {Get,Set}PopupCreatorOrigin() documentation.
718 url::Origin popup_creator_origin_;
719
W. James MacLean81b8d01f2022-01-25 20:50:59720 // If the url from the the last BeginNavigation is about:srcdoc, this value
721 // stores the srcdoc_attribute's value for re-use in history navigations.
722 std::string srcdoc_value_;
723
danakjc492bf82020-09-09 20:02:44724 // Whether the frame's owner element in the parent document is collapsed.
arthursonzogni9816b9192021-03-29 16:09:19725 bool is_collapsed_ = false;
danakjc492bf82020-09-09 20:02:44726
Daniel Cheng6ac128172021-05-25 18:49:01727 // The type of frame owner for this frame. This is only relevant for non-main
728 // frames.
Kevin McNee43fe8292021-10-04 22:59:41729 const blink::FrameOwnerElementType frame_owner_element_type_ =
730 blink::FrameOwnerElementType::kNone;
Daniel Cheng9bd90f92021-04-23 20:49:45731
Daniel Cheng6ac128172021-05-25 18:49:01732 // The tree scope type of frame owner element, i.e. whether the element is in
733 // the document tree (https://dom.spec.whatwg.org/#document-trees) or the
734 // shadow tree (https://dom.spec.whatwg.org/#shadow-trees). This is only
735 // relevant for non-main frames.
736 const blink::mojom::TreeScopeType tree_scope_type_ =
737 blink::mojom::TreeScopeType::kDocument;
738
danakjc492bf82020-09-09 20:02:44739 // Track the pending sandbox flags and container policy for this frame. When a
740 // parent frame dynamically updates 'sandbox', 'allow', 'allowfullscreen',
741 // 'allowpaymentrequest' or 'src' attributes, the updated policy for the frame
Harkiran Bolaria4eacb3a2021-12-13 20:03:47742 // is stored here, and transferred into
743 // render_manager_.current_replication_state().frame_policy when they take
744 // effect on the next frame navigation.
danakjc492bf82020-09-09 20:02:44745 blink::FramePolicy pending_frame_policy_;
746
747 // Whether the frame was created by javascript. This is useful to prune
748 // history entries when the frame is removed (because frames created by
749 // scripts are never recreated with the same unique name - see
750 // https://crbug.com/500260).
arthursonzogni9816b9192021-03-29 16:09:19751 const bool is_created_by_script_;
danakjc492bf82020-09-09 20:02:44752
danakjc492bf82020-09-09 20:02:44753 // Tracks the scrolling and margin properties for this frame. These
754 // properties affect the child renderer but are stored on its parent's
755 // frame element. When this frame's parent dynamically updates these
756 // properties, we update them here too.
757 //
758 // Note that dynamic updates only take effect on the next frame navigation.
759 blink::mojom::FrameOwnerProperties frame_owner_properties_;
760
Yuzu Saijo03dbf9b2022-07-22 04:29:45761 // Contains the tracked HTML attributes of the corresponding iframe element,
762 // such as 'id' and 'src'.
763 blink::mojom::IframeAttributesPtr attributes_;
Antonio Sartori5abc8de2021-07-13 08:42:47764
danakjc492bf82020-09-09 20:02:44765 // Owns an ongoing NavigationRequest until it is ready to commit. It will then
766 // be reset and a RenderFrameHost will be responsible for the navigation.
767 std::unique_ptr<NavigationRequest> navigation_request_;
768
769 // List of objects observing this FrameTreeNode.
770 base::ObserverList<Observer>::Unchecked observers_;
771
772 base::TimeTicks last_focus_time_;
773
arthursonzogni9816b9192021-03-29 16:09:19774 bool was_discarded_ = false;
danakjc492bf82020-09-09 20:02:44775
Abhijeet Kandalkar3f29bc42022-09-23 12:39:58776 const FencedFrameStatus fenced_frame_status_ =
777 FencedFrameStatus::kNotNestedInFencedFrame;
Harkiran Bolaria16f2c48d2022-04-22 12:39:57778
Garrett Tanzerc69f4642022-08-15 22:15:14779 // If this is a fenced frame resulting from a urn:uuid navigation, this
780 // contains all the metadata specifying the resulting context.
Garrett Tanzer34cb92fe2022-09-28 17:50:54781 // TODO(crbug.com/1262022): Move this into the FrameTree once ShadowDOM
782 // and urn iframes are gone.
Garrett Tanzerc69f4642022-08-15 22:15:14783 absl::optional<FencedFrameURLMapping::FencedFrameProperties>
784 fenced_frame_properties_;
785
Lukasz Anforowicz147141962020-12-16 18:03:24786 // Manages creation and swapping of RenderFrameHosts for this frame.
787 //
788 // This field needs to be declared last, because destruction of
789 // RenderFrameHostManager may call arbitrary callbacks (e.g. via
790 // WebContentsObserver::DidFinishNavigation fired after RenderFrameHostManager
791 // destructs a RenderFrameHostImpl and its NavigationRequest). Such callbacks
792 // may try to use FrameTreeNode's fields above - this would be an undefined
793 // behavior if the fields (even trivially-destructible ones) were destructed
794 // before the RenderFrameHostManager's destructor runs. See also
795 // https://crbug.com/1157988.
796 RenderFrameHostManager render_manager_;
danakjc492bf82020-09-09 20:02:44797};
798
799} // namespace content
800
801#endif // CONTENT_BROWSER_RENDERER_HOST_FRAME_TREE_NODE_H_