Remove WebGestureEvent::is_bubbled_from_child_frame

This CL removes that attributes. It also adds a gesture scroll bubbling
case to ensure that the behavior is correct.

Due to our previous temporary fix, we set |scrolling_touch_action_| to
Auto at GSB if it has no value. To prove that this CL is actually working,
we do:
PS#1: remove the set |scrolling_touch_action_| to Auto at GSB, and
the test will crash.
PS#2: Keep 1, add a line in CrossProcessFrameConnector::BubbleScrollEvent
which sets the |scrolling_touch_action_| to Auto. The test will pass.
PS#3: Keep the temporary fix which sets |scrolling_touch_action_| to
Auto at GSB.

TBR=pdr@chromium.org

Bug: 852835, 841270
Change-Id: Ib33a39b4b0ef61e88645da427b920687bbcc80c9
Reviewed-on: https://chromium-review.googlesource.com/1101315
Commit-Queue: Xida Chen <xidachen@chromium.org>
Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
Reviewed-by: Antoine Labour <piman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#568281}

content/browser/frame_host/cross_process_frame_connector.cc

@@ -272,7 +272,9 @@ void CrossProcessFrameConnector::BubbleScrollEvent(
   const gfx::PointF root_point =
       view_->TransformPointToRootCoordSpaceF(event.PositionInWidget());
   resent_gesture_event.SetPositionInWidget(root_point);
-  resent_gesture_event.is_bubbled_from_child_frame = true;
+  // When a gesture event is bubbled to the parent frame, set the allowed touch
+  // action of the parent frame to Auto so that this gesture event is allowed.
+  parent_view->host()->input_router()->ForceSetTouchActionAuto();
 
   if (view_->wheel_scroll_latching_enabled()) {
     if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {

content/browser/renderer_host/input/input_router.h

@@ -79,6 +79,11 @@ class InputRouter : public IPC::Listener {
   // Called when a set-touch-action message is received from the renderer
   // for a touch start event that is currently in flight.
   virtual void OnSetTouchAction(cc::TouchAction touch_action) = 0;
+
+  // In the case when a gesture event is bubbled from a child frame to the main
+  // frame, we set the touch action in the main frame Auto even if there is no
+  // pending touch start.
+  virtual void ForceSetTouchActionAuto() = 0;
 };
 
 }  // namespace content

content/browser/renderer_host/input/input_router_impl.cc

@@ -144,13 +144,6 @@ void InputRouterImpl::SendGestureEvent(
     return;
   }
 
-  // If a gesture event is bubbled from a child frame to the main frame, then
-  // the main frame may not have |allowed_touch_action_| set, in this case we
-  // set it to Auto.
-  // TODO(https://crbug.com/841270): Correct the behavior of scroll bubbling
-  // across an iframe.
-  if (gesture_event.event.is_bubbled_from_child_frame)
-    touch_action_filter_.OnSetTouchAction(cc::kTouchActionAuto);
   if (touch_action_filter_.FilterGestureEvent(&gesture_event.event) ==
       FilterGestureEventResult::kFilterGestureEventFiltered) {
     disposition_handler_->OnGestureEventAck(gesture_event,
@@ -616,6 +609,10 @@ void InputRouterImpl::OnHasTouchEventHandlers(bool has_handlers) {
   client_->OnHasTouchEventHandlers(has_handlers);
 }
 
+void InputRouterImpl::ForceSetTouchActionAuto() {
+  touch_action_filter_.OnSetTouchAction(cc::kTouchActionAuto);
+}
+
 void InputRouterImpl::OnSetTouchAction(cc::TouchAction touch_action) {
   TRACE_EVENT1("input", "InputRouterImpl::OnSetTouchAction", "action",
                touch_action);

content/browser/renderer_host/input/input_router_impl.h

@@ -85,6 +85,7 @@ class CONTENT_EXPORT InputRouterImpl : public InputRouter,
   void StopFling() override;
   bool FlingCancellationIsDeferred() override;
   void OnSetTouchAction(cc::TouchAction touch_action) override;
+  void ForceSetTouchActionAuto() override;
 
   // InputHandlerHost impl
   void CancelTouchTimeout() override;

content/browser/renderer_host/input/touch_action_filter.cc

@@ -304,6 +304,12 @@ void TouchActionFilter::OnHasTouchEventHandlers(bool has_handlers) {
     return;
   has_touch_event_handler_ = has_handlers;
   ResetTouchAction();
+  // If a page has a touch event handler, this function can be called twice with
+  // has_handlers = false first and then true later. When it is true, we need to
+  // reset the |scrolling_touch_action_|. However, we do not want to reset it if
+  // there is an active scroll in progress.
+  if (has_touch_event_handler_ && !touchscreen_scroll_in_progress_)
+    scrolling_touch_action_.reset();
 }
 
 }  // namespace content

content/browser/renderer_host/render_widget_host_unittest.cc

@@ -136,6 +136,7 @@ class MockInputRouter : public InputRouter {
   void StopFling() override {}
   bool FlingCancellationIsDeferred() override { return false; }
   void OnSetTouchAction(cc::TouchAction touch_action) override {}
+  void ForceSetTouchActionAuto() override {}
 
   // IPC::Listener
   bool OnMessageReceived(const IPC::Message& message) override {

content/browser/site_per_process_hit_test_browsertest.cc

@@ -1005,13 +1005,17 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
 class SitePerProcessEmulatedTouchBrowserTest
     : public SitePerProcessHitTestBrowserTest {
  public:
-  enum TestType { ScrollBubbling, PinchGoesToMainFrame };
+  enum TestType { ScrollBubbling, PinchGoesToMainFrame, TouchActionBubbling };
 
   ~SitePerProcessEmulatedTouchBrowserTest() override {}
 
   void RunTest(TestType test_type) {
-    GURL main_url(embedded_test_server()->GetURL(
-        "/frame_tree/page_with_positioned_frame.html"));
+    std::string url;
+    if (test_type == TouchActionBubbling)
+      url = "/frame_tree/page_with_pany_frame.html";
+    else
+      url = "/frame_tree/page_with_positioned_frame.html";
+    GURL main_url(embedded_test_server()->GetURL(url));
     ASSERT_TRUE(NavigateToURL(shell(), main_url));
 
     // It is safe to obtain the root frame tree node here, as it doesn't change.
@@ -1057,6 +1061,7 @@ class SitePerProcessEmulatedTouchBrowserTest
     blink::WebInputEvent::Type expected_gesture_type;
     switch (test_type) {
       case ScrollBubbling:
+      case TouchActionBubbling:
         expected_gesture_type = blink::WebInputEvent::kGestureScrollBegin;
         break;
       case PinchGoesToMainFrame:
@@ -1128,7 +1133,7 @@ class SitePerProcessEmulatedTouchBrowserTest
     router->RouteMouseEvent(root_rwhv, &mouse_drag_event, ui::LatencyInfo());
     router->RouteMouseEvent(root_rwhv, &mouse_up_event, ui::LatencyInfo());
 
-    if (test_type == ScrollBubbling) {
+    if (test_type == ScrollBubbling || test_type == TouchActionBubbling) {
       // Verify child receives GestureScrollBegin.
       child_gesture_event_observer.Wait();
     }
@@ -1152,6 +1157,11 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessEmulatedTouchBrowserTest,
   RunTest(PinchGoesToMainFrame);
 }
 
+IN_PROC_BROWSER_TEST_P(SitePerProcessEmulatedTouchBrowserTest,
+                       EmulatedGestureScrollBubbles) {
+  RunTest(TouchActionBubbling);
+}
+
 #if defined(USE_AURA) || defined(OS_ANDROID)
 
 // When unconsumed scrolls in a child bubble to the root and start an

content/test/data/frame_tree/page_with_pany_frame.html

+<!DOCTYPE html>
+<style>
+.container {
+  touch-action: pan-y;
+}
+iframe {
+  position:absolute;
+  top: 50px;
+  left: 50px;
+  width: 100px;
+  height: 100px;
+}
+</style>
+<html>
+<body>
+<div class="container">
+  <iframe src="/cross-site/baz.com/title1.html"></iframe>
+</div>
+This page contains a positioned cross-origin iframe.
+</body>
+</html>

third_party/blink/public/platform/web_gesture_event.h

@@ -34,10 +34,6 @@ class WebGestureEvent : public WebInputEvent {
 
   bool is_source_touch_event_set_non_blocking;
 
-  // Whether a gesture event is bubbled across frames (such as from an iframe
-  // to the main frame).
-  bool is_bubbled_from_child_frame = false;
-
   // The pointer type for the first touch point in the gesture.
   WebPointerProperties::PointerType primary_pointer_type =
       WebPointerProperties::PointerType::kUnknown;