[SH] Don't call TextFragmentSelectorGenerator for iframes.

TextFragmentSelectorGenerator gets initialized only for main frame
as link to text is supported only for those. Therefore, clients
shouldn't call TextFragmentSelectorGenerator for iframes.

Also adding a DCHECK that selection happened on the same frame as remote
interface is being bind to.

Bug: 1139864
Change-Id: Ibe4b03e04ef995ebb000a0488ffaa64e378bf20d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2487703Reviewed-by: Scott Violet <sky@chromium.org>
Reviewed-by: David Bokan <bokan@chromium.org>
Reviewed-by: John Lee <johntlee@chromium.org>
Commit-Queue: Gayane Petrosyan <gayane@chromium.org>
Cr-Commit-Position: refs/heads/master@{#821209}

chrome/browser/renderer_context_menu/copy_link_to_text_menu_observer.cc

@@ -66,15 +66,23 @@ void CopyLinkToTextMenuObserver::ExecuteCommand(int command_id) {
   // the generated string if it succeeds or an empty string if it fails.
   content::RenderFrameHost* main_frame =
       proxy_->GetWebContents()->GetMainFrame();
-  if (main_frame) {
-    main_frame->GetRemoteInterfaces()->GetInterface(
-        remote_.BindNewPipeAndPassReceiver());
-    remote_->GenerateSelector(
-        base::BindOnce(&CopyLinkToTextMenuObserver::OnGeneratedSelector,
-                       weak_ptr_factory_.GetWeakPtr(),
-                       std::make_unique<ui::ClipboardDataEndpoint>(
-                           main_frame->GetLastCommittedOrigin())));
+  if (!main_frame)
+    return;
+
+  if (main_frame != proxy_->GetWebContents()->GetFocusedFrame()) {
+    OnGeneratedSelector(std::make_unique<ui::ClipboardDataEndpoint>(
+                            main_frame->GetLastCommittedOrigin()),
+                        std::string());
+    return;
   }
+
+  main_frame->GetRemoteInterfaces()->GetInterface(
+      remote_.BindNewPipeAndPassReceiver());
+  remote_->GenerateSelector(
+      base::BindOnce(&CopyLinkToTextMenuObserver::OnGeneratedSelector,
+                     weak_ptr_factory_.GetWeakPtr(),
+                     std::make_unique<ui::ClipboardDataEndpoint>(
+                         main_frame->GetLastCommittedOrigin())));
 }
 
 void CopyLinkToTextMenuObserver::OnGeneratedSelector(

chrome/browser/renderer_context_menu/copy_link_to_text_menu_observer_interactive_uitest.cc

@@ -9,9 +9,12 @@
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/app/chrome_command_ids.h"
 #include "chrome/browser/renderer_context_menu/mock_render_view_context_menu.h"
+#include "chrome/browser/ui/browser.h"
 #include "chrome/test/base/in_process_browser_test.h"
+#include "chrome/test/base/ui_test_utils.h"
 #include "content/public/browser/context_menu_params.h"
 #include "content/public/test/browser_test.h"
+#include "net/dns/mock_host_resolver.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/clipboard/clipboard.h"
 
@@ -22,7 +25,16 @@ class CopyLinkToTextMenuObserverTest : public InProcessBrowserTest {
   CopyLinkToTextMenuObserverTest();
 
   void SetUp() override { InProcessBrowserTest::SetUp(); }
-  void SetUpOnMainThread() override { Reset(false); }
+  void SetUpOnMainThread() override {
+    Reset(false);
+
+    host_resolver()->AddRule("*", "127.0.0.1");
+
+    // Add content/test/data for cross_site_iframe_factory.html
+    embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
+
+    ASSERT_TRUE(embedded_test_server()->Start());
+  }
   void TearDownOnMainThread() override {
     observer_.reset();
     menu_.reset();
@@ -113,3 +125,33 @@ IN_PROC_BROWSER_TEST_F(CopyLinkToTextMenuObserverTest, ReplacesRefInURL) {
   EXPECT_EQ(base::UTF8ToUTF16("\"hello world\"\nhttp://foo.com/#:~:text=hello"),
             text);
 }
+
+// crbug.com/1139864
+IN_PROC_BROWSER_TEST_F(CopyLinkToTextMenuObserverTest,
+                       InvalidSelectorForIframe) {
+  GURL main_url(
+      embedded_test_server()->GetURL("a.com", "/page_with_iframe.html"));
+
+  ui_test_utils::NavigateToURL(browser(), main_url);
+
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  content::RenderFrameHost* main_frame_a = web_contents->GetMainFrame();
+  content::RenderFrameHost* child_frame_b = ChildFrameAt(main_frame_a, 0);
+  EXPECT_TRUE(ExecuteScript(child_frame_b, "window.focus();"));
+  EXPECT_EQ(child_frame_b, web_contents->GetFocusedFrame());
+
+  menu()->set_web_contents(web_contents);
+
+  content::BrowserTestClipboardScope test_clipboard_scope;
+  content::ContextMenuParams params;
+  params.page_url = main_url;
+  params.selection_text = base::UTF8ToUTF16("hello world");
+  InitMenu(params);
+  menu()->ExecuteCommand(IDC_CONTENT_CONTEXT_COPYLINKTOTEXT, 0);
+
+  ui::Clipboard* clipboard = ui::Clipboard::GetForCurrentThread();
+  base::string16 text;
+  clipboard->ReadText(ui::ClipboardBuffer::kCopyPaste, nullptr, &text);
+  EXPECT_EQ(base::UTF8ToUTF16("\"hello world\"\n" + main_url.spec()), text);
+}

third_party/blink/renderer/core/page/scrolling/text_fragment_selector_generator.cc

@@ -180,6 +180,8 @@ void TextFragmentSelectorGenerator::UpdateSelection(
 void TextFragmentSelectorGenerator::BindTextFragmentSelectorProducer(
     mojo::PendingReceiver<mojom::blink::TextFragmentSelectorProducer>
         producer) {
+  DCHECK(selection_frame_);
+
   selector_producer_.reset();
   selector_producer_.Bind(
       std::move(producer),