Allow null RenderWidget on RenderFrameProxy.

Previously, RenderFrameProxy always relied on existence of a RenderWidget. This CL updates RenderFrameProxy to not have a RenderWidget if the proxy is for the main frame, or a subframe of a remote main frame.

Change-Id: Ia24cd85276df77d835e723563fd25de9c4c8be5d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1809514
Commit-Queue: Erik Chen <erikchen@chromium.org>
Auto-Submit: Erik Chen <erikchen@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#698670}

content/renderer/render_frame_proxy.cc

@@ -100,7 +100,7 @@ RenderFrameProxy* RenderFrameProxy::CreateProxyToReplaceFrame(
           ? frame_to_replace->GetLocalRootRenderWidget()
           : RenderFrameProxy::FromWebFrame(
                 frame_to_replace->GetWebFrame()->Parent()->ToWebRemoteFrame())
-                ->render_widget();
+                ->render_widget_;
   proxy->Init(web_frame, frame_to_replace->render_view(), widget,
               parent_is_local);
   return proxy.release();
@@ -146,7 +146,7 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
         replicated_state.frame_owner_element_type, proxy.get(), opener);
     proxy->unique_name_ = replicated_state.unique_name;
     render_view = parent->render_view();
-    render_widget = parent->render_widget();
+    render_widget = parent->render_widget_;
   }
 
   proxy->Init(web_frame, render_view, render_widget, false);
@@ -221,6 +221,7 @@ RenderFrameProxy::RenderFrameProxy(int routing_id)
 }
 
 RenderFrameProxy::~RenderFrameProxy() {
+  if (render_widget_)
     render_widget_->UnregisterRenderFrameProxy(this);
 
   CHECK(!web_frame_);
@@ -234,13 +235,21 @@ void RenderFrameProxy::Init(blink::WebRemoteFrame* web_frame,
                             bool parent_is_local) {
   CHECK(web_frame);
   CHECK(render_view);
-  CHECK(render_widget);
 
   web_frame_ = web_frame;
   render_view_ = render_view;
   render_widget_ = render_widget;
 
+  // |render_widget_| can be null if this is a proxy for a remote main frame, or
+  // a subframe of that proxy. We don't need to register as an observer [since
+  // the RenderWidget is undead/won't exist]. The observer is used to propagate
+  // VisualProperty changes down the frame/process hierarchy. Remote main frame
+  // proxies do not participate in this flow.
+  if (render_widget_) {
     render_widget_->RegisterRenderFrameProxy(this);
+    pending_visual_properties_.screen_info =
+        render_widget_->GetOriginalScreenInfo();
+  }
 
   std::pair<FrameProxyMap::iterator, bool> result =
       g_frame_proxy_map.Get().insert(std::make_pair(web_frame_, this));
@@ -248,9 +257,6 @@ void RenderFrameProxy::Init(blink::WebRemoteFrame* web_frame,
 
   if (parent_is_local)
     compositing_helper_ = std::make_unique<ChildFrameCompositingHelper>(this);
-
-  pending_visual_properties_.screen_info =
-      render_widget_->GetOriginalScreenInfo();
 }
 
 void RenderFrameProxy::ResendVisualProperties() {
@@ -810,8 +816,10 @@ void RenderFrameProxy::FrameRectsChanged(
   pending_visual_properties_.screen_space_rect = gfx::Rect(screen_space_rect);
   pending_visual_properties_.local_frame_size =
       gfx::Size(local_frame_rect.width, local_frame_rect.height);
+  if (render_widget_) {
     pending_visual_properties_.screen_info =
         render_widget_->GetOriginalScreenInfo();
+  }
   if (crashed_) {
     // Update the sad page to match the current size.
     compositing_helper_->ChildFrameGone(local_frame_size(),

content/renderer/render_frame_proxy.h

@@ -154,9 +154,6 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
 
   int provisional_frame_routing_id() { return provisional_frame_routing_id_; }
 
-  // Returns the widget used for the local frame root.
-  RenderWidget* render_widget() { return render_widget_; }
-
   void SynchronizeVisualProperties();
 
   const gfx::Rect& screen_space_rect() const {
@@ -299,7 +296,11 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
   std::unique_ptr<ChildFrameCompositingHelper> compositing_helper_;
 
   RenderViewImpl* render_view_;
-  RenderWidget* render_widget_;
+
+  // The widget used for the local frame root. Can be nullptr if there
+  // is no local frame root. This happens for main frame proxies or subframes of
+  // main frame proxies.
+  RenderWidget* render_widget_ = nullptr;
 
   // Contains token to be used as a frame id in the devtools protocol.
   // It is derived from the content's devtools_frame_token, is

content/renderer/render_view_impl.h

@@ -142,7 +142,9 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   blink::WebView* webview();
   const blink::WebView* webview() const;
 
-  // Returns the RenderWidget for this RenderView.
+  // Returns the RenderWidget owned by this RenderView. Can be nullptr if the
+  // RenderView does not own a RenderWidget [e.g. for remote main frame in
+  // future].
   RenderWidget* GetWidget();
   const RenderWidget* GetWidget() const;