Reland "Refactor OOPIF scroll bubbling state and cancellation"

This is a reland of b9e5ed2a

Original change's description:
> Refactor OOPIF scroll bubbling state and cancellation
>
> Whether or not a child is bubbling scroll was being tracked in both
> CrossProcessFrameConnector and RenderWidgetHostViewChildFrame. It's
> simpler to just have it in RWHVCF.
>
> There are several cases where we generate fake scroll updates when
> cancelling scroll bubbling. This is a relic from the non-scroll latching
> code paths and has been removed. We also deduplicate the scroll bubbling
> cancellation code.
>
> We were tracking the view from which scroll events are bubbled by keeping
> a reference to that view's parent. We now just keep a reference to the
> originating view directly.
>
> We also now properly cancel scroll bubbling when a child detaches.
>
> Bug: 828422, 897216
> Change-Id: Iee983bd9ea05b324d556c66320a1bc5e544de057
> Reviewed-on: https://chromium-review.googlesource.com/c/1357563
> Reviewed-by: Ken Buchanan <kenrb@chromium.org>
> Commit-Queue: Kevin McNee <mcnee@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#615184}

Tbr: kenrb@chromium.org
Bug: 828422, 897216
Change-Id: If529545300f6bbb7a7056cdbebbd8317cb274f7a
Reviewed-on: https://chromium-review.googlesource.com/c/1371010Reviewed-by: Kevin McNee <mcnee@chromium.org>
Commit-Queue: Kevin McNee <mcnee@chromium.org>
Cr-Commit-Position: refs/heads/master@{#615557}

content/browser/frame_host/cross_process_frame_connector.cc

@@ -68,8 +68,7 @@ RenderFrameHostImpl* RootRenderFrameHost(RenderFrameHostImpl* frame) {
 CrossProcessFrameConnector::CrossProcessFrameConnector(
     RenderFrameProxyHost* frame_proxy_in_parent_renderer)
     : FrameConnectorDelegate(IsUseZoomForDSFEnabled()),
-      frame_proxy_in_parent_renderer_(frame_proxy_in_parent_renderer),
-      is_scroll_bubbling_(false) {
+      frame_proxy_in_parent_renderer_(frame_proxy_in_parent_renderer) {
   frame_proxy_in_parent_renderer->frame_tree_node()
       ->render_manager()
       ->current_frame_host()
@@ -119,14 +118,13 @@ void CrossProcessFrameConnector::SetView(RenderWidgetHostViewChildFrame* view) {
     // The RenderWidgetHostDelegate needs to be checked because SetView() can
     // be called during nested WebContents destruction. See
     // https://crbug.com/644306.
-    if (is_scroll_bubbling_ && GetParentRenderWidgetHostView() &&
+    if (GetParentRenderWidgetHostView() &&
         GetParentRenderWidgetHostView()->host()->delegate()) {
       GetParentRenderWidgetHostView()
           ->host()
           ->delegate()
           ->GetInputEventRouter()
-          ->CancelScrollBubbling(view_);
-      is_scroll_bubbling_ = false;
+          ->WillDetachChildView(view_);
     }
     view_->SetFrameConnectorDelegate(nullptr);
   }
@@ -298,14 +296,7 @@ void CrossProcessFrameConnector::BubbleScrollEvent(
   // action of the parent frame to Auto so that this gesture event is allowed.
   parent_view->host()->input_router()->ForceSetTouchActionAuto();
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
-    event_router->BubbleScrollEvent(parent_view, resent_gesture_event, view_);
-    is_scroll_bubbling_ = true;
-  } else if (is_scroll_bubbling_) {
-    event_router->BubbleScrollEvent(parent_view, resent_gesture_event, view_);
-  }
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd)
-    is_scroll_bubbling_ = false;
+  event_router->BubbleScrollEvent(parent_view, view_, resent_gesture_event);
 }
 
 bool CrossProcessFrameConnector::HasFocus() {

content/browser/frame_host/cross_process_frame_connector.h

@@ -202,8 +202,6 @@ class CONTENT_EXPORT CrossProcessFrameConnector
   // which is set through CSS.
   bool is_hidden_ = false;
 
-  bool is_scroll_bubbling_;
-
   // Used to make sure we only log UMA once per renderer crash.
   bool is_crash_already_logged_ = false;
 

content/browser/renderer_host/render_widget_host_input_event_router.cc

@@ -43,15 +43,6 @@ void TransformEventTouchPositions(blink::WebTouchEvent* event,
   }
 }
 
-blink::WebGestureEvent DummyGestureScrollUpdate(
-    base::TimeTicks time_stamp,
-    blink::WebGestureDevice source_device =
-        blink::kWebGestureDeviceUninitialized) {
-  return blink::WebGestureEvent(blink::WebInputEvent::kGestureScrollUpdate,
-                                blink::WebInputEvent::kNoModifiers, time_stamp,
-                                source_device);
-}
-
 gfx::PointF ComputePointInRootInPixels(
     const gfx::PointF& point,
     content::RenderWidgetHostViewBase* root_view,
@@ -272,11 +263,11 @@ void RenderWidgetHostInputEventRouter::OnRenderWidgetHostViewBaseDestroyed(
   if (view == touchpad_gesture_target_.target)
     touchpad_gesture_target_.target = nullptr;
 
-  if (view == bubbling_gesture_scroll_target_.target) {
-    bubbling_gesture_scroll_target_.target = nullptr;
-    first_bubbling_scroll_target_.target = nullptr;
-  } else if (view == first_bubbling_scroll_target_.target) {
-    first_bubbling_scroll_target_.target = nullptr;
+  if (view == bubbling_gesture_scroll_target_) {
+    bubbling_gesture_scroll_target_ = nullptr;
+    bubbling_gesture_scroll_origin_ = nullptr;
+  } else if (view == bubbling_gesture_scroll_origin_) {
+    bubbling_gesture_scroll_origin_ = nullptr;
   }
 
   if (view == last_mouse_move_target_) {
@@ -593,17 +584,11 @@ void RenderWidgetHostInputEventRouter::DispatchMouseWheelEvent(
                       blink::WebMouseWheelEvent::kPhaseEnded ||
                   mouse_wheel_event.momentum_phase ==
                       blink::WebMouseWheelEvent::kPhaseEnded) &&
-                 bubbling_gesture_scroll_target_.target) {
+                 bubbling_gesture_scroll_target_) {
         // Send a GSE to the bubbling target and cancel scroll bubbling since
         // the wheel target view is destroyed and the wheel end event won't get
         // processed.
-        blink::WebGestureEvent fake_scroll_update =
-            DummyGestureScrollUpdate(mouse_wheel_event.TimeStamp(),
-                                     bubbling_gesture_scroll_source_device_);
-        SendGestureScrollEnd(bubbling_gesture_scroll_target_.target,
-                             fake_scroll_update);
-        bubbling_gesture_scroll_target_.target = nullptr;
-        first_bubbling_scroll_target_.target = nullptr;
+        CancelScrollBubbling();
       }
     }
   }
@@ -789,13 +774,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchEvent(
   }
 
   if (is_sequence_start) {
-    if (touch_target_.target == bubbling_gesture_scroll_target_.target) {
-      SendGestureScrollEnd(
-          bubbling_gesture_scroll_target_.target,
-          DummyGestureScrollUpdate(touch_event.TimeStamp(),
-                                   bubbling_gesture_scroll_source_device_));
-      CancelScrollBubbling(bubbling_gesture_scroll_target_.target);
-    }
+    CancelScrollBubblingIfConflicting(touch_target_.target);
   }
 
   touch_event_ack_queue_->Add(touch_event.unique_touch_event_id,
@@ -987,6 +966,28 @@ void RenderWidgetHostInputEventRouter::ReportBubblingScrollToSameView(
 
 namespace {
 
+// Returns true if |target_view| is one of |starting_view|'s ancestors.
+// If |stay_within| is provided, we only consider ancestors within that
+// sub-tree.
+bool IsAncestorView(RenderWidgetHostViewChildFrame* starting_view,
+                    const RenderWidgetHostViewBase* target_view,
+                    const RenderWidgetHostViewBase* stay_within = nullptr) {
+  RenderWidgetHostViewBase* cur_view = starting_view->GetParentView();
+  while (cur_view) {
+    if (cur_view == target_view)
+      return true;
+
+    if (stay_within && cur_view == stay_within)
+      return false;
+
+    cur_view = cur_view->IsRenderWidgetHostViewChildFrame()
+                   ? static_cast<RenderWidgetHostViewChildFrame*>(cur_view)
+                         ->GetParentView()
+                   : nullptr;
+  }
+  return false;
+}
+
 // Given |event| in root coordinates, return an event in |target_view|'s
 // coordinates.
 blink::WebGestureEvent GestureEventInTarget(
@@ -1003,8 +1004,8 @@ blink::WebGestureEvent GestureEventInTarget(
 
 void RenderWidgetHostInputEventRouter::BubbleScrollEvent(
     RenderWidgetHostViewBase* target_view,
-    const blink::WebGestureEvent& event,
-    const RenderWidgetHostViewBase* resending_view) {
+    RenderWidgetHostViewChildFrame* resending_view,
+    const blink::WebGestureEvent& event) {
   DCHECK(target_view);
   DCHECK(event.GetType() == blink::WebInputEvent::kGestureScrollBegin ||
          event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
@@ -1018,6 +1019,9 @@ void RenderWidgetHostInputEventRouter::BubbleScrollEvent(
     // If target_view has unrelated gesture events in progress, do
     // not proceed. This could cause confusion between independent
     // scrolls.
+    // TODO(mcnee): If we are unable to bubble this gesture sequence, we
+    // should inform the child view, so that it does not go on to send us
+    // the updates. See https://crbug.com/828422
     if (target_view == touchscreen_gesture_target_.target ||
         target_view == touchpad_gesture_target_.target ||
         target_view == touch_target_.target) {
@@ -1029,18 +1033,18 @@ void RenderWidgetHostInputEventRouter::BubbleScrollEvent(
     // event ack which didn't consume any scroll delta, and so another level
     // of bubbling is needed. This requires a GestureScrollEnd be sent to the
     // last view, which will no longer be the scroll target.
-    if (bubbling_gesture_scroll_target_.target) {
+    if (bubbling_gesture_scroll_target_) {
       SendGestureScrollEnd(
-          bubbling_gesture_scroll_target_.target,
-          GestureEventInTarget(event, bubbling_gesture_scroll_target_.target));
+          bubbling_gesture_scroll_target_,
+          GestureEventInTarget(event, bubbling_gesture_scroll_target_));
     } else {
-      first_bubbling_scroll_target_.target = target_view;
+      bubbling_gesture_scroll_origin_ = resending_view;
     }
 
-    bubbling_gesture_scroll_target_.target = target_view;
+    bubbling_gesture_scroll_target_ = target_view;
     bubbling_gesture_scroll_source_device_ = event.SourceDevice();
   } else {  // !(event.GetType() == blink::WebInputEvent::kGestureScrollBegin)
-    if (!bubbling_gesture_scroll_target_.target) {
+    if (!bubbling_gesture_scroll_target_) {
       // The GestureScrollBegin event is not bubbled, don't bubble the rest of
       // the scroll events.
       return;
@@ -1049,34 +1053,31 @@ void RenderWidgetHostInputEventRouter::BubbleScrollEvent(
     // Don't bubble the GSE events that are generated and sent to intermediate
     // bubbling targets.
     if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd &&
-        target_view != first_bubbling_scroll_target_.target) {
+        resending_view != bubbling_gesture_scroll_origin_) {
       return;
     }
   }
 
   // If the router tries to resend a gesture scroll event back to the same
   // view, we could hang.
-  DCHECK_NE(resending_view, bubbling_gesture_scroll_target_.target);
+  DCHECK_NE(resending_view, bubbling_gesture_scroll_target_);
   // We've seen reports of this, but don't know the cause yet. For now,
   // instead of CHECKing or hanging, we'll report the issue and abort scroll
   // bubbling.
   // TODO(828422): Remove once this issue no longer occurs.
-  if (resending_view == bubbling_gesture_scroll_target_.target) {
+  if (resending_view == bubbling_gesture_scroll_target_) {
     ReportBubblingScrollToSameView(event, resending_view);
-    first_bubbling_scroll_target_.target = nullptr;
-    bubbling_gesture_scroll_target_.target = nullptr;
-    bubbling_gesture_scroll_source_device_ =
-        blink::kWebGestureDeviceUninitialized;
+    CancelScrollBubbling();
     return;
   }
 
-  bubbling_gesture_scroll_target_.target->ProcessGestureEvent(
-      GestureEventInTarget(event, bubbling_gesture_scroll_target_.target),
+  bubbling_gesture_scroll_target_->ProcessGestureEvent(
+      GestureEventInTarget(event, bubbling_gesture_scroll_target_),
       latency_info);
 
   if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
-    first_bubbling_scroll_target_.target = nullptr;
-    bubbling_gesture_scroll_target_.target = nullptr;
+    bubbling_gesture_scroll_origin_ = nullptr;
+    bubbling_gesture_scroll_target_ = nullptr;
     bubbling_gesture_scroll_source_device_ =
         blink::kWebGestureDeviceUninitialized;
   }
@@ -1085,29 +1086,18 @@ void RenderWidgetHostInputEventRouter::BubbleScrollEvent(
 void RenderWidgetHostInputEventRouter::SendGestureScrollBegin(
     RenderWidgetHostViewBase* view,
     const blink::WebGestureEvent& event) {
+  DCHECK_EQ(blink::WebInputEvent::kGesturePinchBegin, event.GetType());
+  DCHECK_EQ(blink::kWebGestureDeviceTouchscreen, event.SourceDevice());
   blink::WebGestureEvent scroll_begin(event);
   scroll_begin.SetType(blink::WebInputEvent::kGestureScrollBegin);
-  switch (event.GetType()) {
-    case blink::WebInputEvent::kGestureScrollUpdate:
-      scroll_begin.data.scroll_begin.delta_x_hint =
-          event.data.scroll_update.delta_x;
-      scroll_begin.data.scroll_begin.delta_y_hint =
-          event.data.scroll_update.delta_y;
-      scroll_begin.data.scroll_begin.delta_hint_units =
-          event.data.scroll_update.delta_units;
-      break;
-    case blink::WebInputEvent::kGesturePinchBegin:
-      scroll_begin.data.scroll_begin.delta_x_hint = 0;
-      scroll_begin.data.scroll_begin.delta_y_hint = 0;
-      scroll_begin.data.scroll_begin.delta_hint_units =
-          blink::WebGestureEvent::kPrecisePixels;
-      break;
-    default:
-      NOTREACHED();
-  }
+  scroll_begin.data.scroll_begin.delta_x_hint = 0;
+  scroll_begin.data.scroll_begin.delta_y_hint = 0;
+  scroll_begin.data.scroll_begin.delta_hint_units =
+      blink::WebGestureEvent::kPrecisePixels;
   view->ProcessGestureEvent(
       scroll_begin,
-      ui::WebInputEventTraits::CreateLatencyInfoForWebGestureEvent(event));
+      ui::WebInputEventTraits::CreateLatencyInfoForWebGestureEvent(
+          scroll_begin));
 }
 
 void RenderWidgetHostInputEventRouter::SendGestureScrollEnd(
@@ -1123,13 +1113,8 @@ void RenderWidgetHostInputEventRouter::SendGestureScrollEnd(
       scroll_end.data.scroll_end.delta_units =
           event.data.scroll_begin.delta_hint_units;
       break;
-    case blink::WebInputEvent::kGestureScrollUpdate:
-      scroll_end.data.scroll_end.inertial_phase =
-          event.data.scroll_update.inertial_phase;
-      scroll_end.data.scroll_end.delta_units =
-          event.data.scroll_update.delta_units;
-      break;
     case blink::WebInputEvent::kGesturePinchEnd:
+      DCHECK_EQ(blink::kWebGestureDeviceTouchscreen, event.SourceDevice());
       scroll_end.data.scroll_end.inertial_phase =
           blink::WebGestureEvent::kUnknownMomentumPhase;
       scroll_end.data.scroll_end.delta_units =
@@ -1140,22 +1125,82 @@ void RenderWidgetHostInputEventRouter::SendGestureScrollEnd(
   }
   view->ProcessGestureEvent(
       scroll_end,
-      ui::WebInputEventTraits::CreateLatencyInfoForWebGestureEvent(event));
+      ui::WebInputEventTraits::CreateLatencyInfoForWebGestureEvent(scroll_end));
 }
 
-void RenderWidgetHostInputEventRouter::CancelScrollBubbling(
-    RenderWidgetHostViewBase* target_view) {
-  DCHECK(target_view);
-  if (target_view == first_bubbling_scroll_target_.target) {
-    first_bubbling_scroll_target_.target = nullptr;
-    bubbling_gesture_scroll_target_.target = nullptr;
-    bubbling_gesture_scroll_source_device_ =
-        blink::kWebGestureDeviceUninitialized;
+void RenderWidgetHostInputEventRouter::SendGestureScrollEnd(
+    RenderWidgetHostViewBase* view,
+    blink::WebGestureDevice source_device) {
+  blink::WebGestureEvent scroll_end(blink::WebInputEvent::kGestureScrollEnd,
+                                    blink::WebInputEvent::kNoModifiers,
+                                    base::TimeTicks::Now(), source_device);
+  scroll_end.data.scroll_end.inertial_phase =
+      blink::WebGestureEvent::kUnknownMomentumPhase;
+  scroll_end.data.scroll_end.delta_units =
+      blink::WebGestureEvent::kPrecisePixels;
+  view->ProcessGestureEvent(
+      scroll_end,
+      ui::WebInputEventTraits::CreateLatencyInfoForWebGestureEvent(scroll_end));
+}
+
+void RenderWidgetHostInputEventRouter::WillDetachChildView(
+    const RenderWidgetHostViewChildFrame* detaching_view) {
+  // If necessary, cancel ongoing scroll bubbling in response to a frame
+  // connector change.
+  if (!bubbling_gesture_scroll_target_ || !bubbling_gesture_scroll_origin_)
+    return;
+
+  // We cancel bubbling only when the child view affects the current scroll
+  // bubbling sequence.
+  if (detaching_view == bubbling_gesture_scroll_origin_ ||
+      IsAncestorView(bubbling_gesture_scroll_origin_, detaching_view)) {
+    CancelScrollBubbling();
+  }
+}
+
+void RenderWidgetHostInputEventRouter::CancelScrollBubbling() {
+  DCHECK(bubbling_gesture_scroll_target_);
+  SendGestureScrollEnd(bubbling_gesture_scroll_target_,
+                       bubbling_gesture_scroll_source_device_);
+  // TODO(mcnee): We should also inform |bubbling_gesture_scroll_origin_| that
+  // we are no longer bubbling its events, otherwise it could continue to send
+  // them and interfere with a new scroll gesture being bubbled.
+  // See https://crbug.com/828422
+  bubbling_gesture_scroll_origin_ = nullptr;
+  bubbling_gesture_scroll_target_ = nullptr;
+  bubbling_gesture_scroll_source_device_ =
+      blink::kWebGestureDeviceUninitialized;
+}
+
+void RenderWidgetHostInputEventRouter::CancelScrollBubblingIfConflicting(
+    const RenderWidgetHostViewBase* target) {
+  if (!target)
+    return;
+  if (!bubbling_gesture_scroll_target_ || !bubbling_gesture_scroll_origin_)
+    return;
+
+  const RenderWidgetHostViewBase* first_bubbling_scroll_target =
+      bubbling_gesture_scroll_origin_->GetParentView();
+  // TODO(mcnee): This seems wrong. We should not be sending an independent
+  // gesture sequence to any of |bubbling_gesture_scroll_origin_|'s ancestors
+  // up to and including |bubbling_gesture_scroll_target_|.
+  // See https://crbug.com/828422
+  if (target == bubbling_gesture_scroll_target_) {
+    // TODO(mcnee): We shouldn't send the scroll end if we're not actually
+    // cancelling.
+    SendGestureScrollEnd(bubbling_gesture_scroll_target_,
+                         bubbling_gesture_scroll_source_device_);
+    if (bubbling_gesture_scroll_target_ == first_bubbling_scroll_target) {
+      bubbling_gesture_scroll_origin_ = nullptr;
+      bubbling_gesture_scroll_target_ = nullptr;
+      bubbling_gesture_scroll_source_device_ =
+          blink::kWebGestureDeviceUninitialized;
+    }
   }
 }
 
 void RenderWidgetHostInputEventRouter::StopFling() {
-  if (!bubbling_gesture_scroll_target_.target)
+  if (!bubbling_gesture_scroll_target_)
     return;
 
   if (!last_fling_start_target_ || !last_fling_start_target_->host())
@@ -1390,15 +1435,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchscreenGestureEvent(
         IsViewInMap(touchscreen_gesture_target_.target);
 
     // Abort any scroll bubbling in progress to avoid double entry.
-    if (touchscreen_gesture_target_.target &&
-        touchscreen_gesture_target_.target ==
-            bubbling_gesture_scroll_target_.target) {
-      SendGestureScrollEnd(
-          bubbling_gesture_scroll_target_.target,
-          DummyGestureScrollUpdate(gesture_event.TimeStamp(),
-                                   bubbling_gesture_scroll_source_device_));
-      CancelScrollBubbling(bubbling_gesture_scroll_target_.target);
-    }
+    CancelScrollBubblingIfConflicting(touchscreen_gesture_target_.target);
   }
 
   // If we set a target and it's not in the map, we won't get notified if the
@@ -1522,15 +1559,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchpadGestureEvent(
         target_location.value() - touchpad_gesture_event.PositionInWidget();
 
     // Abort any scroll bubbling in progress to avoid double entry.
-    if (touchpad_gesture_target_.target &&
-        touchpad_gesture_target_.target ==
-            bubbling_gesture_scroll_target_.target) {
-      SendGestureScrollEnd(
-          bubbling_gesture_scroll_target_.target,
-          DummyGestureScrollUpdate(touchpad_gesture_event.TimeStamp(),
-                                   bubbling_gesture_scroll_source_device_));
-      CancelScrollBubbling(bubbling_gesture_scroll_target_.target);
-    }
+    CancelScrollBubblingIfConflicting(touchpad_gesture_target_.target);
   }
 
   if (!touchpad_gesture_target_.target) {

content/browser/renderer_host/render_widget_host_input_event_router.h

@@ -55,6 +55,7 @@ namespace content {
 class RenderWidgetHostImpl;
 class RenderWidgetHostView;
 class RenderWidgetHostViewBase;
+class RenderWidgetHostViewChildFrame;
 class RenderWidgetTargeter;
 class TouchEmulator;
 class TouchEventAckQueue;
@@ -100,9 +101,10 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
 
   // |event| is in root coordinates.
   void BubbleScrollEvent(RenderWidgetHostViewBase* target_view,
-                         const blink::WebGestureEvent& event,
-                         const RenderWidgetHostViewBase* resending_view);
-  void CancelScrollBubbling(RenderWidgetHostViewBase* target_view);
+                         RenderWidgetHostViewChildFrame* resending_view,
+                         const blink::WebGestureEvent& event);
+  void WillDetachChildView(
+      const RenderWidgetHostViewChildFrame* detaching_view);
 
   void AddFrameSinkIdOwner(const viz::FrameSinkId& id,
                            RenderWidgetHostViewBase* owner);
@@ -224,13 +226,24 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
                                    RenderWidgetHostViewBase* target,
                                    RenderWidgetHostViewBase* root_view);
 
-  // The following methods take a GestureScrollUpdate event and send a
-  // GestureScrollBegin or GestureScrollEnd for wrapping it. This is needed
-  // when GestureScrollUpdates are being forwarded for scroll bubbling.
+  void CancelScrollBubbling();
+
+  // Cancels scroll bubbling if it is unsafe to send a gesture event sequence
+  // to |target| considering the views involved in an ongoing scroll.
+  void CancelScrollBubblingIfConflicting(
+      const RenderWidgetHostViewBase* target);
+
+  // Wraps a touchscreen GesturePinchBegin in a GestureScrollBegin.
   void SendGestureScrollBegin(RenderWidgetHostViewBase* view,
                               const blink::WebGestureEvent& event);
+  // Used to end a scroll sequence during scroll bubbling or as part of a
+  // wrapped pinch gesture.
   void SendGestureScrollEnd(RenderWidgetHostViewBase* view,
                             const blink::WebGestureEvent& event);
+  // Used when scroll bubbling is canceled to indicate to |view| that it should
+  // consider the scroll sequence to have ended.
+  void SendGestureScrollEnd(RenderWidgetHostViewBase* view,
+                            blink::WebGestureDevice source_device);
 
   // Helper functions to implement RenderWidgetTargeter::Delegate functions.
   RenderWidgetTargetResult FindMouseEventTarget(
@@ -315,8 +328,8 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
   // https://crbug.com/824774.
   bool touchscreen_gesture_target_in_map_;
   TargetData touchpad_gesture_target_;
-  TargetData bubbling_gesture_scroll_target_;
-  TargetData first_bubbling_scroll_target_;
+  RenderWidgetHostViewBase* bubbling_gesture_scroll_target_ = nullptr;
+  RenderWidgetHostViewChildFrame* bubbling_gesture_scroll_origin_ = nullptr;
   // Used to target wheel events for the duration of a scroll.
   TargetData wheel_target_;
   // Maintains the same target between mouse down and mouse up.

content/browser/renderer_host/render_widget_host_view_child_frame.cc

@@ -539,28 +539,25 @@ void RenderWidgetHostViewChildFrame::GestureEventAck(
   if (event.IsTouchpadZoomEvent())
     ProcessTouchpadZoomEventAckInRoot(event, ack_result);
 
-  const bool should_bubble =
-      ack_result == INPUT_EVENT_ACK_STATE_NOT_CONSUMED ||
-      ack_result == INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS ||
-      ack_result == INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE;
-
-  if ((event.GetType() == blink::WebInputEvent::kGestureScrollBegin) &&
-      should_bubble) {
+  // GestureScrollBegin is a blocking event; It is forwarded for bubbling if
+  // its ack is not consumed. For the rest of the scroll events
+  // (GestureScrollUpdate, GestureScrollEnd) are bubbled if the
+  // GestureScrollBegin was bubbled.
+  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
     DCHECK(!is_scroll_sequence_bubbling_);
-    is_scroll_sequence_bubbling_ = true;
-  } else if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
-    is_scroll_sequence_bubbling_ = false;
+    is_scroll_sequence_bubbling_ =
+        ack_result == INPUT_EVENT_ACK_STATE_NOT_CONSUMED ||
+        ack_result == INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS ||
+        ack_result == INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE;
   }
 
-  // GestureScrollBegin is a blocking event; It is forwarded for bubbling if
-  // its ack is not consumed. For the rest of the scroll events
-  // (GestureScrollUpdate, GestureScrollEnd) the frame_connector_ decides to
-  // forward them for bubbling if the GestureScrollBegin event is forwarded.
-  if ((event.GetType() == blink::WebInputEvent::kGestureScrollBegin &&
-       should_bubble) ||
-      event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
-      event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
+  if (is_scroll_sequence_bubbling_ &&
+      (event.GetType() == blink::WebInputEvent::kGestureScrollBegin ||
+       event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
+       event.GetType() == blink::WebInputEvent::kGestureScrollEnd)) {
     frame_connector_->BubbleScrollEvent(event);
+    if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd)
+      is_scroll_sequence_bubbling_ = false;
   }
 }