Reland "Refactor OOPIF scroll bubbling state and cancellation"

This is a reland of b9e5ed2a

Original change's description:
> Refactor OOPIF scroll bubbling state and cancellation
>
> Whether or not a child is bubbling scroll was being tracked in both
> CrossProcessFrameConnector and RenderWidgetHostViewChildFrame. It's
> simpler to just have it in RWHVCF.
>
> There are several cases where we generate fake scroll updates when
> cancelling scroll bubbling. This is a relic from the non-scroll latching
> code paths and has been removed. We also deduplicate the scroll bubbling
> cancellation code.
>
> We were tracking the view from which scroll events are bubbled by keeping
> a reference to that view's parent. We now just keep a reference to the
> originating view directly.
>
> We also now properly cancel scroll bubbling when a child detaches.
>
> Bug: 828422, 897216
> Change-Id: Iee983bd9ea05b324d556c66320a1bc5e544de057
> Reviewed-on: https://chromium-review.googlesource.com/c/1357563
> Reviewed-by: Ken Buchanan <kenrb@chromium.org>
> Commit-Queue: Kevin McNee <mcnee@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#615184}

Tbr: kenrb@chromium.org
Bug: 828422, 897216
Change-Id: If529545300f6bbb7a7056cdbebbd8317cb274f7a
Reviewed-on: https://chromium-review.googlesource.com/c/1371010Reviewed-by: Kevin McNee <mcnee@chromium.org>
Commit-Queue: Kevin McNee <mcnee@chromium.org>
Cr-Commit-Position: refs/heads/master@{#615557}

content/browser/frame_host/cross_process_frame_connector.cc

@@ -68,8 +68,7 @@ RenderFrameHostImpl* RootRenderFrameHost(RenderFrameHostImpl* frame) {
 CrossProcessFrameConnector::CrossProcessFrameConnector(
     RenderFrameProxyHost* frame_proxy_in_parent_renderer)
     : FrameConnectorDelegate(IsUseZoomForDSFEnabled()),
-      frame_proxy_in_parent_renderer_(frame_proxy_in_parent_renderer),
-      is_scroll_bubbling_(false) {
+      frame_proxy_in_parent_renderer_(frame_proxy_in_parent_renderer) {
   frame_proxy_in_parent_renderer->frame_tree_node()
       ->render_manager()
       ->current_frame_host()
@@ -119,14 +118,13 @@ void CrossProcessFrameConnector::SetView(RenderWidgetHostViewChildFrame* view) {
     // The RenderWidgetHostDelegate needs to be checked because SetView() can
     // be called during nested WebContents destruction. See
     // https://crbug.com/644306.
-    if (is_scroll_bubbling_ && GetParentRenderWidgetHostView() &&
+    if (GetParentRenderWidgetHostView() &&
         GetParentRenderWidgetHostView()->host()->delegate()) {
       GetParentRenderWidgetHostView()
           ->host()
           ->delegate()
           ->GetInputEventRouter()
-          ->CancelScrollBubbling(view_);
-      is_scroll_bubbling_ = false;
+          ->WillDetachChildView(view_);
     }
     view_->SetFrameConnectorDelegate(nullptr);
   }
@@ -298,14 +296,7 @@ void CrossProcessFrameConnector::BubbleScrollEvent(
   // action of the parent frame to Auto so that this gesture event is allowed.
   parent_view->host()->input_router()->ForceSetTouchActionAuto();
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
-    event_router->BubbleScrollEvent(parent_view, resent_gesture_event, view_);
-    is_scroll_bubbling_ = true;
-  } else if (is_scroll_bubbling_) {
-    event_router->BubbleScrollEvent(parent_view, resent_gesture_event, view_);
-  }
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd)
-    is_scroll_bubbling_ = false;
+  event_router->BubbleScrollEvent(parent_view, view_, resent_gesture_event);
 }
 
 bool CrossProcessFrameConnector::HasFocus() {

content/browser/frame_host/cross_process_frame_connector.h

@@ -202,8 +202,6 @@ class CONTENT_EXPORT CrossProcessFrameConnector
   // which is set through CSS.
   bool is_hidden_ = false;
 
-  bool is_scroll_bubbling_;
-
   // Used to make sure we only log UMA once per renderer crash.
   bool is_crash_already_logged_ = false;
 

content/browser/renderer_host/render_widget_host_input_event_router.h

@@ -55,6 +55,7 @@ namespace content {
 class RenderWidgetHostImpl;
 class RenderWidgetHostView;
 class RenderWidgetHostViewBase;
+class RenderWidgetHostViewChildFrame;
 class RenderWidgetTargeter;
 class TouchEmulator;
 class TouchEventAckQueue;
@@ -100,9 +101,10 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
 
   // |event| is in root coordinates.
   void BubbleScrollEvent(RenderWidgetHostViewBase* target_view,
-                         const blink::WebGestureEvent& event,
-                         const RenderWidgetHostViewBase* resending_view);
-  void CancelScrollBubbling(RenderWidgetHostViewBase* target_view);
+                         RenderWidgetHostViewChildFrame* resending_view,
+                         const blink::WebGestureEvent& event);
+  void WillDetachChildView(
+      const RenderWidgetHostViewChildFrame* detaching_view);
 
   void AddFrameSinkIdOwner(const viz::FrameSinkId& id,
                            RenderWidgetHostViewBase* owner);
@@ -224,13 +226,24 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
                                    RenderWidgetHostViewBase* target,
                                    RenderWidgetHostViewBase* root_view);
 
-  // The following methods take a GestureScrollUpdate event and send a
-  // GestureScrollBegin or GestureScrollEnd for wrapping it. This is needed
-  // when GestureScrollUpdates are being forwarded for scroll bubbling.
+  void CancelScrollBubbling();
+
+  // Cancels scroll bubbling if it is unsafe to send a gesture event sequence
+  // to |target| considering the views involved in an ongoing scroll.
+  void CancelScrollBubblingIfConflicting(
+      const RenderWidgetHostViewBase* target);
+
+  // Wraps a touchscreen GesturePinchBegin in a GestureScrollBegin.
   void SendGestureScrollBegin(RenderWidgetHostViewBase* view,
                               const blink::WebGestureEvent& event);
+  // Used to end a scroll sequence during scroll bubbling or as part of a
+  // wrapped pinch gesture.
   void SendGestureScrollEnd(RenderWidgetHostViewBase* view,
                             const blink::WebGestureEvent& event);
+  // Used when scroll bubbling is canceled to indicate to |view| that it should
+  // consider the scroll sequence to have ended.
+  void SendGestureScrollEnd(RenderWidgetHostViewBase* view,
+                            blink::WebGestureDevice source_device);
 
   // Helper functions to implement RenderWidgetTargeter::Delegate functions.
   RenderWidgetTargetResult FindMouseEventTarget(
@@ -315,8 +328,8 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
   // https://crbug.com/824774.
   bool touchscreen_gesture_target_in_map_;
   TargetData touchpad_gesture_target_;
-  TargetData bubbling_gesture_scroll_target_;
-  TargetData first_bubbling_scroll_target_;
+  RenderWidgetHostViewBase* bubbling_gesture_scroll_target_ = nullptr;
+  RenderWidgetHostViewChildFrame* bubbling_gesture_scroll_origin_ = nullptr;
   // Used to target wheel events for the duration of a scroll.
   TargetData wheel_target_;
   // Maintains the same target between mouse down and mouse up.

content/browser/renderer_host/render_widget_host_view_child_frame.cc

@@ -539,28 +539,25 @@ void RenderWidgetHostViewChildFrame::GestureEventAck(
   if (event.IsTouchpadZoomEvent())
     ProcessTouchpadZoomEventAckInRoot(event, ack_result);
 
-  const bool should_bubble =
+  // GestureScrollBegin is a blocking event; It is forwarded for bubbling if
+  // its ack is not consumed. For the rest of the scroll events
+  // (GestureScrollUpdate, GestureScrollEnd) are bubbled if the
+  // GestureScrollBegin was bubbled.
+  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
+    DCHECK(!is_scroll_sequence_bubbling_);
+    is_scroll_sequence_bubbling_ =
         ack_result == INPUT_EVENT_ACK_STATE_NOT_CONSUMED ||
         ack_result == INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS ||
         ack_result == INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE;
-
-  if ((event.GetType() == blink::WebInputEvent::kGestureScrollBegin) &&
-      should_bubble) {
-    DCHECK(!is_scroll_sequence_bubbling_);
-    is_scroll_sequence_bubbling_ = true;
-  } else if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
-    is_scroll_sequence_bubbling_ = false;
   }
 
-  // GestureScrollBegin is a blocking event; It is forwarded for bubbling if
-  // its ack is not consumed. For the rest of the scroll events
-  // (GestureScrollUpdate, GestureScrollEnd) the frame_connector_ decides to
-  // forward them for bubbling if the GestureScrollBegin event is forwarded.
-  if ((event.GetType() == blink::WebInputEvent::kGestureScrollBegin &&
-       should_bubble) ||
+  if (is_scroll_sequence_bubbling_ &&
+      (event.GetType() == blink::WebInputEvent::kGestureScrollBegin ||
        event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
-      event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
+       event.GetType() == blink::WebInputEvent::kGestureScrollEnd)) {
     frame_connector_->BubbleScrollEvent(event);
+    if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd)
+      is_scroll_sequence_bubbling_ = false;
   }
 }