1 files changed, 37 insertions, 30 deletions

diff --git a/chromium/content/browser/webui/web_ui_impl.cc b/chromium/content/browser/webui/web_ui_impl.cc
index 432b1dd9679..8bf0b601706 100644
--- a/chromium/content/browser/webui/web_ui_impl.cc
+++ b/chromium/content/browser/webui/web_ui_impl.cc
@@ -34,6 +34,7 @@
 #include "content/public/browser/web_ui_message_handler.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/content_client.h"
+#include "services/service_manager/public/cpp/interface_provider.h"
 
 namespace content {
 
@@ -81,9 +82,10 @@ base::string16 WebUI::GetJavascriptCall(
   return result;
 }
 
-WebUIImpl::WebUIImpl(WebContentsImpl* contents)
+WebUIImpl::WebUIImpl(WebContentsImpl* contents, RenderFrameHost* frame_host)
     : bindings_(BINDINGS_POLICY_WEB_UI),
       requestable_schemes_({kChromeUIScheme, url::kFileScheme}),
+      frame_host_(frame_host),
       web_contents_(contents),
       web_contents_observer_(new MainFrameNavigationObserver(this, contents)) {
   DCHECK(contents);
@@ -93,35 +95,23 @@ WebUIImpl::~WebUIImpl() {
   // Delete the controller first, since it may also be keeping a pointer to some
   // of the handlers and can call them at destruction.
   controller_.reset();
+  remote_.reset();
+  receiver_.reset();
 }
 
-// WebUIImpl, public: ----------------------------------------------------------
-
-bool WebUIImpl::OnMessageReceived(const IPC::Message& message,
-                                  RenderFrameHost* sender) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(WebUIImpl, message, sender)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_WebUISend, OnWebUISend)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
+void WebUIImpl::SetProperty(const std::string& name, const std::string& value) {
+  DCHECK(remote_);
+  remote_->SetProperty(name, value);
 }
 
-void WebUIImpl::OnWebUISend(RenderFrameHost* sender,
-                            const std::string& message,
-                            const base::ListValue& args) {
-  // Ignore IPCs from frames that are pending deletion.  See also
-  // https://crbug.com/780920.
-  if (!sender->IsCurrent())
-    return;
-
-  const GURL& source_url = sender->GetLastCommittedURL();
+void WebUIImpl::Send(const std::string& message, base::Value args) {
+  const GURL& source_url = frame_host_->GetLastCommittedURL();
   if (!ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
-          sender->GetProcess()->GetID()) ||
+          frame_host_->GetProcess()->GetID()) ||
       !WebUIControllerFactoryRegistry::GetInstance()->IsURLAcceptableForWebUI(
           web_contents_->GetBrowserContext(), source_url)) {
     bad_message::ReceivedBadMessage(
-        sender->GetProcess(),
+        frame_host_->GetProcess(),
         bad_message::WEBUI_SEND_FROM_UNAUTHORIZED_PROCESS);
     return;
   }
@@ -133,7 +123,7 @@ void WebUIImpl::OnWebUISend(RenderFrameHost* sender,
     return;
   }
 
-  ProcessWebUIMessage(source_url, message, args);
+  ProcessWebUIMessage(source_url, message, base::Value::AsListValue(args));
 }
 
 void WebUIImpl::RenderFrameCreated(RenderFrameHost* render_frame_host) {
@@ -151,6 +141,26 @@ void WebUIImpl::RenderFrameHostUnloading() {
   DisallowJavascriptOnAllHandlers();
 }
 
+void WebUIImpl::SetupMojoConnection() {
+  // TODO(nasko): WebUI mojo might be useful to be registered for
+  // subframes as well, though at this time there is no such usage.
+  if (frame_host_->GetParent())
+    return;
+
+  static_cast<RenderFrameHostImpl*>(frame_host_)
+      ->GetFrameBindingsControl()
+      ->BindWebUI(remote_.BindNewPipeAndPassReceiver(),
+                  receiver_.BindNewPipeAndPassRemote());
+}
+
+void WebUIImpl::InvalidateMojoConnection() {
+  if (frame_host_->GetParent())
+    return;
+
+  remote_.reset();
+  receiver_.reset();
+}
+
 WebContents* WebUIImpl::GetWebContents() {
   return web_contents_;
 }
@@ -193,13 +203,11 @@ void WebUIImpl::SetController(std::unique_ptr<WebUIController> controller) {
 }
 
 bool WebUIImpl::CanCallJavascript() {
-  RenderFrameHost* frame_host = web_contents_->GetMainFrame();
-  return frame_host &&
-         (ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
-              frame_host->GetProcess()->GetID()) ||
+  return (ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+              frame_host_->GetProcess()->GetID()) ||
           // It's possible to load about:blank in a Web UI renderer.
           // See http://crbug.com/42547
-          frame_host->GetLastCommittedURL().spec() == url::kAboutBlankURL);
+          frame_host_->GetLastCommittedURL().spec() == url::kAboutBlankURL);
 }
 
 void WebUIImpl::CallJavascriptFunctionUnsafe(const std::string& function_name) {
@@ -301,8 +309,7 @@ void WebUIImpl::ExecuteJavascript(const base::string16& javascript) {
   if (!CanCallJavascript())
     return;
 
-  web_contents_->GetMainFrame()->ExecuteJavaScript(javascript,
-                                                   base::NullCallback());
+  frame_host_->ExecuteJavaScript(javascript, base::NullCallback());
 }
 
 void WebUIImpl::DisallowJavascriptOnAllHandlers() {