Partial clone of the following CL: http://codereview.chromium.org/3013045/show

Differences from the above CL include the following:
 - RendererPreferences settings for ExtensionHosts are now extracted from the associated_tab_contents().  This ensures that extension hosts will also forward top level navigation requests.
 - Instead of explicitly setting the delegate on the TabContents in ExtensionHost::ShowCreatedWindow, instead I instruct the associated tab-contents to add the newly build tab-contents.  Note that this is the exact same behaviour performed by TabContents when initiating a top-level navigation to the host browser.  

Points of interest:
 - See the TODO in navigation_controller.cc.  This problem of an unrecognized navigation entry needs further investigation.
 - Also, I found that if the ActiveX control is navigated to a chrome-extension URL, then the top-level-navigation will fail because of the format of the URL.  The fix was to construct a temporary url in place of the chrome-extension url.

BUG=51091
TEST=None 

Review URL: http://codereview.chromium.org/3357013

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@59142 0039d316-1c4b-4281-b951-d872f2087c98

10 files changed, 90 insertions, 21 deletions

diff --git a/chrome/browser/extensions/extension_dom_ui.h b/chrome/browser/extensions/extension_dom_ui.h
index faa7836..a6c598f 100644
--- a/chrome/browser/extensions/extension_dom_ui.h
+++ b/chrome/browser/extensions/extension_dom_ui.h
@@ -48,7 +48,9 @@ class ExtensionDOMUI
   virtual Browser* GetBrowser() const;
   virtual gfx::NativeView GetNativeViewOfHost();
   virtual gfx::NativeWindow GetCustomFrameNativeWindow();
-  virtual TabContents* associated_tab_contents() { return tab_contents(); }
+  virtual TabContents* associated_tab_contents() const {
+    return tab_contents();
+  }
   virtual Profile* GetProfile();
 
   virtual ExtensionBookmarkManagerEventRouter*
diff --git a/chrome/browser/extensions/extension_function_dispatcher.h b/chrome/browser/extensions/extension_function_dispatcher.h
index 2e8251f..99328f7 100644
--- a/chrome/browser/extensions/extension_function_dispatcher.h
+++ b/chrome/browser/extensions/extension_function_dispatcher.h
@@ -51,7 +51,7 @@ class ExtensionFunctionDispatcher {
     // context. For example, the TabContents in which an infobar or
     // chrome-extension://<id> URL are being shown. Callers must check for a
     // NULL return value (as in the case of a background page).
-    virtual TabContents* associated_tab_contents() = 0;
+    virtual TabContents* associated_tab_contents() const = 0;
 
    protected:
     virtual ~Delegate() {}
diff --git a/chrome/browser/extensions/extension_host.cc b/chrome/browser/extensions/extension_host.cc
index 13619ff..334c28e 100644
--- a/chrome/browser/extensions/extension_host.cc
+++ b/chrome/browser/extensions/extension_host.cc
@@ -457,6 +457,13 @@ void ExtensionHost::Close(RenderViewHost* render_view_host) {
 
 RendererPreferences ExtensionHost::GetRendererPrefs(Profile* profile) const {
   RendererPreferences preferences;
+
+  TabContents* associated_contents = associated_tab_contents();
+  if (associated_contents)
+    preferences =
+        static_cast<RenderViewHostDelegate*>(associated_contents)->
+            GetRendererPrefs(profile);
+
   renderer_preferences_util::UpdateFromSystemSettings(&preferences, profile);
   return preferences;
 }
@@ -501,7 +508,7 @@ void ExtensionHost::CreateNewWindow(
     const string16& frame_name) {
   // TODO(aa): Use the browser's profile if the extension is split mode
   // incognito.
-  delegate_view_helper_.CreateNewWindow(
+  TabContents* new_contents = delegate_view_helper_.CreateNewWindow(
       route_id,
       render_view_host()->process()->profile(),
       site_instance(),
@@ -510,6 +517,10 @@ void ExtensionHost::CreateNewWindow(
       this,
       window_container_type,
       frame_name);
+
+  TabContents* associated_contents = associated_tab_contents();
+  if (associated_contents && associated_contents->delegate())
+    associated_contents->delegate()->TabContentsCreated(new_contents);
 }
 
 void ExtensionHost::CreateNewWidget(int route_id,
@@ -542,11 +553,26 @@ void ExtensionHost::ShowCreatedWindow(int route_id,
       Browser::TYPE_NORMAL,
       false);  // Match incognito exactly.
   if (!browser) {
-    browser = Browser::Create(contents->profile());
-    browser->window()->Show();
+    // If no browser is associated with the created TabContents, then the
+    // created TabContents may be an intermediate structure used during topmost
+    // url navigation from within an experimental extension popup view.
+    //
+    // If the ExtensionHost has an associated TabContents, then register the
+    // new contents with this contents.  This will allow top-level link
+    // navigation within the new contents to function just as navigation
+    // within the current host.
+    TabContents* associated_contents = associated_tab_contents();
+    if (associated_contents) {
+      associated_contents->AddNewContents(contents, disposition, initial_pos,
+                                          user_gesture);
+    } else {
+      browser = Browser::Create(contents->profile());
+      browser->window()->Show();
+    }
   }
 
-  browser->AddTabContents(contents, disposition, initial_pos, user_gesture);
+  if (browser)
+    browser->AddTabContents(contents, disposition, initial_pos, user_gesture);
 }
 
 void ExtensionHost::ShowCreatedWidget(int route_id,
diff --git a/chrome/browser/extensions/extension_host.h b/chrome/browser/extensions/extension_host.h
index 80dbf14..d5746cc 100644
--- a/chrome/browser/extensions/extension_host.h
+++ b/chrome/browser/extensions/extension_host.h
@@ -86,7 +86,7 @@ class ExtensionHost : public RenderViewHostDelegate,
   ViewType::Type extension_host_type() const { return extension_host_type_; }
 
   // ExtensionFunctionDispatcher::Delegate
-  virtual TabContents* associated_tab_contents() {
+  virtual TabContents* associated_tab_contents() const {
     return associated_tab_contents_;
   }
   void set_associated_tab_contents(TabContents* associated_tab_contents) {
@@ -111,8 +111,7 @@ class ExtensionHost : public RenderViewHostDelegate,
   // |size_limit| in both width and height.
   void DisableScrollbarsForSmallWindows(const gfx::Size& size_limit);
 
-  // RenderViewHostDelegate implementation.
-  virtual RenderViewHostDelegate::View* GetViewDelegate();
+  // RenderViewHostDelegate::View implementation.
   virtual const GURL& GetURL() const { return url_; }
   virtual void RenderViewCreated(RenderViewHost* render_view_host);
   virtual ViewType::Type GetRenderViewType() const;
@@ -126,6 +125,8 @@ class ExtensionHost : public RenderViewHostDelegate,
   virtual void DocumentOnLoadCompletedInMainFrame(
       RenderViewHost* render_view_host);
 
+  // RenderViewHostDelegate implementation.
+  virtual RenderViewHostDelegate::View* GetViewDelegate();
   virtual WebPreferences GetWebkitPrefs();
   virtual void ProcessDOMUIMessage(const ViewHostMsg_DomMessage_Params& params);
   virtual void RunJavaScriptMessage(const std::wstring& message,
diff --git a/chrome/browser/extensions/extension_popup_api.cc b/chrome/browser/extensions/extension_popup_api.cc
index 3e4f22a..4b3bbd9 100644
--- a/chrome/browser/extensions/extension_popup_api.cc
+++ b/chrome/browser/extensions/extension_popup_api.cc
@@ -165,6 +165,15 @@ class ExtensionPopupHost : public ExtensionPopup::Observer,
         GetRoutingFromDispatcher(dispatcher_);
     if (router)
       router->RegisterRenderViewHost(host->render_view_host());
+
+    // Extension hosts created for popup contents exist in the same tab
+    // contents as the ExtensionFunctionDispatcher that requested the popup.
+    // For example, '_blank' link navigation should be routed through the tab
+    // contents that requested the popup.
+    if (dispatcher_ && dispatcher_->delegate()) {
+      host->set_associated_tab_contents(
+          dispatcher_->delegate()->associated_tab_contents());
+    }
   }
 
   virtual void ExtensionPopupResized(ExtensionPopup* popup) {
diff --git a/chrome/browser/notifications/balloon_host.h b/chrome/browser/notifications/balloon_host.h
index 4211636..8a286c3 100644
--- a/chrome/browser/notifications/balloon_host.h
+++ b/chrome/browser/notifications/balloon_host.h
@@ -42,7 +42,7 @@ class BalloonHost : public RenderViewHostDelegate,
     // TODO(aa): Should this return the native view of the BalloonView*?
     return NULL;
   }
-  virtual TabContents* associated_tab_contents() { return NULL; }
+  virtual TabContents* associated_tab_contents() const { return NULL; }
 
   RenderViewHost* render_view_host() const { return render_view_host_; }
 
diff --git a/chrome/browser/tab_contents/navigation_controller.cc b/chrome/browser/tab_contents/navigation_controller.cc
index a416bc9..fb0f515 100644
--- a/chrome/browser/tab_contents/navigation_controller.cc
+++ b/chrome/browser/tab_contents/navigation_controller.cc
@@ -632,6 +632,12 @@ NavigationType::Type NavigationController::ClassifyNavigation(
       tab_contents_->GetSiteInstance(),
       params.page_id);
   if (existing_entry_index == -1) {
+    // TODO(twiz)  Top-level, out-of-browser navigations from ActiveX instances
+    // of Chrome Frame can trigger this behaviour:  The page_id is less than
+    // GetMaxPageID, yet no entry index is registered.  See BUG 55138.
+    if (PageTransition::IsMainFrame(params.transition))
+      return NavigationType::NEW_PAGE;
+
     // The page was not found. It could have been pruned because of the limit on
     // back/forward entries (not likely since we'll usually tell it to navigate
     // to such entries). It could also mean that the renderer is smoking crack.
diff --git a/chrome_frame/chrome_active_document.cc b/chrome_frame/chrome_active_document.cc
index 7cb1661..6d350f8 100644
--- a/chrome_frame/chrome_active_document.cc
+++ b/chrome_frame/chrome_active_document.cc
@@ -46,9 +46,6 @@
 DEFINE_GUID(CGID_DocHostCmdPriv, 0x000214D4L, 0, 0, 0xC0, 0, 0, 0, 0, 0, 0,
             0x46);
 
-static const wchar_t kHandleTopLevelRequests[] = L"HandleTopLevelRequests";
-static const wchar_t kUseChromeNetworking[] = L"UseChromeNetworking";
-
 base::ThreadLocalPointer<ChromeActiveDocument> g_active_doc_cache;
 
 bool g_first_launch_by_process_ = true;
@@ -96,12 +93,7 @@ HRESULT ChromeActiveDocument::FinalConstruct() {
       return hr;
   }
 
-  // Query and assign the top-level-request routing, and host networking
-  // settings from the registry.
-  bool top_level_requests = GetConfigBool(true, kHandleTopLevelRequests);
-  bool chrome_network = GetConfigBool(false, kUseChromeNetworking);
-  automation_client_->set_handle_top_level_requests(top_level_requests);
-  automation_client_->set_use_chrome_network(chrome_network);
+  InitializeAutomationSettings();
 
   find_dialog_.Init(automation_client_.get());
 
diff --git a/chrome_frame/chrome_frame_activex.cc b/chrome_frame/chrome_frame_activex.cc
index 0401298..e2d9b3a 100644
--- a/chrome_frame/chrome_frame_activex.cc
+++ b/chrome_frame/chrome_frame_activex.cc
@@ -459,6 +459,12 @@ HRESULT ChromeFrameActivex::IOleObject_SetClientSite(
       WideToUTF8(url_, url_.Length(), &utf8_url);
     }
 
+    // Only privileged instances of ActiveX Chrome Frame controls may read
+    // the chrome-network, and top-level-navigation settings from the registry.
+    // See issue: 54920
+    if (is_privileged_)
+      InitializeAutomationSettings();
+
     url_fetcher_->set_frame_busting(!is_privileged_);
     automation_client_->SetUrlFetcher(url_fetcher_.get());
     if (!InitializeAutomation(profile_name, chrome_extra_arguments,
diff --git a/chrome_frame/chrome_frame_activex_base.h b/chrome_frame/chrome_frame_activex_base.h
index 10ad0d9..dae53df 100644
--- a/chrome_frame/chrome_frame_activex_base.h
+++ b/chrome_frame/chrome_frame_activex_base.h
@@ -511,10 +511,25 @@ END_MSG_MAP()
     std::wstring wide_url = url_;
     GURL parsed_url(WideToUTF8(wide_url));
 
+    std::string scheme(parsed_url.scheme());
+    std::string host(parsed_url.host());
+
+    // If Chrome-Frame is presently navigated to an extension page, navigating
+    // the host to a url with scheme chrome-extension will fail, so we
+    // point the host at http:local_host.  Note that this is NOT the URL
+    // to which the host is directed.  It is only used as a temporary message
+    // passing mechanism between this CF instance, and the BHO that will
+    // be constructed in the new IE tab.
+    if (parsed_url.SchemeIs("chrome-extension") &&
+        is_privileged_) {
+      scheme = "http";
+      host = "local_host";
+    }
+
     std::string url =
         StringPrintf("%hs:%hs?attach_external_tab&%I64u&%d&%d&%d&%d&%d&%hs",
-                     parsed_url.scheme().c_str(),
-                     parsed_url.host().c_str(),
+                     scheme.c_str(),
+                     host.c_str(),
                      params.cookie,
                      params.disposition,
                      params.dimensions.x(),
@@ -1221,6 +1236,18 @@ END_MSG_MAP()
                             http_headers.AsInput());
   }
 
+  void InitializeAutomationSettings() {
+    static const wchar_t kHandleTopLevelRequests[] = L"HandleTopLevelRequests";
+    static const wchar_t kUseChromeNetworking[] = L"UseChromeNetworking";
+
+    // Query and assign the top-level-request routing, and host networking
+    // settings from the registry.
+    bool top_level_requests = GetConfigBool(true, kHandleTopLevelRequests);
+    bool chrome_network = GetConfigBool(false, kUseChromeNetworking);
+    automation_client_->set_handle_top_level_requests(top_level_requests);
+    automation_client_->set_use_chrome_network(chrome_network);
+  }
+
   ScopedBstr url_;
   ScopedComPtr<IOleDocumentSite> doc_site_;