Capture mouse input to plugins on MouseDown

When a user presses a mouse button over a PDF, the PDF receives all
mouse input until there is a corresponding MouseUp. This is currently
broken for OOPIFs because the browser process doesn't know when a PDF
is supposed to capture input and so it doesn't always route events to
the right process. This change causes renderers to signal the browser
process for mouse capture when a PDF is is clicked.

Bug: 864957
Change-Id: If17587d5ca475d9a8ac03a3bba301d4084e6d4e3
Reviewed-on: https://chromium-review.googlesource.com/c/1203883
Commit-Queue: Ken Buchanan <kenrb@chromium.org>
Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
Reviewed-by: James MacLean <wjmaclean@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#596893}

content/browser/renderer_host/render_widget_host_input_event_router.cc

@@ -1709,4 +1709,11 @@ void RenderWidgetHostInputEventRouter::SetMouseCaptureTarget(
     mouse_capture_target_.target = nullptr;
 }
 
+RenderWidgetHostImpl*
+RenderWidgetHostInputEventRouter::GetMouseCaptureWidgetForTests() const {
+  if (mouse_capture_target_.target)
+    return mouse_capture_target_.target->host();
+  return nullptr;
+}
+
 }  // namespace content

content/browser/renderer_host/render_widget_host_input_event_router.h

@@ -127,6 +127,7 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
   // Allows a target to claim or release capture of mouse events.
   void SetMouseCaptureTarget(RenderWidgetHostViewBase* target,
                              bool captures_dragging);
+  RenderWidgetHostImpl* GetMouseCaptureWidgetForTests() const;
 
   std::vector<RenderWidgetHostView*> GetRenderWidgetHostViewsForTests() const;
   RenderWidgetTargeter* GetRenderWidgetTargeterForTests();

content/public/test/browser_test_utils.cc

@@ -786,6 +786,21 @@ void SimulateRoutedMouseClickAt(WebContents* web_contents,
                                                             ui::LatencyInfo());
 }
 
+void SendMouseDownToWidget(RenderWidgetHost* target,
+                           int modifiers,
+                           blink::WebMouseEvent::Button button) {
+  auto* view = static_cast<content::RenderWidgetHostImpl*>(target)->GetView();
+
+  blink::WebMouseEvent mouse_event(blink::WebInputEvent::kMouseDown, modifiers,
+                                   ui::EventTimeForNow());
+  mouse_event.button = button;
+  int x = view->GetViewBounds().width() / 2;
+  int y = view->GetViewBounds().height() / 2;
+  mouse_event.SetPositionInWidget(x, y);
+  mouse_event.click_count = 1;
+  target->ForwardMouseEvent(mouse_event);
+}
+
 void SimulateMouseEvent(WebContents* web_contents,
                         blink::WebInputEvent::Type type,
                         const gfx::Point& point) {
@@ -1876,6 +1891,12 @@ RenderWidgetHost* GetKeyboardLockWidget(WebContents* web_contents) {
   return static_cast<WebContentsImpl*>(web_contents)->GetKeyboardLockWidget();
 }
 
+RenderWidgetHost* GetMouseCaptureWidget(WebContents* web_contents) {
+  return static_cast<WebContentsImpl*>(web_contents)
+      ->GetInputEventRouter()
+      ->GetMouseCaptureWidgetForTests();
+}
+
 bool RequestKeyboardLock(WebContents* web_contents,
                          base::Optional<base::flat_set<ui::DomCode>> codes) {
   DCHECK(!codes.has_value() || !codes.value().empty());

content/public/test/browser_test_utils.h

@@ -169,6 +169,12 @@ void SimulateRoutedMouseClickAt(WebContents* web_contents,
                                 blink::WebMouseEvent::Button button,
                                 const gfx::Point& point);
 
+// Simulates MouseDown at the center of the given RenderWidgetHost's area.
+// This does not send a corresponding MouseUp.
+void SendMouseDownToWidget(RenderWidgetHost* target,
+                           int modifiers,
+                           blink::WebMouseEvent::Button button);
+
 // Simulates asynchronously a mouse enter/move/leave event.
 void SimulateMouseEvent(WebContents* web_contents,
                         blink::WebInputEvent::Type type,
@@ -840,6 +846,12 @@ RenderWidgetHost* GetMouseLockWidget(WebContents* web_contents);
 // Returns the RenderWidgetHost that holds the keyboard lock.
 RenderWidgetHost* GetKeyboardLockWidget(WebContents* web_contents);
 
+// Returns the RenderWidgetHost that holds mouse capture, if any. This is
+// distinct from MouseLock above in that it is a widget that has requested
+// implicit capture, such as during a drag. MouseLock is explicitly gained
+// through the JavaScript API.
+RenderWidgetHost* GetMouseCaptureWidget(WebContents* web_contents);
+
 // Allows tests to drive keyboard lock functionality without requiring access
 // to the RenderWidgetHostImpl header or setting up an HTTP test server.
 // |codes| represents the set of keys to lock.  If |codes| has no value, then

extensions/browser/guest_view/mime_handler_view/mime_handler_view_browsertest.cc

@@ -341,4 +341,24 @@ IN_PROC_BROWSER_TEST_F(MimeHandlerViewBrowserPluginSpecificTest,
         FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
     run_loop.Run();
   }
-}
+}
+
+// Verify that a BrowserPlugin captures mouse input on MouseDown.
+IN_PROC_BROWSER_TEST_F(MimeHandlerViewBrowserPluginSpecificTest,
+                       MouseCaptureOnMouseDown) {
+  RunTest("testBasic.csv");
+  auto* guest_web_contents = GetGuestViewManager()->WaitForSingleGuestCreated();
+  auto* guest_widget = MimeHandlerViewGuest::FromWebContents(guest_web_contents)
+                           ->GetOwnerRenderWidgetHost();
+  auto* embedder_web_contents = GetEmbedderWebContents();
+
+  SendMouseDownToWidget(guest_widget, 0, blink::WebMouseEvent::Button::kLeft);
+
+  while (!GetMouseCaptureWidget(embedder_web_contents)) {
+    base::RunLoop run_loop;
+    base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+    run_loop.Run();
+  }
+  EXPECT_EQ(GetMouseCaptureWidget(embedder_web_contents), guest_widget);
+}

third_party/blink/renderer/core/exported/web_view_impl.cc

@@ -427,6 +427,7 @@ void WebViewImpl::HandleMouseDown(LocalFrame& main_frame,
     if (!result.GetScrollbar() && hit_node && hit_node->GetLayoutObject() &&
         hit_node->GetLayoutObject()->IsEmbeddedObject()) {
       mouse_capture_node_ = hit_node;
+      page_->DeprecatedLocalMainFrame()->Client()->SetMouseCapture(true);
       TRACE_EVENT_ASYNC_BEGIN0("input", "capturing mouse", this);
     }
   }
@@ -1847,6 +1848,8 @@ void WebViewImpl::SetCursorVisibilityState(bool is_visible) {
 void WebViewImpl::MouseCaptureLost() {
   TRACE_EVENT_ASYNC_END0("input", "capturing mouse", this);
   mouse_capture_node_ = nullptr;
+  if (page_->DeprecatedLocalMainFrame())
+    page_->DeprecatedLocalMainFrame()->Client()->SetMouseCapture(false);
 }
 
 void WebViewImpl::SetFocus(bool enable) {