Screen readers often set focus in response to user actions (e.g. the user moving the screen reader's review cursor or choosing to interact with a control). Other a11y clients might need this too. This is done via Accessible::TakeFocus. For out-of-process iframes, this doesn't work unless the iframe document already has the focus; e.g. you tab into it or click inside it.

Henri, are you able to provide some guidance here as to how we can do this? I see that bug 1533716 made "out-of-process iframes able to request focus". Can Accessible::TakeFocus just call SendRequestFocus on the BrowserChild actor before calling nsFocusManager::SetFocus? Does that even sound reasonable?

(In reply to James Teh [:Jamie] from comment #0)

Henri, are you able to provide some guidance here as to how we can do this? I see that bug 1533716 made "out-of-process iframes able to request focus". Can Accessible::TakeFocus just call SendRequestFocus on the BrowserChild actor before calling nsFocusManager::SetFocus? Does that even sound reasonable?

SendRequestFocus isn't meant to be called directly. It's meant to be called via nsIWidget::SetFocus (when nsIWidget is actually PuppetWidget). However, I'm not aware of any particular harm rom calling SendRequestFocus directly on BrowserChild.

Calling nsFocusManager::SetFocus as you currently do should just work to focus the frame. You are calling this from within the out-of-process iframe? Do you have a testcase where this doesn't work?

data:text/html,<button>a</button><iframe fission src="data:text/html,&lt;button&gt;b&lt;/button&gt;"></iframe>

1. Focus the "a" button.
2. Get an accessible for the "b" button (from within the content process) and call Accessible::TakeFocus.
   • Expected: The "b" button should get focus.
   • Actual: It doesn't. The "a" button remains focused.

I don't quite know how to test this without an a11y client; we don't have a11y testing set up for Fission yet.

The issue here is that the checks at https://searchfox.org/mozilla-central/source/dom/base/nsFocusManager.cpp#1223 to determine whether what is being focused is in the active window are using the docshell tree to scan for this, which doesn't provide any useful information for an iframe in a separate process.

I'm going to change this into a bug to fix this.

Adding ni for Henri to look into this when he's back from PTO.

(In reply to Neil Deakin from comment #4)

The issue here is that the checks at https://searchfox.org/mozilla-central/source/dom/base/nsFocusManager.cpp#1223 to determine whether what is being focused is in the active window are using the docshell tree to scan for this, which doesn't provide any useful information for an iframe in a separate process.

Could this also be the reason why text fields in out-of-process iframes can't be focused by mouse?

(In reply to James Teh [:Jamie] from comment #3)

data:text/html,<button>a</button><iframe fission src="data:text/html,&lt;button&gt;b&lt;/button&gt;"></iframe>

1. Focus the "a" button.
2. Get an accessible for the "b" button (from within the content process) and call Accessible::TakeFocus.
   • Expected: The "b" button should get focus.
   • Actual: It doesn't. The "a" button remains focused.

I don't quite know how to test this without an a11y client;

How do I perform step 2 above with an accessibility client on Mac, Windows, or Ubuntu?

Alternatively, can you check if the builds from this try run resolve the problem?
https://treeherder.mozilla.org/#/jobs?repo=try&revision=5c7dd607a44fc311522f9c6b72ed1c8475f1564f

Could this also be the reason why text fields in out-of-process iframes can't be focused by mouse?

(The patch in the try run does not fix the unfocusability of text fields by mouse.)

(In reply to Henri Sivonen (:hsivonen) from comment #7)

(The patch in the try run does not fix the unfocusability of text fields by mouse.)

The mouse part is bug 1562156. These are probably duplicates of each other.

(In reply to Henri Sivonen (:hsivonen) from comment #6)

2. Get an accessible for the "b" button (from within the content process) and call Accessible::TakeFocus.

How do I perform step 2 above with an accessibility client on Mac, Windows, or Ubuntu?

New test case (because apparently fission.oopif.attribute is deprecated now). You'll need the NVDA screen reader on Windows.

1. Set pref fission.autostart to true and restart Firefox.
2. Open this test case:
   data:text/html,a<iframe src="https://google.com/notfound"></iframe>
3. Focus the top level document (e.g. by tabbing once from the address bar).
4. Press NVDA+control+z to open the NVDA Python console. (The "NVDA" key defaults to the insert key. You can also set this to be the caps lock key in NVDA menu -> Preferences -> Settings -> Keyboard.)
5. Enter this command:
   nav.firstChild.next.firstChild.firstChild.setFocus()
6. Switch back to Firefox.
   • Expected: The "Google" link in the iframe should be focused.
   • Actual: it isn't.

Alternatively, can you check if the builds from this try run resolve the problem?
https://treeherder.mozilla.org/#/jobs?repo=try&revision=5c7dd607a44fc311522f9c6b72ed1c8475f1564f

Unfortunately, they don't. No change.

Thank you for the NVDA steps. I'm now pretty convinced that bug 1562156 is a duplicate of this bug.

In the non-Fission case, when we enter SetFocus, mFocusedWindow and mActiveWindow are non-null. They are null in the Fission case. Hence...

(In reply to Neil Deakin from comment #4)

The issue here is that the checks at https://searchfox.org/mozilla-central/source/dom/base/nsFocusManager.cpp#1223 to determine whether what is being focused is in the active window are using the docshell tree to scan for this, which doesn't provide any useful information for an iframe in a separate process.

It's insufficient to just scan the BrowsingContext tree, since the starting point is wrong: We have null mActiveWindow instead of the corresponding BrowsingContext*.

From the point of view of auditing all uses of mFocusedWindow and mActiveWindow for using the BrowsingContext tree instead, we have a pretty daunting number of references to mFocusedWindow and mActiveWindow. Considering that sequential focus traversal works, we might get away with a partial migration to the BrowsingContext tree.

How synchronous does this stuff need to be? Could we maintain asynchronously-updating information about the focused BrowsingContext in the BrowsingContext tree and compute the active BrowsingContext from it on demand? Could we just trigger the information syncing whenever we assign to mFocusedWindow and hope that the IPC racing isn't too terrible?

Do we have any example of a synced property that is true for at most one BrowsingContext at a time? I wonder how much cross-process blur should be explicit and how much it should be a side effect of the focused property sync...

(In reply to Henri Sivonen (:hsivonen) from comment #10)

Do we have any example of a synced property that is true for at most one BrowsingContext at a time?

Instead of syncing a property on the browsing contexts themselves, we should probably be syncing the id of the focused browsing context to all processes. Do we have an existing example of that kind of broadcast?

So we have something similar. BrowsingContextGroup has a list of ContentParent that actually has a BrowsingContext from that group. We could put that property on the group instead, and use BrowsingContextGroup::EachParent to send a message to all concerned ContentChild(ren).

Does this make sense as a plan:

In nsFocusManager, replace mActiveWindow and mFocusedWindow with BrowsingContexts, which can be in-process or out-of-process.

Since mFocusedWindow is documented to always be the same as or descendent of mActiveWindow and mActiveWindow is required to be a top-level window, only allow setting mFocusedWindow and compute mActiveWindow from it. (I.e. mActiveWindow is just a cached pre-computed value.)

mFocusedWindow can only change by a new focuses item grabbing focus. When mFocusedWindow changes, the content process in which the new mFocusedWindow resides (i.e. the content process that is taking focus) runs the blurring for the blur-eligible in-process BrowsingContexts and sends an IPC message to the chrome process indicating the id of the newly-focused BrowsingContext.

The chrome process broadcasts the newly-focused BrowsingContext id to all other content processes (on a per-process basis, not on a per-BrowserParent basis!). When the content process receives the id of the newly-focused BrowsingContext from the chrome process, it checks if any of its in-process BrowsingContexts become blurred and runs the blurring steps for those.

There is an opportunity for to content processes to start grabbing focus simultaneously. As far as I can tell, this cannot happen as a result of the user event. It can only happen by JS (or compromised C++) grabbing focus without reacting to user event. The probability of two processes grabbing focus simultaneously from a timer or such seems low enough that I propose we don't implement any particular protocol for dealing with the situation but just let the consequences be whatever the consequences are for the focused BrowsingContext id broadcasts arriving in the order they happen to arrive in.

Yes, this sounds reasonable, and the trade off on races due to simultaneous content child interaction is something that's just inherently fission-y. We've made the decision that this is inevitable in other cases, and I think that it should be in this case as well.

What do you think of comment 14, Neil?

Is that a more complex way of saying that the chrome process gets told and keeps track of which descendant BrowsingContext is focused? Why does it need to broadcast to all other processes rather than just the one that is focused?

(In reply to Neil Deakin from comment #17)

Is that a more complex way of saying that the chrome process gets told and keeps track of which descendant BrowsingContext is focused?

No, the chrome process would just be a the broadcast conduit and the content processes would all maintain their understanding of which BrowsingContext is focused. My understanding is that they all maintain the full BrowsingContext tree anyway.

Or do they? (ni farre for this.)

Why does it need to broadcast to all other processes rather than just the one that is focused?

All the processes that own BrowsingContexts in the chain that gets blurred need to know that the focus went elsewhere. It seems simpler to broadcast the id of the newly-focused BrowsingContext to every process than to make the chrome process keep track of which processes strictly need to know.

All the processes that own BrowsingContexts in the chain that gets blurred need to know that the focus went elsewhere. It seems simpler to broadcast the id of the newly-focused BrowsingContext to every process than to make the chrome process keep track of which processes strictly need to know.

OK, so that means that only those processes that have browsing contexts that are ancestors of the browsing context being blurred and not ancestors of those being being focused would respond. That seems like it might work.

Does every chrome subframe (sidebar for example) always have a separate browsing context as well? I assume the intent is to use the same message passing here as well?

(In reply to Neil Deakin from comment #19)

Does every chrome subframe (sidebar for example) always have a separate browsing context as well? I assume the intent is to use the same message passing here as well?

I don't know. However, other sidebar and popup breakage that I've caused while making Fission changes indicates that my understanding of chrome-level browsing contexts is insufficient.

farre, how do sidebars and popups as well as multiple top-level browser windows fit the browsing context tree? More generally, what's the latest documentation that I should read about how the browsing context tree works?

It shouldn't be that different from how it was with nsDocShell. The only big difference is that we only have same type trees, so you're never expected to be able to from a content browsing context be able to traverse upwards in the tree and get a chrome browsing context.

And in the grandes scheme of things this isn't really an issue, with bc's, but more with how focus handling should be dealt with in a post-fission world. Tagging in :nika for thoughts.

(In reply to Henri Sivonen (:hsivonen) from comment #18)

(In reply to Neil Deakin from comment #17)

Is that a more complex way of saying that the chrome process gets told and keeps track of which descendant BrowsingContext is focused?

No, the chrome process would just be a the broadcast conduit and the content processes would all maintain their understanding of which BrowsingContext is focused. My understanding is that they all maintain the full BrowsingContext tree anyway.

Yes and no. Content processes can see the entire tree, but that doesn't hold the entire state of the browser. It can only see the subtree for each content tab (sidebar, extension popup, etc) loaded in that process. It's possible (common?) for no BrowsingContext in the entire content-visible tree to have focus (e.g. when the URL bar is focused, or focus is in a different tab). I'm not entirely sure how focus works in that situation (it's possible the subtree would still have a focused node which doesn't correspond to the OS's focus).

In the parent process, you can see every BrowsingContext, including those for browser UI, so it would be more reasonable to keep track of which BrowsingContext is focused there.

From the point of view of a content process, I'm guessing what is important is whether or not you have focus. I imagine a system where the parent process keeps track of which BC has focus, and in the content process, the BC which has focus is also tracked. However, in content, the focus status of BCs which aren't local is invisible. Calls like "focus()" and "blur()" would update local state as much as is reasonable, and then the parent process would be notified. When the parent process receives the message from content, it would update its local state, and potentially notify other content processes that they have been focused or blurred, updating their local state async. We may need to use the same epoch mechanism as is used for BC field syncing to ensure that focus state in every process is consistent.

I think that would appear sufficiently sync to make us web-compatible, and there'd be a coherent view of focus in the parent process.

(In reply to :Nika Layzell (ni? for response) from comment #23)

Yes and no. Content processes can see the entire tree, but that doesn't hold the entire state of the browser. It can only see the subtree for each content tab (sidebar, extension popup, etc) loaded in that process. It's possible (common?) for no BrowsingContext in the entire content-visible tree to have focus (e.g. when the URL bar is focused, or focus is in a different tab). I'm not entirely sure how focus works in that situation (it's possible the subtree would still have a focused node which doesn't correspond to the OS's focus).

Ah, so I was wrong about the entire tree getting synced. Now that I think about it a bit more, it makes sense from the security perspective not to sync the parts that a given content process doesn't need to know.

In the parent process, you can see every BrowsingContext, including those for browser UI, so it would be more reasonable to keep track of which BrowsingContext is focused there.

FWIW, I have no idea what mActiveWindow means in the chrome context. (In the Web context its the top-level ancestor of mFocusedWindow or, if mFocuseWindow is the top-level thing in the Web hierarchy, mFocusedWindow itself.)

From the point of view of a content process, I'm guessing what is important is whether or not you have focus. I imagine a system where the parent process keeps track of which BC has focus, and in the content process, the BC which has focus is also tracked. However, in content, the focus status of BCs which aren't local is invisible. Calls like "focus()" and "blur()" would update local state as much as is reasonable, and then the parent process would be notified. When the parent process receives the message from content, it would update its local state, and potentially notify other content processes that they have been focused or blurred, updating their local state async. We may need to use the same epoch mechanism as is used for BC field syncing to ensure that focus state in every process is consistent.

I take it that the reasonable way to do the syncing is to send the ID of the most-recently-focused BrowsingContext across IPC and not to make "focused" a field of the BrowsingContext itself, since an outside-the-tree "the focused BrowsingContext is that one" makes sure there can't be more than one, whereas with a "focused" field on the BrowsingContext objects, there'd be more work to maintain the invariant that no more than one BrowsingContext can have the field set to true.

What code should I read to see a sample of the closest thing to something like this that currently exists?

FWIW, I have no idea what mActiveWindow means in the chrome context. (In the Web context its the top-level ancestor of mFocusedWindow or, if mFocuseWindow is the top-level thing in the Web hierarchy, mFocusedWindow itself.)

mActiveWindow is the topmost raised chrome window. mFocusedWindow is either equal to mActiveWindow or a descendant of it.

(In reply to Henri Sivonen (:hsivonen) from comment #24)

I take it that the reasonable way to do the syncing is to send the ID of the most-recently-focused BrowsingContext across IPC and not to make "focused" a field of the BrowsingContext itself, since an outside-the-tree "the focused BrowsingContext is that one" makes sure there can't be more than one, whereas with a "focused" field on the BrowsingContext objects, there'd be more work to maintain the invariant that no more than one BrowsingContext can have the field set to true.

That sounds like a reasonable approach, and probably how I'd do something like that as well :-)

What code should I read to see a sample of the closest thing to something like this that currently exists?

I'm not sure if there's something exactly like this for BrowsingContext right now The closest is probably the BrowsingContextField synchronization logic. Here's a summary of what it does:

• In content processes, store a uint64_t mEpoch; for each independent synced value, initialized to 0. https://searchfox.org/mozilla-central/rev/1d0e84d2ec2843924bc6e5ed6658f93439e12351/docshell/base/BrowsingContext.h#534-544
• Each ContentChild and ContentParent has a BrowsingContextFieldEpoch.
• Whenever a content process performs a mutation, the global ContentChild epoch is incremented, and stored as the latest mEpoch for each independent synced value (https://searchfox.org/mozilla-central/rev/1d0e84d2ec2843924bc6e5ed6658f93439e12351/docshell/base/BrowsingContext.cpp#966-975)
• The new epoch is sent with the mutation message, and stored in ContentParent (https://searchfox.org/mozilla-central/rev/1d0e84d2ec2843924bc6e5ed6658f93439e12351/dom/ipc/ContentParent.cpp#6074-6082).
• Whenever the parent process wants to send a mutation down to content, it sends down the currently known epoch value alongside the updates (https://searchfox.org/mozilla-central/rev/1d0e84d2ec2843924bc6e5ed6658f93439e12351/docshell/base/BrowsingContext.cpp#979-981).
• The content process compares the received epoch with the one stored for each independent value, allowing it to determine if it has an in-flight mutation message which the parent process hasn't seen yet. These messages are out-of-date updates which will be overridden int he parent, and so can be ignored. (https://searchfox.org/mozilla-central/rev/1d0e84d2ec2843924bc6e5ed6658f93439e12351/docshell/base/BrowsingContext.cpp#1008-1013)

The patch now has the line-by-line conversion to BrowsingContext without any epoch checking, because it was unclear to me what the code should do differently on an epoch mismatch.

Unsurprisingly, in its current state, the patch breaks SetFocus even in the non-Fission case.

So far, the obvious non-Fission change is that RaiseWindow no longer sets the active windows, which is now computed from the focused browsing context. This changes when (or if?) a window becomes "active".

It is so far unclear to me how the old code actually upheld the claimed invariant that mActiveWindow was mFocusedWindow or its ancestor.

If you see errors in the patch (there have to be some), I welcome those getting pointed out to me.

The patch I uploaded earlier today appears to break blurring. We never run LOGCONTENT("Element %s has been blurred", element.get());

Additionally, it breaks remote process Activate/Deactivate behavior somehow, which breaks keyboard event routing.

Part of the problem seems to be that tracking cross-process focused BrowsingContext loses tracking of the best approximation of in-process ancestor DOM window. I bet that mFocusedWindow in the chrome process has had more subtle semantics than have been documented. Sigh.

What's the expected null/non-null behavior of mFocusedWindow in the chrome process when focus is in Web content?

If focus is in a child process, then mFocusedWindow in the chrome process should be the window containing its embedding <browser> element. mFocusedElement should be that <browser> element.

mFocusedWindow should only be null in the chrome process when some other application is active (or in-between blurring one thing and focusing another). If it was it would mean that the focus was on the top level window with no element focused.

(In reply to Neil Deakin from comment #32)

If focus is in a child process, then mFocusedWindow in the chrome process should be the window containing its embedding <browser> element. mFocusedElement should be that <browser> element.

mFocusedWindow should only be null in the chrome process when some other application is active (or in-between blurring one thing and focusing another). If it was it would mean that the focus was on the top level window with no element focused.

Thank you.

How does this apply to out-of-process iframes? Clearly, with in-process iframes, the ancestor iframes can be mFocusedElement, since there's only one per process. However, when process boundaries can traverse the same process multiple times in a hierarchy (example.com frames example.org which frames example.com again, which frames example.org again, and focus is in there), will it be a problem that the example.com process can't have mFocusedElement set to both out-of-process iframes?

Currently, the way BrowserParent::Activate and BrowserParent::Deactivate get called seems to assume that each process shows up only once in the framing hierarchy and the process containing the out-of-process iframe has mFocusedElement set to it.

What benefit do we get from maintaining mFocusedElement pointed to the <browser> or out-of-process iframe? How bad would it be to figure out dynamically every time that if browsing context A has focus is out-of-process and its parent B is in this process, the frame that logically contains B is in this process and is focused?

(Also, currently IME focus depends on Activate and Deactivate happening in an orderly fashion. I'm worried that once focusing random stuff by mouse works correctly, it'll be infeasible to maintain proper temporal order of the chrome process observing the Activates and Deactivates and IME focus source of truth will have to change again.)

Is there a profound reason why CanonicalBrowsingContext doesn't have a getter for BrowserParent, or is it just a matter of no one having added one yet?

The current patch makes it possible to use BrowsingContexts to focus the top level of Web content by click and enter text. Focusing iframes is still broken.

(In reply to Henri Sivonen (:hsivonen) from comment #34)

Is there a profound reason why CanonicalBrowsingContext doesn't have a getter for BrowserParent, or is it just a matter of no one having added one yet?

I hope there isn't a profound reason not to add such a getter, since I think I really need one. Bug 1585950.

The most pressing issues I see:

• After making focused BrowsingContext propagate across processes, the "active" concept does not work well, because the the existing code seems to assume that top-level BrowsingContext in the front-most tab should count as "active" even when focus is in chrome, so the notion that "active" must be an ancestor of "focused" but not across the chrome/content boundary seems not quite true.
• I'm a having trouble getting the focused BrowsingContext synced to newly-spawned processes for out-of-process iframes. (Hopefully simpler to fix than the first point.)

(In reply to Henri Sivonen (:hsivonen) from comment #37)

• After making focused BrowsingContext propagate across processes, the "active" concept does not work well, because the the existing code seems to assume that top-level BrowsingContext in the front-most tab should count as "active" even when focus is in chrome, so the notion that "active" must be an ancestor of "focused" but not across the chrome/content boundary seems not quite true.

What non-chrome-process top-level content can we have participating in focus apart from the Web content in the currently-active tab of the front-most native window? There can be a sidebar with extension-provided non-chrome-process content. There can be an extension-provided pop-up that's semantically not a titlebarful native window but in a native window manager thingy that's somehow tied to the titlebarful window.

Do we support "focus-follows mouse" still on some X11 configs allowing keystrokes to go to non-frontmost window? What configs?

Are there more cases for content process top-level focus than:

1. Focus is in chrome. No Web content is receiving keystrokes.
2. Focus is in the selected browser tab of the frontmost titlebarful native window.
3. Focus is in the sidebar of the frontmost titlebarful native window.
4. Focus is in a titlebarless popup associated with the frontmost titlebarful native window.

Is case 4 either always fully-chrome (e.g. awesomebar popup) or always fully-content (popups generated by extension icons in the toolbar), or are there subtle transitions within those windows?

An even larger part that I though is about the "active"/"activate" concept than about focus per se.

AFAICT:

Before e10s, we had the notion of raising a window where window meant an actual GUI window. With e10s, we made the internal APIs model the action of switching to a tab hosting out-of-process Web content as raising the window of the puppet widget hosting the top-level Web content in that process. Each process considers one widget--real or puppet--to be the raised one. This works, since there was only at most one of these process boundaries "active" at a time per process.

With Fission, one process can simultaneously have more than one process boundary integration point on the logical path from the native window to the focused element. Thus, the notion that there is such a thing as the raised DOM window per process no longer works. If site A frames site B frames site A and focus is in the innermost frame, the focus handling for the process hosting site A is broken, because the process-wide globals (fields of a singleton more precisely) clash for the content hosted by the two BrowserChild objects in the same process. We generally assume that we can obtain a pointer to a singleton nsFocusManager without providing any context, so refactoring things such that there'd be one nsFocusManager per BrowserChild rather than per process would be a big deal.

Handing off raisedness by click worked under e10s, too. When you click Web content in a non-topmost GUI window in non-Fission e10s, chrome knows which native GUI window to raise and which BrowserParent to tell to raise its puppet/DOM window. But most importantly: Telling the BrowserParent to raise its puppet window is one level of IPC.

In contrast, when in Fission you click an out-of-process iframe, the click goes directly to the out-of-process iframe. There's no opportunity for a chain of "raise DOM window" operations to propagate down first before we react to the mouse click. We want to process the mouse click synchronously and let the "raise DOM window" chain to happen afterwards somehow. Not only does the existing code expect there to be at most one raised DOM window per process, it expects the DOM windows to have been raised in a top-down sequence before the mouse click is processed.

Merely changing the "focused DOM window" to be a "focused BrowsingContext" is not enough. Trusting the comments about what "active (DOM) window" means relative to the focused one doesn't work at all, because the "active" concept both assumes there's at most one per process and assumes there is one per process boundary.

It seems we need a way for a BrowserChild that's not "active" to be able to put itself and the BrowserChild objects that are its ancestors in Web hierarchy and that reside in the same process in the "active" state synchronously and then let the other BrowserChild objects in the chain logically but residing in other processes to become "active" asynchronously after the fact. And we need to support more than one "active" BrowserChild and more than one focused remote frame host in one process.

To take a step back:

Since the concept of "active" DOM window is an artifact of process boundaries and doesn't exist on in-process iframe boundaries, should be really be extending the concept of "active" to more than one per process or should be try to eliminate the concept of "active" at process boundaries and instead only have the concepts that are equal across all frame boundaries (each DOM window knowing its focused element, which may be an iframe, and which is remembered even if the DOM window is not "raised") and concepts that are synced across all processes (the deepest "raised" BrowsingContext)?

The explanations here help understand the main issue here, thanks. The issue is a case where A and B are processes, and we have a frame tree with a structure like A -> B -> A, this causes an issue as there is only one focus manager per process.

However, the actual focus in only in the one of those 'A' subframes, so nsFocusManager's mFocusedWindow and mFocusedElement would point to those.

So for example if a button is the higher A was focused, mFocusedWindow would be A and mFocusedElement is the button. The current focus for a window is stored at https://searchfox.org/mozilla-central/rev/5cb522c7baba24e55874809e0e206b001494c1e9/dom/base/nsPIDOMWindow.h#636 whether the window is focused or not. If the higher A was focused, this would point to the button.

If however the descendant A subframe was focused, nsFocusedManager::mFocusedWindow would be the lower A, and nsFocusedManager::mFocusedElement would be whatever element in that was focused. The ancestor A's nsPIDOMWindow::mFocusedElement would point at the subframe.

You could change all this to use browsing contexts instead if that would be easier.

The trickier case in with the active window. The original intent of nsFocusManager::mActiveWindow was to indicate the top-level chrome window that was in front. However with e10s, this was repurposed for child processes to also indicate which tab was in front.

I think an analysis of what the callers are doing when getting the active window would be needed. Many callers just want to know whether they are inside an active window so they can update UI state (window decorations, highlight colours, etc). Those don't actually need to know which window is active, but just a boolean indicating active versus inactive. Much of the rest are chrome process only so the issue wouldn't apply. Are there any content process uses of the active window that do more than that?

(In reply to Neil Deakin from comment #40)

I think an analysis of what the callers are doing when getting the active window would be needed. Many callers just want to know whether they are inside an active window so they can update UI state (window decorations, highlight colours, etc). Those don't actually need to know which window is active, but just a boolean indicating active versus inactive. Much of the rest are chrome process only so the issue wouldn't apply. Are there any content process uses of the active window that do more than that?

AFAICT, there are three cases:

1. Checking if current focus or about-to-be-focused thing is in the frontmost GUI window (and for Web content, tab).
2. Checking things related to actual native GUI window raisedness in the chrome process only.
3. Checking things related to either the actual native GUI window raisedness in the chrome process or raisedness of a process boundary integration point in a content process.

For the purpose of item #1 it should logically be enough to track the BrowsingContext that is in the frontmost GUI window and has focus, since it should be always possible to walk up from that one. However, doing only that totally breaks cases #2 and #3, because the relationship between "focused" and "active" gets out of sync during raising a window. Specifically, the code wants the window being raised to become "active" synchronously, and then activation / pseudo-raise asynchronously propagates down.

The async top-down propagation is fine for switching tabs/windows from the top and for sequential tabbing, but, as noted, it doesn't at all fit the notion that a random element at the bottom wants to get focused bottom-up. For the start of the bottom-up focusing action, checking what's allowed and what needs to happen, it should be enough for the content process to have an ahead-of-time eagerly-synced copy of the BrowsingContext tree as well as the currently-focused BrowsingContext. However, getting everything else in the right state afterwards, considering that things are built to sync top-down is unresolved. (Hand-waved in comment 14, but in addition to running blurring, the end state should get the "active" status of everything right.)

If however the descendant A subframe was focused, nsFocusedManager::mFocusedWindow would be the lower A, and nsFocusedManager::mFocusedElement would be whatever element in that was focused. The ancestor A's nsPIDOMWindow::mFocusedElement would point at the subframe.

Right, but I'm not yet convinced that there isn't an assumption that when processing things related to the ancestor A, nsFocusedManager::mFocusedElement should point to the subframe (which it can't, since the global is pointing to something in the descendant A).

I spoke with Neil by voice. I'm going to try the following:

1. Retain current mActiveWindow for chrome-process native windows raising/lowering.
2. Have the cross-process-synced focused BrowsingContext as planned previously. Use its Top() for making decisions about whether the about-to-be-focused element is in the "active" window.
3. Try to get mActiveWindow out of the way in content processes when BrowserChild::RecvActivate() does what it needs to do. (I.e. try to make mActiveWindow irrelevant for the puppet widget case.)
4. When the focused BrowsingContext changes, have each process that experiences the change compute with BrowsingContexts that are on the path from the newly-focused BrowsingContext to the top are in-process and call Activate on them.
5. Make chrome-process IME/keyboard focus work based on the BrowserParent closest to the focused BrowsingContext instead of the current expectation of Activate/Deactivate being neatly stack-friendly.
6. Starting IME state management in the newly-focused content process is ???? but hopefully comes out naturally from making item #2 on this list actually work.

When the focused BrowsingContext changes, have each process that experiences the change compute with BrowsingContexts that are on the path from the newly-focused BrowsingContext to the top are in-process and call Activate on them.

Hmm. I wonder if instead the process hosting the nearest common ancestor of the previous and new focused BrowsingContext should call Deactivate and Activate and let them propagate down the usual way even though the focus has already changed ahead of time.

Oh, and the very first thing to try is to remove mFocusedElement to and see if anything breaks to see if it genuinely a cached value as it is supposed to be. After this is all done, if there's an actual perf issue, we can reoptimize, but it seems that refactoring is easier when not having to maintain cache invariants.

When we spawn a new out-of-process iframe, has the CanonicalBrowsingContext for that iframe been added to the BrowsingContextGroup by the time BrowsingContextGroup::EnsureSubscribed runs to subscribe the process to that BrowsingContextGroup? (I'm trying to figure out what's the right point to inform a newly-spawned process about what the currently-focused BrowsingContext is. Can't happen before the new process has the requisite reflector BrowsingContext objects.)

(In reply to Henri Sivonen (:hsivonen) from comment #45)

When we spawn a new out-of-process iframe, has the CanonicalBrowsingContext for that iframe been added to the BrowsingContextGroup by the time BrowsingContextGroup::EnsureSubscribed runs to subscribe the process to that BrowsingContextGroup? (I'm trying to figure out what's the right point to inform a newly-spawned process about what the currently-focused BrowsingContext is. Can't happen before the new process has the requisite reflector BrowsingContext objects.)

Yes. BrowisngContext (and CanonicalBrowsingContext by extension) objects are always added to their groups as soon as they're created, and don't become cross-process until they navigate :-) (https://searchfox.org/mozilla-central/rev/7cc0f0e89cb40e43bf5c96906f13d44705401042/docshell/base/BrowsingContext.cpp#143,178). EnsureSubscribed is the earliest moment that a content process is informed about the existence of these contexts, if it was not aware before.

Try to get mActiveWindow out of the way in content processes when BrowserChild::RecvActivate() does what it needs to do. (I.e. try to make mActiveWindow irrelevant for the puppet widget case.)

Still trying to figure out what this means in practice. That is, what should nsFocusManager::WindowRaised do for out-of-process iframes? In particular, if example.com frames example.org frames example.com and focused was in the inner example.com before the browser tab was switched away form, how should the state be restored upon switching back to the tab without colliding with the top-level example.com state?

Or should we not "raise" and "lower" out-of-process iframes at all? If so, how should we "activate" and "deactivate" them?

Enough of our focus logic relies on the notion of being able to reuse the notion of "raise" the window of the out-of-process internal of a the frameloader when focus moves across a process boundary that I'm really shy to try to do away with all that.

Still, for out-of-process iframes, equality checking with mActiveWindow won't work as a check for whether the DOM window is already "raised", so we need something else. Once we reach a stable state, all this is computable from where in the BrowsingContext tree the focus is. But I have a hard time understanding what we need to do during focus move or a tab switch to keep the existing code happy enough.

This baby step surely shouldn't break anything:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=6ba7f3fdf6abfd0367504d250c2c88ba5e7103c4

Going back to the earlier patch but with more restraint. This time trying not to change the parent process logic and not trusting the comments:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=222e656aecb9174d6e4c78b1830ee245d06aa26c

https://treeherder.mozilla.org/#/jobs?repo=try&revision=74ded9fd1fd7c61649b4a1cf529d40b5d3ed406d

https://treeherder.mozilla.org/#/jobs?repo=try&revision=12ebfe5805bce1db4b32a6bbfbe1f4360fcd5363

So the comments about the relationship of mActiveWindow and mFocusedWindow don't hold. That is, there are significant periods of time when the documented relationship doesn't hold, and our tests depend on that. Likewise, the documented relationship of mFocusedElement and mFocusedWindow->mFocusedElement doesn't hold, either, at important times in ways that our tests depend on.

It's not enough to just say that XUL is weird and assume that these things hold for Web content: Test cases fall over that way, too. So special-casing the chrome process doesn't work.

I think I'm going to need to special-case out-of-process iframes instead, since there are fewer pre-existing assumptions for those.

Moreover, it seems that whenever I make a larger logical set of changes at once, too many things fall over to figure out what exactly broke what. Therefore, I'm now going to try in ridiculously small steps.

Here's one:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=bb32d6d987ed02baecb57da17f5e17dba1c9378d

(In reply to Henri Sivonen (:hsivonen) from comment #53)

Here's one:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=bb32d6d987ed02baecb57da17f5e17dba1c9378d

Even this tiny change is all orange. :-(

https://treeherder.mozilla.org/#/jobs?repo=try&revision=23f9db1c33cb22c51ff61024e55f36500fa2eaf1

https://treeherder.mozilla.org/#/jobs?repo=try&revision=fb4e529d642261d73cdd18c6e45ce6c94e113050

The only test that fails now is a test that tests mozbrowser ignoreuserfocus. I haven't yet verified this, but I'm guessing that BrowsingContext::Top() doesn't cross a mozbrowser boundary, but the test case probably expects everything other than the ignoreuserfocus part to behave "normally".

smaug, you added this for the purpose of the Gaia onscreen keyboard. Does ignoreuserfocus have use cases that apply to the use of mozbrowser in dev tools?

farre, what should I know about mozbrowser and the BrowsingContext tree? Does Fission support in-process mozbrowser, or is it always out-of-process in Fission?

So, my assumptions for BrowsingContext::Top() don't hold even within content processes:
https://searchfox.org/mozilla-central/rev/8a63fc190b39ed6951abb4aef4a56487a43962bc/dom/base/nsFrameLoader.cpp#248-251

It says that in addition to mozbrowser we could create a top-level BrowsingContext in a content process for "a xul browser element with a remote="true" marker". Do all content processes have a hidden XUL document with browser remote=true at the top of the docshell hierarchy, or is there something else that involves XUL in a content process?

(In reply to Henri Sivonen (:hsivonen) from comment #58)

It says that in addition to mozbrowser we could create a top-level BrowsingContext in a content process for "a xul browser element with a remote="true" marker". Do all content processes have a hidden XUL document with browser remote=true at the top of the docshell hierarchy, or is there something else that involves XUL in a content process?

It's for about:addons:
https://searchfox.org/mozilla-central/rev/8a63fc190b39ed6951abb4aef4a56487a43962bc/dom/base/nsFrameLoader.cpp#229-232

Thanks, Nika, for writing this down!

farre, what should I know about mozbrowser and the BrowsingContext tree? Does Fission support in-process mozbrowser, or is it always out-of-process in Fission?

Redirecting needinfo to Nika who wrote the comment:
Do mozbrowser and the about:addons XUL browser remote=true always create create an out-of-process iframe boundary?

If I have a BrowsingContext from below a mozbrowser or browser remote=true boundary in a content process, is there any way of discovering the top-most content-process BrowsingContext?

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f60bdead6df38c650e1d6a27fb15f7f91cfd5e41

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1b5c0510350c7fad56c2204fa8dda18550ed0892

(In reply to Henri Sivonen (:hsivonen) from comment #60)

farre, what should I know about mozbrowser and the BrowsingContext tree? Does Fission support in-process mozbrowser, or is it always out-of-process in Fission?

Fission supports both in-process and cross-process <browser> elements. Whether or not browser is cross-process is controlled by the remote attribute, as before. Fission does not support <browser> nested within a content process.

Redirecting needinfo to Nika who wrote the comment:
Do mozbrowser and the about:addons XUL browser remote=true always create create an out-of-process iframe boundary?

A <browser remote=true> element can never appear within a content process, so you can't get an out-of-process iframe boundary at one. The reason why about:addons is able to contain these attributes is that it loaded in the parent process, not a content process. <iframe mozbrowser> within content processes is also no longer supported, and support is generally being removed. I believe the last remaining user is Responsive Design Mode, which is being rewritten to remove the use.

The <browser elements within about:addons which have a remote attribute on them are then treated as another browser boundary, and can be out-of-process. As they are browser boundaries, the BrowsingContext trees within them are split. Say we've loaded about:addons in a tab and it has a single nested browser element with an iframe, the 3 separate BrowsingContext trees would look something like this:

browser.xhtml BrowsingContext
(parent process, type=chrome, toplevel)

--------

about:addons BrowsingContext
(parent process, type=content, toplevel)

--------

moz-extension://addonPrefs BrowsingContext
(content process, type=content, toplevel)
                   |
                   v
moz-extension://addonSubframe BrowsingContext
(content process, type=content, nested)

If I have a BrowsingContext from below a mozbrowser or browser remote=true boundary in a content process, is there any way of discovering the top-most content-process BrowsingContext?

BrowsingContext.top will work in that situation for you.

(In reply to :Nika Layzell (ni? for response) from comment #63)

A <browser remote=true> element can never appear within a content process

I'm happy that that's the case. It wasn't clear from the code comments.

<iframe mozbrowser> within content processes is also no longer supported, and support is generally being removed.

OK. Good. That means that dom/html/test/test_ignoreuserfocus.html is doing its testing in a no-longer-supported way.

I believe the last remaining user is Responsive Design Mode, which is being rewritten to remove the use.

If I come across Responsive Design Mode failures, I'll ignore them for now. I'm curious, is Responsive Design Mode being rewritten to remove the use of mozbrowser or being rewritten to move mozbrowser into the chrome process?

Thanks!

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2e8096b1231b1fab22b93e88064ef2fb7c08db3f

https://treeherder.mozilla.org/#/jobs?repo=try&revision=84e73340856285102e9b5e373a6b70c81760d9bd

https://treeherder.mozilla.org/#/jobs?repo=try&revision=35a141b95174c9799782e5dee98311ff1e7253a1

https://treeherder.mozilla.org/#/jobs?repo=try&revision=a6b20e070818e2f542aaa53d329f0b3fefe07899

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5baef827f53de9d2302be24eda3853bb19fa9a92

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b32b5c4b67aad272ab6876f99d6ee4165089d93b

https://treeherder.mozilla.org/#/jobs?repo=try&revision=95cac3fd8bd64c3850119edb51db0bd77d2ecafa

https://treeherder.mozilla.org/#/jobs?repo=try&revision=af48fa95d0da02f53bd6928ecea1d1d64d00b26e

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b5d631deb0adfc9e9e28092f19f5d93437b9b8ff

https://treeherder.mozilla.org/#/jobs?repo=try&revision=478d017aae44df9a7cd81473d20ef8cf3c76503e

https://treeherder.mozilla.org/#/jobs?repo=try&revision=325ac9d8799e05ba5644c05d396dfea2fb5ff6a7

https://treeherder.mozilla.org/#/jobs?repo=try&revision=705e9c2ce6440f1e719b005a137cb19416f7b834

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e42cc72e0e53ecd857815020b39a43f408bcc724

https://treeherder.mozilla.org/#/jobs?repo=try&revision=17f2933fd413b3453c1ae693292c8976acd7ef7b

Nika, pre-Fission, can extension-provided sidebars or popups have their content allocated to a process that also hosts Web content? (I take it that post-Fission, these shouldn't go into the same process, right?)

(In reply to Henri Sivonen (:hsivonen) from comment #75)

https://treeherder.mozilla.org/#/jobs?repo=try&revision=325ac9d8799e05ba5644c05d396dfea2fb5ff6a7

These failures may be attributable to the previous patch, whose try run failed due to infra issues. Specifically, AFAICT, the changes to WindowRaised in this changeset should have no effect on the executions of browser_accesskeys.js due to mActiveWindow being nullptr in the executions that are omitted due to the parent process check.

Rolling back the testing to re-try the runs that didn't have results yesterday due to infra failure. This is before introducing mActiveBrowsingContext:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=abce55d3da78e56edb0ead003e4c476286ee5662

With mActiveBrowsingContext:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=fb1671a01b31e8370f8b67d54694e1f4802ce156

(In reply to Henri Sivonen (:hsivonen) from comment #81)

Rolling back the testing to re-try the runs that didn't have results yesterday due to infra failure. This is before introducing mActiveBrowsingContext:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=abce55d3da78e56edb0ead003e4c476286ee5662

This step was still OK.

(In reply to Henri Sivonen (:hsivonen) from comment #82)

With mActiveBrowsingContext:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=fb1671a01b31e8370f8b67d54694e1f4802ce156

This is where breakage starts.

(In reply to Henri Sivonen (:hsivonen) from comment #64)

OK. Good. That means that dom/html/test/test_ignoreuserfocus.html is doing its testing in a no-longer-supported way.

I expect that the ignoreuserfocus attribute is probably exercising some broken focus logic with fission, but the attribute itself can probably be completely removed, as there don't appear to be an users outside of the test.

I'm curious, is Responsive Design Mode being rewritten to remove the use of mozbrowser or being rewritten to move mozbrowser into the chrome process?

RDM already uses mozbrowser in the parent process, but within a "content" docshell. We never use mozbrowser in a content process.

The refactoring being performed is to remove the use of mozbrowser, and instead directly use the browser element within the browser.xhtml UI.

(In reply to Henri Sivonen (:hsivonen) from comment #79)

Nika, pre-Fission, can extension-provided sidebars or popups have their content allocated to a process that also hosts Web content? (I take it that post-Fission, these shouldn't go into the same process, right?)

The process which hosts extension-provided sidebars should always be the extension process. This process can actually host web content right now, as (for example) a moz-extension page can load a https:// iframe element.

(In reply to :Nika Layzell (ni? for response) from comment #85)
...

Thanks. It seems that none of those things require special-casing here, then!

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ff2bf386317ffeb8791caabf87f67e617b7095a3

https://treeherder.mozilla.org/#/jobs?repo=try&revision=9124386db908d3f642cdd5ca92e4e01b23f7aeba

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4665d39846397e49101ed1002f1e3f7fb77820d5

https://treeherder.mozilla.org/#/jobs?repo=try&revision=eb3a18543a2d24ad6834ee536ec369e513df60dc

https://treeherder.mozilla.org/#/jobs?repo=try&revision=6c37344d122e135fc7b67f914aa6e132aa9bf1cd

https://treeherder.mozilla.org/#/jobs?repo=try&revision=311c566427c0a81d63df100bda236f163ea23650

https://treeherder.mozilla.org/#/jobs?repo=try&revision=89dd9d2a4ccdf5b8650493a8b9fa6d2913b50709

If I'm in a content process and I have two BrowsingContexts neither for which IsInProcess() returns true, how do I check if the two BrowsingContexts are both assigned to the same process or if they are assigned to two different processes?

https://treeherder.mozilla.org/#/jobs?repo=try&revision=515d74da0dab816b3e299a92705db7a920672b9d

https://treeherder.mozilla.org/#/jobs?repo=try&revision=955cc868dbe76c523f99f8a34b8b94eee0844bda

All orange reached. :-(

(In reply to Henri Sivonen (:hsivonen) from comment #97)

All orange reached. :-(

Fortunately, just a silly mistake.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3bee7f58d85ee0950338e14171f0f4f9884c8b22

Verify rollback:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=e3d2472fc811f8b27c4e593e09161d6e90cb4fa5

(In reply to Henri Sivonen (:hsivonen) from comment #94)

If I'm in a content process and I have two BrowsingContexts neither for which IsInProcess() returns true, how do I check if the two BrowsingContexts are both assigned to the same process or if they are assigned to two different processes?

You intentionally can't check this from within a content process. If you're in the parent process, your BrowsingContext is actually a CanonicalBrowsingContext, and you can compare CanonicalBrowsingContext::OwnerProcessId() (https://searchfox.org/mozilla-central/rev/35873cfc312a6285f54aa5e4ec2d4ab911157522/docshell/base/CanonicalBrowsingContext.h#39).

(In reply to :Nika Layzell (ni? for response) from comment #100)

(In reply to Henri Sivonen (:hsivonen) from comment #94)

If I'm in a content process and I have two BrowsingContexts neither for which IsInProcess() returns true, how do I check if the two BrowsingContexts are both assigned to the same process or if they are assigned to two different processes?

You intentionally can't check this from within a content process.

Thanks. I guess I'll have to send over all the info in one IPC message to the parent and let it split the message when sending it on to other content processes.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f13cccff2ee754d3cfdfc35e05cdb223e402f30f

https://treeherder.mozilla.org/#/jobs?repo=try&revision=a9601803f0de39e6a359142df65b78a5ecaf6d65

https://treeherder.mozilla.org/#/jobs?repo=try&revision=9f5724e2f3a60e10800db30f84e64c4ff35c32e7

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5ae48c8786b8d2b6840db6c924658aa58e7af16a

https://treeherder.mozilla.org/#/jobs?repo=try&revision=37e73a976c8723dec8943787d7e095fe6107bec3

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3feec9e68d8176ad021cb9108e6a5dc095e254e4

https://treeherder.mozilla.org/#/jobs?repo=try&revision=0da4e2607e2da09ee8396964fd2aeafa45d85e90

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2999370418dc5789c89edc3b0894b43964c95162

https://treeherder.mozilla.org/#/jobs?repo=try&revision=78ce5eb74d026bd0d815bf8bf5579e964b664cd8

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d2bffac87c52871da95cb15526a7b9df9ca56644

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5cd2924e56752d7db7e2bd6f6c332643130325e8

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f75e5af29b047696c31ef79dd45f947cc247fbe0

I have code like this in the parent:

mozilla::ipc::IPCResult ContentParent::RecvSetFocusedBrowsingContext(
    BrowsingContext* aContext) {
  if (!aContext || aContext->IsDiscarded()) {
    MOZ_LOG(
        BrowsingContext::GetLog(), LogLevel::Debug,
        ("ParentIPC: Trying to send a message to dead or detached context"));
    return IPC_OK();
  }

  // XXX Set focused BrowserParent

  aContext->Group()->EachOtherParent(this, [&](ContentParent* aParent) {
    Unused << aParent->SendSetFocusedBrowsingContext(aContext);
  });

  return IPC_OK();
}

This ends up sending an IPC message back to the same ContentChild that the current IPC message was received from. How am I using EachOtherParent wrong? I do see EachOtherParent exclude one parent. Can mSubscribers somehow contain the same process twice with different ContentParent keys?

I'm on leave, so redirecting to Andreas

Roll some unfixed bugs from Fission Milestone M4 to M5

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732

https://treeherder.mozilla.org/#/jobs?repo=try&revision=575e06cb379511909cd4aac52e2a047fb986b99f

https://hg.mozilla.org/try/pushloghtml?changeset=25b1ad9fd361d6eac931f666fb787772eff6a406

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2ce686bd53520abd4354cd420ce43f8099ac453a

This belongs to M4.1 milestone because it blocks some M-fis tests.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=932aadc930b7f37db215b8d1d75c3ed59577d7b3

(In reply to Henri Sivonen (:hsivonen) from comment #113)

I have code like this in the parent:

mozilla::ipc::IPCResult ContentParent::RecvSetFocusedBrowsingContext(
    BrowsingContext* aContext) {
  if (!aContext || aContext->IsDiscarded()) {
    MOZ_LOG(
        BrowsingContext::GetLog(), LogLevel::Debug,
        ("ParentIPC: Trying to send a message to dead or detached context"));
    return IPC_OK();
  }

  // XXX Set focused BrowserParent

  aContext->Group()->EachOtherParent(this, [&](ContentParent* aParent) {
    Unused << aParent->SendSetFocusedBrowsingContext(aContext);
  });

  return IPC_OK();
}

This ends up sending an IPC message back to the same ContentChild that the current IPC message was received from. How am I using EachOtherParent wrong? I do see EachOtherParent exclude one parent. Can mSubscribers somehow contain the same process twice with different ContentParent keys?

This is extremely fishy. One reason could be that this isn't subscribed to the group. So this isn't really the solution, but could you try calling aContext->Group()->EnsureSubscribed(this) before calling EachOtherParent?

Thanks. It seems that EachOtherParent is OK. I think what happens is this:

1. Content process C1 claims in-process BrowsingContext BC as focused.
2. The parent process starts switching processes for BC to content process C2.
3. The parent process receives the message from step 1 and distributes the message to other content processes, including C2.
4. The process switch completes from the parent process perspective.
5. Process C2 starts focusing BC, which is now in-process from its perspective.
6. C2 sends an IPC message to broadcast BC having obtained focus in C2.
7. C2 receives the message from step #3 that BC is being focused in another process (C1), but it has already become an in-process BrowsingContext for C2.

I guess the next step is to figure out what the right criterion for rejecting some messages is. I'm going to try rejecting messages that carry a BrowsingContext that's supposed to be in another process but is, in fact, in-process.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=915bf129280657be3518eb09a6b75c00d2547332

https://treeherder.mozilla.org/#/jobs?repo=try&revision=286733c754af93f105c8592fe49f224f20d09392

https://treeherder.mozilla.org/#/jobs?repo=try&revision=add0d50710b89c5de899735c74a6024a0b1ff764

https://treeherder.mozilla.org/#/jobs?repo=try&revision=00626f81dd4d6fc574bbce9c6590c64749834c62

Obtaining a BrowserParent from CanonicalBrowsingContext isn't working as I expected: bug 1585950 comment 7.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=bb32da5d1df93b2af6df6b0de1ebe670923c0f00

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5881ff7a4bcd428fa35e41bcd78c8f5dbe934aeb

https://treeherder.mozilla.org/#/jobs?repo=try&revision=265d161485afc3d0b8aff8358aa2014f3490f4c0

https://treeherder.mozilla.org/#/jobs?repo=try&revision=efeed3aa602f87f856bee52d64b347ce295566bd

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4d4a0ab623f2cebe3a45e246badf7f4fc695d443

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e834437fd7e098a8bc41627488984b3edda51f50

Current problem: Distinguishing between a top-level BrowsingContext in a content process becoming "not active" due to tab switch and a top-level BrowsingContext becoming "not active" due to being moved to another content process. I don't want to send IPC messages in the latter case so that they don't arrive late and undo the (logically same but different-process) BrowsingContext becoming "active" in the process it just moved to.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e6b6fee9ee331976b4f3a27fad28c5ee4f589929

Progress! I can now click-focus a text field in an out-of-process iframe provided that:

1. I have switched away from the browser tab and back once first and
2. I have then managed to provoke the out-of-process iframe to get painted/composited.

Next steps:

1. When an out-of-process iframe is created, propagate the current "active browsing context" to its process, since the process couldn't have received the information when the currently-active browsing context became active.
2. When a top-level browsing context becomes active after having been deactivated, make its out-of-process iframes also run enough activation steps to restart painting/compositing.

Locally, I can now focus a text field in a previously-unfocused out-of-process iframe by mouse click! (Subsequent keyboard and IME events don't go to the right place, yet.) Let's see how orange this is on try:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=d222e8d522ad6fde13c38c0ca5842fafc7b95593

Let's see if this makes the shutdown leaks go away:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=2dfafc820a2ea88aaf9a371d59eee5e5d6d3b654

Current status: The IME code doesn't like it when focus changes from one out-of-process iframe to another out-of-process iframe such that both are hosted by the same process. That is, the focus moves inside one process, but the IME connection needs to move from one BrowserChild to another BrowserChild.

Known-broken, but let's see how broken:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=d2f90f2b19ba9cc64b9333c5b897853d2b25b0b0

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5231cdc9cc42111b5c267d1c122f0834b2931171

If I have a composition open in one out-of-process iframe and I click to focus a different out-of-process iframe hosted by the same process and the previous one, the content process requests IME to commit composition. Then TextComposition::RequestToCommit runs the branch that sets the commit type to eCompositionCommitAsIs. Then ContentCacheInParent::OnCompositionEvent asserts that the type should instead be either eCompositionChange or eCompositionCommit.

The current patch queue is at https://github.com/hsivonen/gecko/tree/focusavoidstoppingstatemanagement

Masayuki, what's the significance of https://searchfox.org/mozilla-central/rev/42c2ecdc429115c32e6bcb78bf087a228a051044/widget/ContentCache.cpp#1122 ? Specifically, why isn't eCompositionCommitAsIs OK?

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b231f0fe304ef78f8918f5294a3c391eb50d65d8

(In reply to Henri Sivonen (:hsivonen) from comment #144)

Masayuki, what's the significance of https://searchfox.org/mozilla-central/rev/42c2ecdc429115c32e6bcb78bf087a228a051044/widget/ContentCache.cpp#1122 ? Specifically, why isn't eCompositionCommitAsIs OK?

Ah, because it does not assume that widget does not useeCompositionCommitAsIs in that case. If you hit the assertion, you need to create new path for it because eCompositionCommitAsIs event's mData isn't available. Probably, you need to do *mCommitStringByRequest = mCompositionString; in that case.

Builds for testing:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=29dd929aec9297b418271ed27e397796bc88bdac

Looks like this makes a bunch on known-intermittent oranges more likely to fail in Fission. I suggest we disable those tests in Fission for now.

Bug: On Ubuntu 18.04, after having used Korean input in one out-of-process iframe and then clicking to focus a different out-of-focus iframe that belongs to the same process and the previous one, the first syllable typed in the second iframe isn't shown until the second syllable starts.

(In reply to Henri Sivonen (:hsivonen) from comment #149)

Bug: On Ubuntu 18.04, after having used Korean input in one out-of-process iframe and then clicking to focus a different out-of-focus iframe that belongs to the same process and the previous one, the first syllable typed in the second iframe isn't shown until the second syllable starts.

Other than that bug, this now seems to work across Windows, Mac, and Linux across a variety of IMEs (only IBus-based ones tested on Linux). It's probably the best to leave the Ubuntu Hangul first syllable case as a follow-up, considering that the Hangul IME on Ubuntu 18.04 seems buggy in other apps in other ways.

Cleaning up some naming:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=503c39b500cfe94384baddf8ee1ca284b4c19c41

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ae6ddbd275f278c0b99b7fa425fbbfc9033eaa4f

I just tested manually with a build (though haven't tried enabling a11y tests skipped because of this yet) and this seems to be working nicely for a11y. Thanks.

(In reply to Henri Sivonen (:hsivonen) from comment #148)

Looks like this makes a bunch on known-intermittent oranges more likely to fail in Fission. I suggest we disable those tests in Fission for now.

I think this approach sounds reasonable! But I'd like to ensure :kmag and :cpeterson are on the same page as they are still tracking Fission disabled tests.

(In reply to Hsin-Yi Tsai [:hsinyi] from comment #155)

(In reply to Henri Sivonen (:hsivonen) from comment #148)

Looks like this makes a bunch on known-intermittent oranges more likely to fail in Fission. I suggest we disable those tests in Fission for now.

I think this approach sounds reasonable! But I'd like to ensure :kmag and :cpeterson are on the same page as they are still tracking Fission disabled tests.

Since this bug is blocking other a11y Fission work, I'm OK with temporarily skipping those tests in Fission so you can land this bug fix. But we are trying to fix all tests that are skipped or failing in Fission (for our Fission M4.1 milestone targeting January-February 2020), so we will need to revisit those same tests soon.

Thanks. I've requested review on this patch and will create a separate patch about disabling intermittents-turned-perma-orange.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ce1388ae146e078ba45fcf46e39cc13d4f7851aa

Yeah, I think that's find for now since this is blocking other work.

I've started to review the patch, but I also did some simple testing. It seems to work well so far when Fission is disabled. I created a simple test case with the following structure:

<html id="outer">
<iframe src="some-remote-page">
<html id="outerinput">
<input id="innerinput">
</html>
</iframe>
<input id="outerinput">
</html>

With Fission disabled, it works ok. But with Fission enabled, I need to click the inner input twice to focus it. The first click seems to focus the 'outer' html page, while the second click focuses the 'inner' html page. I can move focus between outer and inner fine.

If 'innerinput' is focused, switching to another window doesn't send a blur event nor disable the focus ring or caret.

(In reply to Neil Deakin (away Dec 12 - Dec 20) from comment #162)

I've started to review the patch, but I also did some simple testing. It seems to work well so far when Fission is disabled. I created a simple test case with the following structure:

<html id="outer">
<iframe src="some-remote-page">
<html id="outerinput">
<input id="innerinput">
</html>
</iframe>
<input id="outerinput">
</html>

With Fission disabled, it works ok. But with Fission enabled, I need to click the inner input twice to focus it.

That's weird. Is the test case online somewhere? I used a setup that looks like yours: https://hsivonen.fi/fission-host.html , and I don't see this problem.

If 'innerinput' is focused, switching to another window doesn't send a blur event nor disable the focus ring or caret.

That's indeed a bug.

That's weird. Is the test case online somewhere? I used a setup that looks like yours: https://hsivonen.fi/fission-host.html , and I don't see this problem.

It looks like it happens only when chrome is focused to begin with. I had the url or search bar focused, then need to click on the inner textbox twice.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=44aeeb604639792be5f730f1e408ece85694b7c9

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d6eb57588d448734355092b6cc0c1e7414466eec

I suspect the IME content cache might require widget-level focus management even with the puppet widget:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=49ed06590f629a63a698894f3f4888c87cb58984

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3694704855384c5c6e83ec7d42cdb38731626a52

https://treeherder.mozilla.org/#/jobs?repo=try&revision=903a8628d37a125f79fe67a6f7198795cc8ef1d9

https://treeherder.mozilla.org/#/jobs?repo=try&revision=dd4cf697eaa56a7aeadbf8fa8365bad89b2f6c0a

https://treeherder.mozilla.org/#/jobs?repo=try&revision=982bc371709f1ac94c118fc62091adf67b480e46

I'm going to mark this blocking Fission dogfooding because it seems like it could be related to the issue we see on a few sites where you can't enter information into a form.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=909a8c844c1664bed1d5f2a8adf56e379fd62200

https://treeherder.mozilla.org/#/jobs?repo=try&revision=90faaef5021eaa22cc7d5892b24b2a19e25a9a04

Sadly, it looks like

Assertion failure: !remoteHasFocus (IMEContentObserver should have been destroyed by OnFocusMovedBetweenBrowsers.), at /builds/worker/workspace/build/src/dom/events/IMEStateManager.cpp:449

seen in https://treeherder.mozilla.org/#/jobs?repo=try&selectedJob=285600258&revision=909a8c844c1664bed1d5f2a8adf56e379fd62200 is intermittent.

(In reply to Henri Sivonen (:hsivonen) from comment #176)

Sadly, it looks like

Assertion failure: !remoteHasFocus (IMEContentObserver should have been destroyed by OnFocusMovedBetweenBrowsers.), at /builds/worker/workspace/build/src/dom/events/IMEStateManager.cpp:449

seen in https://treeherder.mozilla.org/#/jobs?repo=try&selectedJob=285600258&revision=909a8c844c1664bed1d5f2a8adf56e379fd62200 is intermittent.

Not having seen what happens via a debugger, I think the most plausible explanation is that this happens when the window global of a CanonicalBrowsingContext changes but the connected BrowserParent remains the same. IMEStateManager experiences whatever caused that as something that should have cause a cross-process IME focus change.

I'll try synthesizing a focus change to chrome and back to the same BrowserParent when the window global of a CanonicalBrowsingContext changes.

Or maybe I'll just call DestroyIMEContentObserver(); in that case and see what happens. I'm a bit worried disconnecting the IME too often in case it fails to connect back. There was some of that earlier.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=8d9f0a990041e051112e3e60df3f9f05b1679b10

(In reply to Henri Sivonen (:hsivonen) from comment #178)

Or maybe I'll just call DestroyIMEContentObserver(); in that case and see what happens. I'm a bit worried disconnecting the IME too often in case it fails to connect back. There was some of that earlier.

That can't work, because the crashing process is Web content. The assertion message has been written as if the assertion was relevant only to the chrome process.

We take this branch in a content process, because there is an out-of-process iframe, so remoteHasFocus is true.

Masayuki, is it OK to skip over the assertion if we aren't in the chrome process. If not, why do we need sActiveIMEContentObserver to already having been destroyed if remoteHasFocus and what kind of mechanism should destroy it in the out-of-process iframe case?

https://treeherder.mozilla.org/#/jobs?repo=try&revision=38ff02e087eb2360c84671167746f7104fa9acfc

(In reply to Henri Sivonen (:hsivonen) from comment #180)

Masayuki, is it OK to skip over the assertion if we aren't in the chrome process. If not, why do we need sActiveIMEContentObserver to already having been destroyed if remoteHasFocus and what kind of mechanism should destroy it in the out-of-process iframe case?

If there are two or more IMEContentObserver exist, chrome process may receive outdated (i.e., blurred) content data after new editor gets focus. In non-Fission world, when aContent is a remote process's content, the running process is always chrome. Therefore, the assertion was correct. I mean that chrome process should have already destroyed its IMEContentObserver at its blur handling.

On the other hand, in Fission world, in this case, the running process and aContent's process are both content processes. Ideally, running process should've handled blur and destroyed its IMEContentObserver before aContent gets focus and creates IMEContentObserver. But I guess that if the running process is busy, its blur handling might be delayed. I.e., IMEContentObserver may keep alive even after aContent gets focus, right? If so, it's okay to use the assertion only in chrome process. However, I think that chrome process needs to reject notifications from old focused content process. Looks like that the receiver methods don't have the sender process information so that I guess it's not checked. I think that we need to do it if the assertion detects the race issue detected.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e0c9a2bcf9f91d84ce3bf2bfbe6642439ad6279f

(In reply to Masayuki Nakano [:masayuki] (he/him)(JST, +0900) from comment #182)

On the other hand, in Fission world, in this case, the running process and aContent's process are both content processes. Ideally, running process should've handled blur and destroyed its IMEContentObserver before aContent gets focus and creates IMEContentObserver. But I guess that if the running process is busy, its blur handling might be delayed. I.e., IMEContentObserver may keep alive even after aContent gets focus, right?

I'm not really sure what happens.

If so, it's okay to use the assertion only in chrome process. However, I think that chrome process needs to reject notifications from old focused content process. Looks like that the receiver methods don't have the sender process information so that I guess it's not checked. I think that we need to do it if the assertion detects the race issue detected.

Thank you. I filed bug 1612802 for this.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4c5820a5aa35aebd05dac450a949a68cdd983918

https://treeherder.mozilla.org/#/jobs?repo=try&revision=60949aeb2015e55a4e5e7bf974fae4d7e8391d4a

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e3b9ee080b515dccac547b399b15eb98c6ea9891

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d3d2005607e7807d7d1f15eb5709bb251801fc17

The bc tests fail due to the parent process trying to deserialize a non-existing BrowsingContext from IPC:
Hit MOZ_CRASH(Attempt to deserialize absent BrowsingContext) at /builds/worker/workspace/build/src/docshell/base/BrowsingContext.cpp:1510

I don't know what the exact IPC send/receive situation is. Is there some known pattern with a known fix that causes this problem?

Testing hypothesis that the crash comes from IPC WindowLowered, which may even be useless:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=ffc224c7ce6023f59453c109dc1a87ebb0a82367

Looks like it was WindowLowered IPC.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=8823680aa3ee5ca1463c0c800ca6fd1a742c687b

https://treeherder.mozilla.org/#/jobs?repo=try&revision=fd71df4026e8b57dcfc8833bf3fcb83a61c52268

https://treeherder.mozilla.org/#/jobs?repo=try&revision=208107040621cbc4b8968c669871a1e3799bbede

https://treeherder.mozilla.org/#/jobs?repo=try&revision=8890c04b7a85b5d3e8844dd519fa409fdbfbfc6b

https://treeherder.mozilla.org/#/jobs?repo=try&revision=72c431309a80ae954f4adfee93130827a15d7d2b

It's green! Let's try more test suites:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=62c65659c55cbddd6e465367a3d5b38c03c105a0

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1dcc9a82934342820055a8decc4c80143b15435b

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1eada7e0976abea516ab051a455ac28de6e7cd5b

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ee713b74224a3a5802f279e2270e5d36ab7f8f8c

Neil, would you be OK with reviewing this for the purpose of landing with known bugs (bug 1613054 and out-of-process iframes failing to deactivate when switching windows)? This patch keeps blocking other Fission work and the patch keeps rotting when other Fission work is done, so I think it would make sense to land what exists now and then pursue the known bugs as separate patches.

I can review later this week.