When determining whether or not to swap processes on navigation, check the top frame's URL.

chrome/renderer/chrome_content_renderer_client.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_content_renderer_client.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/message_loop.h"
@@ skipping 653 matching lines @@
 
 void ChromeContentRendererClient::SetExtensionDispatcher(
     ExtensionDispatcher* extension_dispatcher) {
   extension_dispatcher_.reset(extension_dispatcher);
 }
 
 bool ChromeContentRendererClient::CrossesExtensionExtents(WebFrame* frame,
                                                           const GURL& new_url) {
   const ExtensionSet* extensions = extension_dispatcher_->extensions();
   // If the URL is still empty, this is a window.open navigation. Check the
-  // opener's URL.
+  // opener's URL. In all cases we use the top frame's URL (as opposed to our
+  // frame's) since that's what determines the type of process.
   // TODO(abarth): This code is super sketchy! Are you sure looking at the
   // opener is correct here?  This appears to let me steal my opener's
   // privileges if I can make my URL be "empty."
-  GURL old_url(frame->document().url());
+  GURL old_url(frame->top()->document().url());
   if (old_url.is_empty() && frame->opener())
-    old_url = frame->opener()->document().url();
+    old_url = frame->top()->opener()->top()->document().url();
 
   // If this is a reload, check whether it has the wrong process type.  We
   // should send it to the browser if it's an extension URL (e.g., hosted app)
   // in a normal process, or if it's a process for an extension that has been
   // uninstalled.
   if (old_url == new_url) {
     bool is_extension_url = !!extensions->GetByURL(new_url);
     if (is_extension_url != extension_dispatcher_->is_extension_process())
       return true;
   }
 
   return !extensions->InSameExtent(old_url, new_url);
 }
 
 void ChromeContentRendererClient::OnPurgeMemory() {
   DVLOG(1) << "Resetting spellcheck in renderer client";
   RenderThread* thread = RenderThread::current();
   if (spellcheck_.get())
     thread->RemoveObserver(spellcheck_.get());
   SpellCheck* new_spellcheck = new SpellCheck();
   if (spellcheck_provider_)
     spellcheck_provider_->SetSpellCheck(new_spellcheck);
   spellcheck_.reset(new_spellcheck);
   thread->AddObserver(new_spellcheck);
 }
 
 }  // namespace chrome