Use the request's URL rather than the document's when deciding to swap.

content/renderer/render_view.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
@@ skipping 2074 matching lines @@
       IsNonLocalTopLevelNavigation(url, frame, type)) {
     GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
     // Reset these counters as the RenderView could be reused for the next
     // navigation.
     page_id_ = -1;
     last_page_id_sent_to_browser_ = -1;
     OpenURL(url, referrer, default_policy);
     return WebKit::WebNavigationPolicyIgnore;  // Suppress the load here.
   }
 
-  GURL old_url(frame->document().url());
-
   // Detect when we're crossing a permission-based boundary (e.g. into or out of
   // an extension or app origin, leaving a WebUI page, etc). We only care about
   // top-level navigations within the current tab (as opposed to, for example,
   // opening a new window). But we sometimes navigate to about:blank to clear a
   // tab, and we want to still allow that.
   //
   // Note: we do this only for GET requests because our mechanism for switching
   // processes only issues GET requests. In particular, POST requests don't
   // work, because this mechanism does not preserve form POST data. If it
   // becomes necessary to support process switching for POST requests, we will
@@ skipping 25 matching lines @@
           &send_referrer);
     }
 
     if (should_fork) {
       GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
       OpenURL(url, send_referrer ? referrer : GURL(), default_policy);
       return WebKit::WebNavigationPolicyIgnore;  // Suppress the load here.
     }
   }
 
+  // Use the frame's original request's URL rather than the document's URL for
+  // this check.  For a popup, the document's URL may become the opener window's
+  // URL if the opener has called document.write.  See http://crbug.com/93517.
+  GURL old_url(frame->dataSource()->request().url());
+
   // Detect when a page is "forking" a new tab that can be safely rendered in
   // its own process.  This is done by sites like Gmail that try to open links
   // in new windows without script connections back to the original page.  We
   // treat such cases as browser navigations (in which we will create a new
   // renderer for a cross-site navigation), rather than WebKit navigations.
   //
   // We use the following heuristic to decide whether to fork a new page in its
   // own process:
   // The parent page must open a new tab to about:blank, set the new tab's
   // window.opener to null, and then redirect the tab to a cross-site URL using
@@ skipping 2430 matching lines @@
 }
 
 void RenderView::OnEnableViewSourceMode() {
   if (!webview())
     return;
   WebFrame* main_frame = webview()->mainFrame();
   if (!main_frame)
     return;
   main_frame->enableViewSourceMode(true);
 }