Prerendered tabs use the same SessionStorage namespace as the tab that triggered the prerender.

chrome/browser/prerender/prerender_manager.cc

Index: chrome/browser/prerender/prerender_manager.cc
diff --git a/chrome/browser/prerender/prerender_manager.cc b/chrome/browser/prerender/prerender_manager.cc
index f7264ce95a23aa439a2cc25792e3329bc679cdf8..3f9ddd1d6010575fa0b19d8f4fdb72aa31a70452 100644
--- a/chrome/browser/prerender/prerender_manager.cc
+++ b/chrome/browser/prerender/prerender_manager.cc
@@ -35,6 +35,7 @@
 #include "content/browser/browser_thread.h"
 #include "content/browser/cancelable_request.h"
 #include "content/browser/debugger/render_view_devtools_agent_host.h"
+#include "content/browser/in_process_webkit/session_storage_namespace.h"
 #include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/renderer_host/resource_dispatcher_host.h"
@@ -272,10 +273,13 @@ bool PrerenderManager::AddPrerenderFromLinkRelPrerender(int process_id,
                                                            route_id);
 
   return AddPrerender(ORIGIN_LINK_REL_PRERENDER, child_route_id_pair,
-                      url, referrer);
+                      url, referrer, NULL);
 }
 
-bool PrerenderManager::AddPrerenderFromOmnibox(const GURL& url) {
+bool PrerenderManager::AddPrerenderFromOmnibox(
+    const GURL& url,
+    SessionStorageNamespace* session_storage_namespace) {
+  DCHECK(session_storage_namespace);
   if (!IsOmniboxEnabled(profile_))
     return false;
 
@@ -294,14 +298,16 @@ bool PrerenderManager::AddPrerenderFromOmnibox(const GURL& url) {
       break;
   };
 
-  return AddPrerender(origin, std::make_pair(-1, -1), url, GURL());
+  return AddPrerender(origin, std::make_pair(-1, -1), url, GURL(),
+                      session_storage_namespace);
 }
 
 bool PrerenderManager::AddPrerender(
     Origin origin,
     const std::pair<int, int>& child_route_id_pair,
     const GURL& url_arg,
-    const GURL& referrer) {
+    const GURL& referrer,
+    SessionStorageNamespace* session_storage_namespace) {
   DCHECK(CalledOnValidThread());
 
   if (origin == ORIGIN_LINK_REL_PRERENDER && IsGoogleSearchResultURL(referrer))
@@ -356,7 +362,6 @@ bool PrerenderManager::AddPrerender(
   }
 
   RenderViewHost* source_render_view_host = NULL;
-  // This test should fail only during unit tests.
   if (child_route_id_pair.first != -1) {
     source_render_view_host =
         RenderViewHost::FromID(child_route_id_pair.first,
@@ -370,8 +375,14 @@ bool PrerenderManager::AddPrerender(
     }
   }
 
-  PrerenderContents* prerender_contents =
-      CreatePrerenderContents(url, referrer, origin, experiment);
+  if (!session_storage_namespace) {
+    DCHECK(source_render_view_host);
+    session_storage_namespace =
+      source_render_view_host->session_storage_namespace();
+  }
+
+  PrerenderContents* prerender_contents = CreatePrerenderContents(
+    session_storage_namespace, url, referrer, origin, experiment);
   if (!prerender_contents || !prerender_contents->Init())
     return false;
 
@@ -535,6 +546,20 @@ bool PrerenderManager::MaybeUsePrerenderedPage(TabContents* tab_contents,
     return false;
   }
 
+  // If the sessionStorage namespaces don't match, don't swap the site in.
+  // Note that we don't actually need to destroy here.
+  RenderViewHost* old_render_view_host = tab_contents->render_view_host();
+  RenderViewHost* new_render_view_host =
+    prerender_contents->prerender_contents()->render_view_host();
+  DCHECK(old_render_view_host);
+  DCHECK(new_render_view_host);
+  if (old_render_view_host->session_storage_namespace()->id() !=
+      new_render_view_host->session_storage_namespace()->id()) {
+    prerender_contents.release()->Destroy(
+      FINAL_STATUS_SESSION_STORAGE_NAMESPACE_MISMATCH);
+    return false;
+  }
+
   int child_id, route_id;
   CHECK(prerender_contents->GetChildId(&child_id));
   CHECK(prerender_contents->GetRouteId(&route_id));
@@ -554,11 +579,8 @@ bool PrerenderManager::MaybeUsePrerenderedPage(TabContents* tab_contents,
   histograms_->RecordPerSessionCount(++prerenders_per_session_count_);
   prerender_contents->set_final_status(FINAL_STATUS_USED);
 
-  RenderViewHost* render_view_host =
-      prerender_contents->prerender_contents()->render_view_host();
-  DCHECK(render_view_host);
-  render_view_host->Send(
-      new ChromeViewMsg_SetIsPrerendering(render_view_host->routing_id(),
+  new_render_view_host->Send(
+      new ChromeViewMsg_SetIsPrerendering(new_render_view_host->routing_id(),
                                           false));
 
   TabContentsWrapper* new_tab_contents =
@@ -648,13 +670,15 @@ bool PrerenderManager::IsPrerenderElementFresh(const base::Time start) const {
 }
 
 PrerenderContents* PrerenderManager::CreatePrerenderContents(
+    SessionStorageNamespace* session_storage_namespace,
     const GURL& url,
     const GURL& referrer,
     Origin origin,
     uint8 experiment_id) {
   DCHECK(CalledOnValidThread());
   return prerender_contents_factory_->CreatePrerenderContents(
-      this, prerender_tracker_, profile_, url, referrer, origin, experiment_id);
+      this, prerender_tracker_, session_storage_namespace, profile_, url,
+      referrer, origin, experiment_id);
 }
 
 bool PrerenderManager::IsPendingDelete(PrerenderContents* entry) const {