Use top frame's origin when checking content settings for plugins.

chrome/browser/chrome_site_per_process_browsertest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/strings/stringprintf.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
@@ skipping 79 matching lines @@
   EXPECT_TRUE(ExecuteScriptAndExtractBool(
       frame_host,
       "window.domAutomationController.send(!!openDatabase("
       "'foodb', '1.0', 'Test DB', 1024));",
       &is_object_created));
   EXPECT_TRUE(is_object_created);
   EXPECT_TRUE(ExecuteScript(frame_host,
                             "window.webkitRequestFileSystem("
                             "window.TEMPORARY, 1024, function() {});"));
 }
+
+// Ensure that creating a plugin in a cross-site subframe doesn't crash.  This
+// involves querying content settings from the renderer process and using the
+// top frame's origin as one of the parameters.  See https://crbug.com/426658.
+IN_PROC_BROWSER_TEST_F(ChromeSitePerProcessTest, PluginWithRemoteTopFrame) {
+  GURL main_url(embedded_test_server()->GetURL("a.com", "/iframe.html"));
+  ui_test_utils::NavigateToURL(browser(), main_url);
+
+  // Navigate subframe to a page with a Flash object.
+  content::WebContents* active_web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  GURL frame_url =
+      embedded_test_server()->GetURL("b.com", "/flash_object.html");
+  content::DOMMessageQueue msg_queue;
+  EXPECT_TRUE(NavigateIframeToURL(active_web_contents, "test", frame_url));
+
+  // Ensure the page finishes loading without crashing.
+  std::string status;
+  while (msg_queue.WaitForMessage(&status)) {
+    if (status == "\"DONE\"")
+      break;
+  }
+}