Use top frame's origin when checking content settings for plugins.

chrome/browser/chrome_site_per_process_browsertest.cc

Index: chrome/browser/chrome_site_per_process_browsertest.cc
diff --git a/chrome/browser/chrome_site_per_process_browsertest.cc b/chrome/browser/chrome_site_per_process_browsertest.cc
index de2a9879a485ea0a6587b774a4065fce4bc0adb2..58a3ecbdec07fa38ad3e59317828db2e7e86cdae 100644
--- a/chrome/browser/chrome_site_per_process_browsertest.cc
+++ b/chrome/browser/chrome_site_per_process_browsertest.cc
@@ -97,3 +97,25 @@ IN_PROC_BROWSER_TEST_F(ChromeSitePerProcessTest,
                             "window.webkitRequestFileSystem("
                             "window.TEMPORARY, 1024, function() {});"));
 }
+
+// Ensure that creating a plugin in a cross-site subframe doesn't crash.  This
+// involves querying content settings from the renderer process and using the
+// top frame's origin as one of the parameters.  See https://crbug.com/426658.
+IN_PROC_BROWSER_TEST_F(ChromeSitePerProcessTest, PluginWithRemoteTopFrame) {
+  GURL main_url(embedded_test_server()->GetURL("a.com", "/iframe.html"));
+  ui_test_utils::NavigateToURL(browser(), main_url);
+
+  // Navigate subframe to a page with a Flash object.
+  content::WebContents* active_web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  GURL frame_url = embedded_test_server()->GetURL("b.com", "/object.html");

[nasko, 2015/08/20 20:44:23]

nit: flash_object.html, as object.html is a bit too generic and can be of other
types.

[alexmos, 2015/08/20 21:23:44]

Done.

+  content::DOMMessageQueue msg_queue;
+  EXPECT_TRUE(NavigateIframeToURL(active_web_contents, "test", frame_url));
+
+  // Ensure the page finishes loading without crashing.
+  std::string status;
+  while (msg_queue.WaitForMessage(&status)) {
+    if (status == "\"DONE\"")
+      break;
+  }
+}