Renderer initiated navigations from non instant process should not fall into instant.

content/public/browser/content_browser_client.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_
 #define CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_
 
 #include <map>
 #include <string>
 #include <utility>
@@ skipping 124 matching lines @@
                                        WebContents* embedder_web_contents) {}
 
   // Notifies that a RenderProcessHost has been created. This is called before
   // the content layer adds its own BrowserMessageFilters, so that the
   // embedder's IPC filters have priority.
   virtual void RenderProcessHostCreated(RenderProcessHost* host) {}
 
   // Notifies that a BrowserChildProcessHost has been created.
   virtual void BrowserChildProcessHostCreated(BrowserChildProcessHost* host) {}
 
+  // Returns a privileged site version of the given URL if allowed. When
+  // transitioning across SiteInstances during navigation, the "site" of the
+  // SiteInstance may be determine by navigation properties such as
+  // "is_renderer_initiated" etc. Since SiteInstance does not take into account
+  // such factors, this calls allows clients to rewrite the URL so that their
+  // sites embedd this info.

[Charlie Reis, 2013/05/01 01:17:54]

This comment is the most important thing to get right, because it's introducing
a new concept: a privileged site.  We don't have this notion defined anywhere
else yet.  How about this?

Determines whether a navigation from |current_instance| to |url| would be a
valid entry point to a "privileged site," based on whether it
|is_renderer_initiated|.  A privileged site requires careful process isolation
to ensure its privileges do not leak, and it can only be entered via known
paths.

If this is a valid entry to a privileged site, this function should rewrite the
origin of |url| with a non-http(s) origin that represents the privileged site. 
This will distinguish the resulting SiteInstance from other SiteInstances in the
process model.

[Shishir, 2013/05/01 07:56:14]

Done.

+  virtual GURL GetPossiblyPrivilegedURL(
+      content::BrowserContext* browser_context,
+      const GURL& url,
+      bool is_renderer_initiated,
+      SiteInstance* curr_instance);

[Charlie Reis, 2013/05/01 01:17:54]

nit: current_instance

(Since this is a public API, we may as well spell it out everywhere.  Sorry for
my earlier abbreviation.)

[Shishir, 2013/05/01 07:56:14]

Done.

+
   // Get the effective URL for the given actual URL, to allow an embedder to
   // group different url schemes in the same SiteInstance.
   virtual GURL GetEffectiveURL(BrowserContext* browser_context,
                                const GURL& url);
 
   // Returns whether all instances of the specified effective URL should be
   // rendered by the same process, rather than using process-per-site-instance.
   virtual bool ShouldUseProcessPerSite(BrowserContext* browser_context,
                                        const GURL& effective_url);
 
@@ skipping 377 matching lines @@
   // This is called on a worker thread.
   virtual
       crypto::CryptoModuleBlockingPasswordDelegate* GetCryptoPasswordDelegate(
           const GURL& url);
 #endif
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_