OOPIF: Fix remote frame navigations from extension pages.

content/browser/frame_host/navigator_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigator_impl.h"
 
 #include <utility>
 
 #include "base/metrics/histogram.h"
 #include "base/time/time.h"
@@ skipping 575 matching lines @@
                                    const Referrer& referrer,
                                    WindowOpenDisposition disposition,
                                    bool should_replace_current_entry,
                                    bool user_gesture) {
   // This call only makes sense for subframes if OOPIFs are possible.
   DCHECK(!render_frame_host->GetParent() ||
          SiteIsolationPolicy::AreCrossProcessFramesPossible());
 
   // If this came from a swapped out RenderFrameHost, we only allow the request
   // if we are still in the same BrowsingInstance.
-  // TODO(creis): Move this to RenderFrameProxyHost::OpenURL.

[alexmos, 2016/02/20 02:42:47]

I'm assuming this check will have to stay in addition to the one I added in
RFPH::OnOpenURL until we are ready to rip out swapped out everywhere?

[Charlie Reis, 2016/02/21 05:47:23]

Sure, we can remove it when Nasko removes the rest of swapped out.

   SiteInstance* current_site_instance = render_frame_host->frame_tree_node()
                                             ->current_frame_host()
                                             ->GetSiteInstance();
   if (render_frame_host->is_swapped_out() &&
       !render_frame_host->GetSiteInstance()->IsRelatedSiteInstance(
           current_site_instance)) {
     return;
   }
 
   // TODO(creis): Pass the redirect_chain into this method to support client
@@ skipping 45 matching lines @@
     params.is_renderer_initiated = false;
   }
 
   if (delegate_)
     delegate_->RequestOpenURL(render_frame_host, params);
 }
 
 void NavigatorImpl::RequestTransferURL(
     RenderFrameHostImpl* render_frame_host,
     const GURL& url,
+    SiteInstance* source_site_instance,
     const std::vector<GURL>& redirect_chain,
     const Referrer& referrer,
     ui::PageTransition page_transition,
     const GlobalRequestID& transferred_global_request_id,
     bool should_replace_current_entry) {
   // This call only makes sense for subframes if OOPIFs are possible.
   DCHECK(!render_frame_host->GetParent() ||
          SiteIsolationPolicy::AreCrossProcessFramesPossible());
 
   // Allow the delegate to cancel the transfer.
@@ skipping 24 matching lines @@
     // want web sites to see a referrer of "chrome://blah" (and some
     // chrome: URLs might have search terms or other stuff we don't want to
     // send to the site), so we send no referrer.
     referrer_to_use = Referrer();
 
     // Navigations in Web UI pages count as browser-initiated navigations.
     is_renderer_initiated = false;
   }
 
   NavigationController::LoadURLParams load_url_params(dest_url);
-  // The source_site_instance only matters for navigations via RenderFrameProxy,
-  // which go through RequestOpenURL.
-  load_url_params.source_site_instance = nullptr;
+  // The source_site_instance may matter for navigations via RenderFrameProxy.
+  load_url_params.source_site_instance = source_site_instance;
   load_url_params.transition_type = page_transition;
   load_url_params.frame_tree_node_id = node->frame_tree_node_id();
   load_url_params.referrer = referrer_to_use;
   load_url_params.redirect_chain = redirect_chain;
   load_url_params.is_renderer_initiated = is_renderer_initiated;
   load_url_params.transferred_global_request_id = transferred_global_request_id;
   load_url_params.should_replace_current_entry = should_replace_current_entry;
 
   controller_->LoadURLWithParams(load_url_params);
 }
@@ skipping 319 matching lines @@
       entry->set_should_replace_entry(pending_entry->should_replace_entry());
       entry->SetRedirectChain(pending_entry->GetRedirectChain());
     }
     controller_->SetPendingEntry(std::move(entry));
     if (delegate_)
       delegate_->NotifyChangedNavigationState(content::INVALIDATE_TYPE_URL);
   }
 }
 
 }  // namespace content