Correctly sets the security origin for the IME window.

chrome/browser/ui/ime/ime_window.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/ime/ime_window.h"
 
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/ime/ime_native_window.h"
 #include "chrome/browser/ui/ime/ime_window_observer.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/manifest_handlers/icons_handler.h"
 #include "ui/gfx/image/image.h"
 #include "ui/gfx/screen.h"
 
 namespace {
 
 // The vertical margin between the cursor and the follow-cursor window.
 const int kFollowCursorMargin = 3;
 
 }  // namespace
 
 namespace ui {
 
 ImeWindow::ImeWindow(Profile* profile,
                      const extensions::Extension* extension,
+                     content::RenderFrameHost* opener_render_frame_host,
                      const std::string& url,
                      Mode mode,
                      const gfx::Rect& bounds)
     : mode_(mode), native_window_(nullptr) {
   if (extension) {  // Allow nullable |extension| for testability.
     title_ = extension->name();
     icon_.reset(new extensions::IconImage(
         profile, extension, extensions::IconsInfo::GetIcons(extension),
         extension_misc::EXTENSION_ICON_SMALL, gfx::ImageSkia(), this));
   }
 
   registrar_.Add(this, chrome::NOTIFICATION_APP_TERMINATING,
                  content::NotificationService::AllSources());
 
   GURL gurl(url);
   if (!gurl.is_valid())
     gurl = extension->GetResourceURL(url);
 
-  content::SiteInstance* instance =
-      content::SiteInstance::CreateForURL(profile, gurl);
-  content::WebContents::CreateParams create_params(profile, instance);
+  content::SiteInstance* site_instance = opener_render_frame_host
+      ? opener_render_frame_host->GetSiteInstance() : nullptr;
+  if (!site_instance ||
+      site_instance->GetSiteURL().GetOrigin() != gurl.GetOrigin()) {
+    site_instance = content::SiteInstance::CreateForURL(profile, gurl);
+  }
+  content::WebContents::CreateParams create_params(profile, site_instance);
+  if (opener_render_frame_host) {
+    create_params.opener_render_process_id =
+        opener_render_frame_host->GetProcess()->GetID();
+    create_params.opener_render_frame_id =
+        opener_render_frame_host->GetRoutingID();
+  }
   web_contents_.reset(content::WebContents::Create(create_params));
   web_contents_->SetDelegate(this);
   content::OpenURLParams params(gurl, content::Referrer(), SINGLETON_TAB,
                                 ui::PAGE_TRANSITION_LINK, false);
   web_contents_->OpenURL(params);
 
   native_window_ = CreateNativeWindow(this, bounds, web_contents_.get());
 }
 
 void ImeWindow::Show() {
@@ skipping 95 matching lines @@
                                  const gfx::Rect& pos) {
   if (native_window_)
     native_window_->SetBounds(pos);
 }
 
 bool ImeWindow::IsPopupOrPanel(const content::WebContents* source) const {
   return true;
 }
 
 }  // namespace ui