Validate params.origin in the browser process at commit time.

content/browser/frame_host/render_frame_host_impl.h

Index: content/browser/frame_host/render_frame_host_impl.h
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index bf8bac3e2558069d78174ae44fcec164baed616f..892ab4bb6e5e0341c5f3eb854f2c107e0e18629f 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -677,6 +677,12 @@ class CONTENT_EXPORT RenderFrameHostImpl : public RenderFrameHost,
   // it will be used to kill processes that commit unauthorized URLs.
   bool CanCommitURL(const GURL& url);
 
+  // Returns whether the given origin is allowed to commit in the current
+  // RenderFrameHost. This is a more conservative check than
+  // RenderProcessHost::FilterURL, since it will be used to kill processes that
+  // commit unauthorized origins.
+  bool CanCommitOrigin(const GURL& url, const url::Origin& origin);

[Charlie Reis, 2016/03/10 22:28:02]

nit: Reverse order (since |origin| is the main thing we care about) and explain
why |url| is needed as well in the comment.  (Something about making sure they
match?)

[nasko, 2016/03/11 00:19:37]

Done.

+
   // Asserts that the given RenderFrameHostImpl is part of the same browser
   // context (and crashes if not), then returns whether the given frame is
   // part of the same site instance.