Validate params.origin in the browser process at commit time.

content/browser/frame_host/render_frame_host_manager_unittest.cc

Index: content/browser/frame_host/render_frame_host_manager_unittest.cc
diff --git a/content/browser/frame_host/render_frame_host_manager_unittest.cc b/content/browser/frame_host/render_frame_host_manager_unittest.cc
index 0cea53190f852a49788f6fb82474127f0d0e6ec6..ed018fe78959316c049a624c77b1c9efe66217c7 100644
--- a/content/browser/frame_host/render_frame_host_manager_unittest.cc
+++ b/content/browser/frame_host/render_frame_host_manager_unittest.cc
@@ -2972,6 +2972,68 @@ TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithTwoWebUIs2) {
   BaseSimultaneousNavigationWithTwoWebUIs(commit_new_frame_host);
 }
 
+TEST_F(RenderFrameHostManagerTest, CanCommitOrigin) {
+  const GURL kUrl("http://a.com/");
+  const GURL kUrlBar("http://a.com/bar");
+
+  NavigateActiveAndCommit(kUrl);
+
+  controller().LoadURL(
+      kUrlBar, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());

[Charlie Reis, 2016/03/10 22:28:02]

Maybe this should be inside the loop with test_case.url?  (To the extent it
matters, I don't think we're aiming to test CanCommitURL kills here.)

[nasko, 2016/03/11 00:19:37]

I didn't do it purposefully. If I move it in the loop, starting a navigation for
each test case causes cross-process navigations for some cases, which means I
need to add some complexity in checking whether there is a pending RFH and using
its process to count the bad_msg_count().

[Charlie Reis, 2016/03/11 00:28:58]

Acknowledged.

+
+  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  params.page_id = 0;
+  params.nav_entry_id = 0;
+  params.did_create_new_entry = false;
+  params.transition = ui::PAGE_TRANSITION_LINK;
+  params.should_update_history = false;
+  params.gesture = NavigationGestureAuto;
+  params.was_within_same_page = false;
+  params.is_post = false;
+  params.page_state = PageState::CreateFromURL(kUrlBar);
+
+  struct TestCase {
+    const char* const url;
+    const char* const origin;
+    bool mismatch;
+  } cases[] = {
+    // Positive case where the two match.
+    { "http://a.com/", "http://a.com", false },

[Charlie Reis, 2016/03/10 22:28:02]

Maybe add something to the path of the |url|?

[nasko, 2016/03/11 00:19:38]

Done.

+
+    // Host mismatches.
+    { "http://a.com/", "http://b.com", true },
+    { "http://b.com/", "http://a.com", true },
+
+    // Scheme mismatches.
+    { "file://", "http://a.com", true },
+    { "https://a.com/", "http://a.com", true },
+
+    // about:blank.

[Charlie Reis, 2016/03/10 22:28:02]

Let's add a comment about why this isn't a kill (which is the right behavior).

[nasko, 2016/03/11 00:19:38]

Done.

+    { "about:blank", "http://a.com", false },

[Charlie Reis, 2016/03/10 22:28:02]

Can we add a test to ensure that "about:blank" + "chrome://settings" results in
a kill?

[nasko, 2016/03/11 00:19:38]

I don't think we have enough support for this kill quite yet. Probably will be
added as we add support for checking WebUI bindings.

[Charlie Reis, 2016/03/11 00:28:58]

Acknowledged.

+
+    // Unique origin.
+    { "http://a.com", "null", false },
+  };
+
+  for (const auto& test_case : cases) {
+    params.url = GURL(test_case.url);
+    params.origin = url::Origin(GURL(test_case.origin));
+
+    int expected_bad_msg_count = process()->bad_msg_count();;

[Charlie Reis, 2016/03/10 22:28:02]

nit: Remove extra semicolon.

[nasko, 2016/03/11 00:19:38]

Done.

+    if (test_case.mismatch)
+      expected_bad_msg_count++;
+
+    FrameHostMsg_DidCommitProvisionalLoad msg(
+        main_test_rfh()->routing_id(), params);
+    main_test_rfh()->OnMessageReceived(msg);

[Charlie Reis, 2016/03/10 22:28:02]

Maybe use SendNavigateWithParams, as you suggested to me?  It looks like we may
also want to call PrepareForCommit first.  (I'm not 100% sure, but that was
introduced for PlzNavigate.)

[nasko, 2016/03/11 00:19:37]

Done.

+
+    EXPECT_EQ(expected_bad_msg_count, process()->bad_msg_count())
+      << " url:" << test_case.url
+      << " origin:" << test_case.origin
+      << " mismatch:" << test_case.mismatch;
+  }
+}
+
 // RenderFrameHostManagerTest extension for PlzNavigate enabled tests.
 class RenderFrameHostManagerTestWithBrowserSideNavigation
     : public RenderFrameHostManagerTest {