Ensure in RFH the DidFailProvisionalLoad IPCs correspond to a navigation

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index b83ef55f132998aa450cd309187928f99976c3a7..243a81ae0c857b8a2fdcb45218eb02a90bf315e6 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -897,10 +897,30 @@ void RenderFrameHostImpl::OnDidStartProvisionalLoad(
 
 void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
     const FrameHostMsg_DidFailProvisionalLoadWithError_Params& params) {
-  if (!IsBrowserSideNavigationEnabled() && navigation_handle_) {
+  if (!navigation_handle_) {
+    bad_message::ReceivedBadMessage(
+        GetProcess(), bad_message::RFH_FAIL_PROVISIONAL_LOAD_NO_HANDLE);
+    return;

[Charlie Reis, 2016/04/13 17:16:26]

Sanity check: We did still call navigator()->DidFailProvisionalLoadWithError
when there was no handle before, and that has sensitive logic for avoiding URL
spoofs.  I think we're still safe from URL spoofs after your change, since the
renderer will be killed.

Still, let's be sure to check the histograms for whether this case happens in
practice.  :)  I wouldn't be surprised if a race makes it possible (e.g.,
something in the browser process cancels the navigation while a DidFail IPC is
in flight).  We wouldn't want a legitimate race to kill the renderer.

+  }
+
+  if (IsBrowserSideNavigationEnabled() &&
+      navigation_handle_->GetNetErrorCode() == net::OK) {
+    // The renderer should not be sending this message unless asked to commit
+    // an error page.
+    // TODO(clamy): Stop sending DidFailProvisionalLoad IPCs at all when enough
+    // observers have moved to DidFinishNavigation.
+    bad_message::ReceivedBadMessage(
+        GetProcess(), bad_message::RFH_FAIL_PROVISIONAL_LOAD_NO_ERROR);
+    return;
+  }
+
+  // Update the error code in the NavigationHandle of the navigation.
+  // PlzNavigate: this has already done in NavigationRequest::OnRequestFailed.

[Charlie Reis, 2016/04/13 17:16:26]

nit: has already been done

+  if (!IsBrowserSideNavigationEnabled()) {
     navigation_handle_->set_net_error_code(
         static_cast<net::Error>(params.error_code));
   }
+
   frame_tree_node_->navigator()->DidFailProvisionalLoadWithError(this, params);
 }