Add an extra check in NavigateRemoteFrameToBlankAndDataURLs.

content/browser/site_per_process_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_per_process_browsertest.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 1271 matching lines @@
   EXPECT_EQ(
       " Site A\n"
       "   |--Site A\n"
       "   +--Site A\n"
       "        +--Site A\n"
       "Where A = http://a.com/",
       DepictFrameTree(root));
 
   // Load cross-site page into iframe.
   GURL url = embedded_test_server()->GetURL("foo.com", "/title2.html");
-  NavigateFrameToURL(root->child_at(0), url);
+  NavigateFrameToURL(child, url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(url, observer.last_navigation_url());
   EXPECT_EQ(
       " Site A ------------ proxies for B\n"
       "   |--Site B ------- proxies for A\n"
       "   +--Site A ------- proxies for B\n"
       "        +--Site A -- proxies for B\n"
       "Where A = http://a.com/\n"
       "      B = http://foo.com/",
       DepictFrameTree(root));
@@ skipping 10 matching lines @@
   EXPECT_EQ(
       " Site A\n"
       "   |--Site A\n"
       "   +--Site A\n"
       "        +--Site A\n"
       "Where A = http://a.com/",
       DepictFrameTree(root));
 
   // Load cross-site page into iframe.
   url = embedded_test_server()->GetURL("bar.com", "/title2.html");
-  NavigateFrameToURL(root->child_at(0), url);
+  NavigateFrameToURL(child, url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(url, observer.last_navigation_url());
   EXPECT_EQ(
       " Site A ------------ proxies for C\n"
       "   |--Site C ------- proxies for A\n"
       "   +--Site A ------- proxies for C\n"
       "        +--Site A -- proxies for C\n"
       "Where A = http://a.com/\n"
       "      C = http://bar.com/",
       DepictFrameTree(root));
 
   // Navigate iframe to about:blank. The navigation happens from a script in the
   // parent frame, so it should be committed in the same SiteInstance as the
   // parent frame.
   GURL about_blank_url("about:blank");
   NavigateIframeToURL(shell()->web_contents(), "child-0", about_blank_url);
   EXPECT_TRUE(observer.last_navigation_succeeded());
   EXPECT_EQ(about_blank_url, observer.last_navigation_url());
 
   // Ensure that we have navigated using the top level process.
   EXPECT_EQ(
       " Site A\n"
       "   |--Site A\n"
       "   +--Site A\n"
       "        +--Site A\n"
       "Where A = http://a.com/",
       DepictFrameTree(root));
+
+  // Load cross-site page into iframe again.
+  url = embedded_test_server()->GetURL("f00.com", "/title3.html");
+  NavigateFrameToURL(child, url);
+  EXPECT_TRUE(observer.last_navigation_succeeded());
+  EXPECT_EQ(url, observer.last_navigation_url());
+  EXPECT_EQ(
+      " Site A ------------ proxies for D\n"
+      "   |--Site D ------- proxies for A\n"
+      "   +--Site A ------- proxies for D\n"
+      "        +--Site A -- proxies for D\n"
+      "Where A = http://a.com/\n"
+      "      D = http://f00.com/",
+      DepictFrameTree(root));
+
+  // Navigate the iframe itself to about:blank using a script executing in its
+  // own context. It should stay in the same SiteInstance as before, not the
+  // parent one.
+  std::string script(
+      "window.domAutomationController.send("
+      "window.location.href = 'about:blank');");
+  TestFrameNavigationObserver frame_observer(child);
+  EXPECT_TRUE(ExecuteScript(child->current_frame_host(), script));
+  frame_observer.Wait();
+  EXPECT_EQ(about_blank_url, child->current_url());
+
+  // Ensure that we have navigated using the top level process.
+  EXPECT_EQ(
+      " Site A ------------ proxies for D\n"
+      "   |--Site D ------- proxies for A\n"
+      "   +--Site A ------- proxies for D\n"
+      "        +--Site A -- proxies for D\n"
+      "Where A = http://a.com/\n"
+      "      D = http://f00.com/",
+      DepictFrameTree(root));

[ncarter (slow), 2016/04/26 18:40:27]

lgtm

If you are working on improving the resolution of "about:blank", I think you may
wish to take a look at DISABLED_NavigateGrandchildToAboutBlank, in
FrameTreeBrowserTest. That's a case where we do ostensibly the wrong thing, see
the bug it mentions for details.

 }
 
 // This test checks that killing a renderer process of a remote frame
 // and then navigating some other frame to the same SiteInstance of the killed
 // process works properly.
 // This can be illustrated as follows,
 // where 1/2/3 are FrameTreeNode-s and A/B are processes and B* is the killed
 // B process:
 //
 //     1        A                  A                           A
@@ skipping 4726 matching lines @@
   EXPECT_EQ(b_url, root->current_url());
 
   // Verify that the same RenderViewHost is preserved and that it is no longer
   // in swapped out state.
   EXPECT_EQ(rvh, contents->GetFrameTree()->GetRenderViewHost(
                      root->current_frame_host()->GetSiteInstance()));
   EXPECT_FALSE(rvh->is_swapped_out_);
 }
 
 }  // namespace content