Add a test for iframe srcdoc origin.

content/browser/frame_host/frame_tree_browsertest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/macros.h"
 #include "build/build_config.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ skipping 432 matching lines @@
   EXPECT_EQ(target->current_origin().Serialize(), about_blank_origin);
 
   std::string document_body;
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       target->current_frame_host(),
       "domAutomationController.send(document.body.innerHTML);",
       &document_body));
   EXPECT_EQ("Hi from a.com", document_body);
 }
 
+// Ensures that iframe with srcdoc is always put in the same origin as its
+// parent frame.
+IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, ChildFrameWithSrcdoc) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  WebContentsImpl* contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  FrameTreeNode* root = contents->GetFrameTree()->root();
+  EXPECT_EQ(1U, root->child_count());
+
+  FrameTreeNode* child = root->child_at(0);
+  std::string frame_origin;
+  EXPECT_TRUE(ExecuteScriptAndExtractString(
+      child->current_frame_host(),
+      "domAutomationController.send(document.origin);", &frame_origin));
+  EXPECT_TRUE(
+      child->current_frame_host()->GetLastCommittedOrigin().IsSameOriginWith(
+          url::Origin(GURL(frame_origin))));
+  EXPECT_FALSE(
+      root->current_frame_host()->GetLastCommittedOrigin().IsSameOriginWith(
+          url::Origin(GURL(frame_origin))));
+
+  // Create a new iframe with srcdoc and add it to the main frame. It should
+  // be created in the same SiteInstance as the parent.
+  {
+    std::string script("var f = document.createElement('iframe');"
+                       "f.srcdoc = 'some content';"
+                       "document.body.appendChild(f)");
+    TestNavigationObserver observer(shell()->web_contents());
+    EXPECT_TRUE(ExecuteScript(root->current_frame_host(), script));
+    EXPECT_EQ(2U, root->child_count());
+    observer.Wait();
+
+    EXPECT_EQ(GURL(url::kAboutBlankURL), root->child_at(1)->current_url());
+    EXPECT_TRUE(ExecuteScriptAndExtractString(
+        root->child_at(1)->current_frame_host(),
+        "domAutomationController.send(document.origin);", &frame_origin));
+    EXPECT_EQ(root->current_frame_host()->GetLastCommittedURL().GetOrigin(),
+              GURL(frame_origin));
+    EXPECT_NE(child->current_frame_host()->GetLastCommittedURL().GetOrigin(),
+              GURL(frame_origin));
+  }
+
+  // Set srcdoc on the existing cross-site frame. It should navigate the frame
+  // back to the origin of the parent.
+  {
+    std::string script("var f = document.getElementById('child-0');"
+                       "f.srcdoc = 'some content';");
+    TestNavigationObserver observer(shell()->web_contents());
+    EXPECT_TRUE(ExecuteScript(root->current_frame_host(), script));
+    observer.Wait();
+
+    EXPECT_EQ(GURL(url::kAboutBlankURL), child->current_url());
+    EXPECT_TRUE(ExecuteScriptAndExtractString(
+        child->current_frame_host(),
+        "domAutomationController.send(document.origin);", &frame_origin));
+    EXPECT_EQ(root->current_frame_host()->GetLastCommittedURL().GetOrigin(),
+              GURL(frame_origin));
+  }

[ncarter (slow), 2016/04/29 20:10:30]

srcdoc is very entertaining.

I just checked manually, and it looks like we have some mismatched oopif
behaviors around srcdoc and navigation history.

i.e., if you add an iframe src that navigates itself cross-process after page
load:

i = document.createElement('iframe'); i.srcdoc = "<script>setTimeout(function()
{window.location.href =
'https://csreis.github.io/tests/cross-site-iframe.html';}, 5000);</script>";
document.body.appendChild(i);

In ToT Chrome, it looks like going back actually restores the srcdoc contents
(the page navigates itself after another 5 seconds). With TDI, there doesn't
seem to be a navigation entry at all!

+}
+
 // Ensure that sandbox flags are correctly set when child frames are created.
 IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, SandboxFlagsSetForChildFrames) {
   GURL main_url(embedded_test_server()->GetURL("/sandboxed_frames.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
                             ->GetFrameTree()->root();
 
   // Verify that sandbox flags are set properly for all FrameTreeNodes.
@@ skipping 165 matching lines @@
 
   GURL data_url("data:text/html,foo");
   NavigateFrameToURL(root->child_at(1), data_url);
 
   // Navigating to a data URL should set a unique origin.  This is represented
   // as "null" per RFC 6454.
   EXPECT_EQ(root->child_at(1)->current_origin().Serialize(), "null");
 }
 
 }  // namespace content