Take session history SiteInstance into account for unique origin navigations.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 1092 matching lines @@
 
 scoped_refptr<SiteInstance>
 RenderFrameHostManager::GetSiteInstanceForNavigation(
     const GURL& dest_url,
     SiteInstance* source_instance,
     SiteInstance* dest_instance,
     SiteInstance* candidate_instance,
     ui::PageTransition transition,
     bool dest_is_restore,
     bool dest_is_view_source_mode) {
+  // On renderer-initiated navigations, when the frame initiating the navigation
+  // and the frame being navigated differ, |source_instance| is set to the
+  // SiteInstance of the initiating frame. |dest_instance| is present on session
+  // history navigations. The two cannot be set simultaneously.
+  DCHECK(!source_instance || !dest_instance);
+
   SiteInstance* current_instance = render_frame_host_->GetSiteInstance();
 
   // We do not currently swap processes for navigations in webview tag guests.
   if (current_instance->GetSiteURL().SchemeIs(kGuestScheme))
     return current_instance;
 
   // Determine if we need a new BrowsingInstance for this entry.  If true, this
   // implies that it will get a new SiteInstance (and likely process), and that
   // other tabs in the current BrowsingInstance will be unable to script it.
   // This is used for cases that require a process swap even in the
@@ skipping 1392 matching lines @@
   }
 
   msg->set_routing_id(render_frame_host_->GetRoutingID());
   render_frame_host_->Send(msg);
 }
 
 bool RenderFrameHostManager::CanSubframeSwapProcess(
     const GURL& dest_url,
     SiteInstance* source_instance,
     SiteInstance* dest_instance) {
+  // On renderer-initiated navigations, when the frame initiating the navigation
+  // and the frame being navigated differ, |source_instance| is set to the
+  // SiteInstance of the initiating frame. |dest_instance| is present on session
+  // history navigations. The two cannot be set simultaneously.
+  DCHECK(!source_instance || !dest_instance);
+
   // Don't swap for subframes unless we are in an OOPIF-enabled mode.  We can
   // get here in tests for subframes (e.g., NavigateFrameToURL).
   if (!SiteIsolationPolicy::AreCrossProcessFramesPossible())
     return false;
 
   // If dest_url is a unique origin like about:blank, then the need for a swap
-  // is determined by the source_instance.
+  // is determined by the source_instance or dest_instance.
   GURL resolved_url = dest_url;
   if (url::Origin(resolved_url).unique()) {
-    // If there is no source_instance for a unique origin, then we should avoid
-    // a process swap.
-    if (!source_instance)
+    if (source_instance) {
+      resolved_url = source_instance->GetSiteURL();
+    } else if (dest_instance) {
+      resolved_url = dest_instance->GetSiteURL();
+    } else {
+      // If there is no SiteInstance this unique origin can be associated with,
+      // then we should avoid a process swap.
       return false;
-
-    // Use source_instance to determine if a swap is needed.
-    resolved_url = source_instance->GetSiteURL();
+    }
   }
 
   // If we are in an OOPIF mode that only applies to some sites, only swap if
   // the policy determines that a transfer would have been needed.  We can get
   // here for session restore.
   if (!IsRendererTransferNeededForNavigation(render_frame_host_.get(),
                                              resolved_url)) {
     DCHECK(!dest_instance ||
            dest_instance == render_frame_host_->GetSiteInstance());
     return false;
   }
 
   return true;
 }
 
 }  // namespace content