Allow about:blank to be considered in-page if origin matches.

content/browser/frame_host/navigation_controller_impl.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_FRAME_HOST_NAVIGATION_CONTROLLER_IMPL_H_
 #define CONTENT_BROWSER_FRAME_HOST_NAVIGATION_CONTROLLER_IMPL_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 137 matching lines @@
   // and it will return false.
   bool RendererDidNavigate(
       RenderFrameHostImpl* rfh,
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
       LoadCommittedDetails* details);
 
   // Notifies us that we just became active. This is used by the WebContentsImpl
   // so that we know to load URLs that were pending as "lazy" loads.
   void SetActive(bool is_active);
 
-  // Returns true if the given URL would be an in-page navigation (i.e. only the
-  // reference fragment is different) from the last committed URL in the
-  // specified frame. If there is no last committed entry, then nothing will be
-  // in-page.
+  // Returns true if the given URL would be an in-page navigation (e.g., if the
+  // reference fragment is different, or after a pushState) from the last
+  // committed URL in the specified frame. If there is no last committed entry,
+  // then nothing will be in-page.
   //
   // Special note: if the URLs are the same, it does NOT automatically count as
   // an in-page navigation. Neither does an input URL that has no ref, even if
   // the rest is the same. This may seem weird, but when we're considering
   // whether a navigation happened without loading anything, the same URL could
   // be a reload, while only a different ref would be in-page (pages can't clear
   // refs without reload, only change to "#" which we don't count as empty).
   //
   // The situation is made murkier by history.replaceState(), which could
   // provide the same URL as part of an in-page navigation, not a reload. So
   // we need to let the (untrustworthy) renderer resolve the ambiguity, but
-  // only when the URLs are on the same origin.
-  bool IsURLInPageNavigation(
-      const GURL& url,
-      bool renderer_says_in_page,
-      RenderFrameHost* rfh) const;
+  // only when the URLs are on the same origin. We rely on |origin|, which
+  // matters in cases like about:blank that otherwise look cross-origin.
+  bool IsURLInPageNavigation(const GURL& url,
+                             const url::Origin& origin,
+                             bool renderer_says_in_page,
+                             RenderFrameHost* rfh) const;
 
   // Sets the SessionStorageNamespace for the given |partition_id|. This is
   // used during initialization of a new NavigationController to allow
   // pre-population of the SessionStorageNamespace objects. Session restore,
   // prerendering, and the implementaion of window.open() are the primary users
   // of this API.
   //
   // Calling this function when a SessionStorageNamespace has already been
   // associated with a |partition_id| will CHECK() fail.
   void SetSessionStorageNamespace(
@@ skipping 261 matching lines @@
   TimeSmoother time_smoother_;
 
   std::unique_ptr<NavigationEntryScreenshotManager> screenshot_manager_;
 
   DISALLOW_COPY_AND_ASSIGN(NavigationControllerImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_FRAME_HOST_NAVIGATION_CONTROLLER_IMPL_H_