Account for origin corner cases during AutoSubframe navigations.

content/browser/frame_host/navigation_controller_impl_browsertest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 654 matching lines @@
 // navigation entries, and the third and fourth, the new navigations, try to.
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, SubframeOnEmptyPage) {
   // Navigate to a page to force the renderer process to start.
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
                             ->GetFrameTree()
                             ->root();
 
   // Pop open a new window with no last committed entry.
   ShellAddedObserver new_shell_observer;
-  {
-    std::string script = "window.open()";
-    EXPECT_TRUE(ExecuteScript(root, script));
-  }
+  EXPECT_TRUE(ExecuteScript(root, "window.open()"));
   Shell* new_shell = new_shell_observer.GetShell();
   ASSERT_NE(new_shell->web_contents(), shell()->web_contents());
   FrameTreeNode* new_root =
       static_cast<WebContentsImpl*>(new_shell->web_contents())
           ->GetFrameTree()
           ->root();
   EXPECT_FALSE(
       new_shell->web_contents()->GetController().GetLastCommittedEntry());
 
   // Make a new iframe in it.
@@ skipping 31 matching lines @@
     std::string script = "var iframe = document.createElement('iframe');"
                          "iframe.src = '" + grandchild_url.spec() + "';"
                          "document.body.appendChild(iframe);";
     EXPECT_TRUE(ExecuteScript(new_root->child_at(0), script));
     capturer.Wait();
   }
   ASSERT_EQ(1U, new_root->child_at(0)->child_count());
   EXPECT_EQ(grandchild_url, new_root->child_at(0)->child_at(0)->current_url());
 }
 
+// Test that the renderer is not killed after an auto subframe navigation if the
+// main frame appears to change its origin due to a document.write on an
+// about:blank page.  See https://crbug.com/613732.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       OriginChangeAfterDocumentWrite) {
+  GURL url1 = embedded_test_server()->GetURL(
+      "/navigation_controller/simple_page_1.html");
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+
+  // Pop open a new window to about:blank.
+  ShellAddedObserver new_shell_observer;
+  EXPECT_TRUE(ExecuteScript(root, "var w = window.open('about:blank')"));
+  Shell* new_shell = new_shell_observer.GetShell();
+  ASSERT_NE(new_shell->web_contents(), shell()->web_contents());
+  FrameTreeNode* new_root =
+      static_cast<WebContentsImpl*>(new_shell->web_contents())
+          ->GetFrameTree()
+          ->root();
+  GURL blank_url(url::kAboutBlankURL);
+  EXPECT_EQ(blank_url, new_root->current_url());
+
+  // Make a new iframe in it using document.write from the opener.
+  {
+    LoadCommittedCapturer capturer(new_shell->web_contents());
+    std::string script = "w.document.write("
+                         "\"<iframe src='" + url1.spec() + "'></iframe>\");"
+                         "w.document.close();";
+    EXPECT_TRUE(ExecuteScript(root->current_frame_host(), script));
+    capturer.Wait();
+  }
+  ASSERT_EQ(1U, new_root->child_count());
+  EXPECT_EQ(blank_url, new_root->current_url());
+  EXPECT_EQ(url1, new_root->child_at(0)->current_url());
+
+  // Navigate the subframe.
+  GURL url2 = embedded_test_server()->GetURL(
+      "/navigation_controller/simple_page_2.html");
+  {
+    LoadCommittedCapturer capturer(new_root->child_at(0));
+    std::string script = "location.href = '" + url2.spec() + "';";
+    EXPECT_TRUE(ExecuteScript(new_root->child_at(0), script));
+    capturer.Wait();
+  }
+  EXPECT_EQ(blank_url, new_root->current_url());
+  EXPECT_EQ(url2, new_root->child_at(0)->current_url());
+  EXPECT_EQ(2, new_shell->web_contents()->GetController().GetEntryCount());
+
+  // Do a replace state in the main frame, which changes the URL from
+  // about:blank to the opener's origin, due to the document.write() call.
+  {
+    LoadCommittedCapturer capturer(new_root);
+    std::string script = "history.replaceState({}, 'foo', 'foo');";
+    EXPECT_TRUE(ExecuteScript(new_root, script));
+    capturer.Wait();
+  }
+  EXPECT_EQ(embedded_test_server()->GetURL("/navigation_controller/foo"),
+            new_root->current_url());
+  EXPECT_EQ(url2, new_root->child_at(0)->current_url());
+
+  // Go back in the subframe.  Note that the main frame's URL looks like a
+  // cross-origin change from a web URL to about:blank.
+  {
+    TestNavigationObserver observer(new_shell->web_contents(), 1);
+    new_shell->web_contents()->GetController().GoBack();
+    observer.Wait();
+  }
+  EXPECT_TRUE(new_root->current_frame_host()->IsRenderFrameLive());
+
+  // Go forward in the subframe.  Note that the main frame's URL looks like a
+  // cross-origin change from about:blank to a web URL.
+  {
+    TestNavigationObserver observer(new_shell->web_contents(), 1);
+    new_shell->web_contents()->GetController().GoForward();
+    observer.Wait();
+  }
+  EXPECT_TRUE(new_root->current_frame_host()->IsRenderFrameLive());
+}
+
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
                        ErrorPageReplacement) {
   NavigationController& controller = shell()->web_contents()->GetController();
   GURL error_url(
       net::URLRequestFailedJob::GetMockHttpUrl(net::ERR_CONNECTION_RESET));
   BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
                           base::Bind(&net::URLRequestFailedJob::AddUrlHandler));
 
   NavigateToURL(shell(), GURL(url::kAboutBlankURL));
   EXPECT_EQ(1, controller.GetEntryCount());
@@ skipping 3751 matching lines @@
     // TODO(clamy): Check the post id as well when PlzNavigate handles it
     // properly.
     if (!IsBrowserSideNavigationEnabled())
       EXPECT_NE(-1, frame_entry->post_id());
     EXPECT_FALSE(entry->GetHasPostData());
     EXPECT_EQ(-1, entry->GetPostID());
   }
 }
 
 }  // namespace content