Account for origin corner cases during AutoSubframe navigations.

content/browser/frame_host/navigation_controller_impl_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
@@ skipping 2688 matching lines @@
   main_test_rfh()->PrepareForCommit();
   main_test_rfh()->SendNavigateWithParams(&back_params);
   controller.GoForward();
   main_test_rfh()->PrepareForCommit();
   main_test_rfh()->SendNavigateWithParams(&forward_params);
   EXPECT_EQ(forward_params.url,
             controller.GetVisibleEntry()->GetURL());
 
   // Finally, navigate to an unrelated URL to make sure in_page is not sticky.
   const GURL url3("http://bar");
-  params.page_id = 2;
-  params.nav_entry_id = 0;
-  params.did_create_new_entry = true;
-  params.url = url3;
+  FrameHostMsg_DidCommitProvisionalLoad_Params bar_params;
+  bar_params.page_id = 2;
+  bar_params.nav_entry_id = 0;
+  bar_params.did_create_new_entry = true;
+  bar_params.url = url3;
+  bar_params.transition = ui::PAGE_TRANSITION_LINK;
+  bar_params.should_update_history = false;
+  bar_params.gesture = NavigationGestureUser;
+  bar_params.method = "GET";
+  bar_params.page_state = PageState::CreateFromURL(url3);
+  bar_params.was_within_same_page = false;
   navigation_entry_committed_counter_ = 0;
   main_test_rfh()->SendRendererInitiatedNavigationRequest(url3, false);
   main_test_rfh()->PrepareForCommit();
-  main_test_rfh()->SendNavigateWithParams(&params);
+  main_test_rfh()->SendNavigateWithParams(&bar_params);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
   EXPECT_FALSE(observer.details().is_in_page);
   EXPECT_EQ(3, controller.GetEntryCount());
   EXPECT_EQ(2, controller.GetCurrentEntryIndex());
 }
 
 TEST_F(NavigationControllerTest, InPage_Replace) {
   NavigationControllerImpl& controller = controller_impl();
   TestNotificationTracker notifications;
@@ skipping 1026 matching lines @@
   EXPECT_FALSE(contents()->HasAccessedInitialDocument());
   EXPECT_FALSE(controller.IsInitialNavigation());
   EXPECT_TRUE(controller.GetVisibleEntry());
   EXPECT_EQ(url1, controller.GetVisibleEntry()->GetURL());
 
   notifications.Reset();
 }
 
 // Tests that IsInPageNavigation returns appropriate results.  Prevents
 // regression for bug 1126349.
-TEST_F(NavigationControllerTest, IsInPageNavigation) {
+TEST_F(NavigationControllerTest, IsInPageNavigationFromAboutBlank) {
   NavigationControllerImpl& controller = controller_impl();
-  const GURL url("http://www.google.com/home.html");
+  const GURL google_url("http://www.google.com/home.html");
+  const url::Origin google_origin(google_url);
+
+  const GURL foo_url("http://www.foo.com");
+  const url::Origin foo_origin(foo_url);
 
   // If the renderer claims it performed an in-page navigation from
   // about:blank, trust the renderer.
   // This can happen when an iframe is created and populated via
   // document.write(), then tries to perform a fragment navigation.
   // TODO(japhet): We should only trust the renderer if the about:blank
   // was the first document in the given frame, but we don't have enough
   // information to identify that case currently.
   // TODO(creis): Update this to verify that the origin of the about:blank page
   // matches if the URL doesn't look same-origin.
+
+  // Navigate to about:blank, with an empty/unique origin.
   const GURL blank_url(url::kAboutBlankURL);
-  const url::Origin blank_origin;
   main_test_rfh()->NavigateAndCommitRendererInitiated(0, true, blank_url);
-  EXPECT_TRUE(controller.IsURLInPageNavigation(url, url::Origin(url), true,
+
+  // A web URL cannot be in-page if the url::origin doesn't match.
+  MockRenderProcessHost* process = main_test_rfh()->GetProcess();
+  int expected_bad_messages = 0;
+  EXPECT_EQ(expected_bad_messages, process->bad_msg_count());
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      google_url, google_origin, true, main_test_rfh()));
+  EXPECT_EQ(++expected_bad_messages, process->bad_msg_count());
+
+  // A web URL can in-page with about:blank if the url::Origin matches.
+  main_test_rfh()->frame_tree_node()->SetCurrentOrigin(google_origin, false);
+  EXPECT_TRUE(controller.IsURLInPageNavigation(google_url, google_origin, true,
                                                main_test_rfh()));
+  EXPECT_EQ(expected_bad_messages, process->bad_msg_count());
+
+  // A different web URL cannot be in-page with about:blank.
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      foo_url, foo_origin, true, main_test_rfh()));
+  EXPECT_EQ(++expected_bad_messages, process->bad_msg_count());
+}
+
+TEST_F(NavigationControllerTest, IsInPageNavigation) {
+  NavigationControllerImpl& controller = controller_impl();
+  const GURL url("http://www.google.com/home.html");
 
   // Navigate to URL with no refs.
-  main_test_rfh()->NavigateAndCommitRendererInitiated(0, false, url);
+  main_test_rfh()->NavigateAndCommitRendererInitiated(0, true, url);
 
-  // Reloading the page is not an in-page navigation.
+  // Respect what the renderer says when the origin doesn't change.
   EXPECT_FALSE(controller.IsURLInPageNavigation(url, url::Origin(url), false,
                                                 main_test_rfh()));
   const GURL other_url("http://www.google.com/add.html");
   EXPECT_FALSE(controller.IsURLInPageNavigation(
       other_url, url::Origin(other_url), false, main_test_rfh()));
   const GURL url_with_ref("http://www.google.com/home.html#my_ref");
   EXPECT_TRUE(controller.IsURLInPageNavigation(
       url_with_ref, url::Origin(url_with_ref), true, main_test_rfh()));
 
   // Navigate to URL with refs.
@@ skipping 1539 matching lines @@
             observer.details().ssl_status.num_unknown_scts);
   EXPECT_EQ(default_ssl_status.num_invalid_scts,
             observer.details().ssl_status.num_invalid_scts);
   EXPECT_EQ(default_ssl_status.num_valid_scts,
             observer.details().ssl_status.num_valid_scts);
 
   EXPECT_EQ(1, main_test_rfh()->GetProcess()->bad_msg_count());
 }
 
 }  // namespace content