Account for origin corner cases during AutoSubframe navigations.

content/browser/frame_host/navigation_controller_impl_unittest.cc

Index: content/browser/frame_host/navigation_controller_impl_unittest.cc
diff --git a/content/browser/frame_host/navigation_controller_impl_unittest.cc b/content/browser/frame_host/navigation_controller_impl_unittest.cc
index 5dfa8cfb1d9b91160ea414ad7389e0926a3de9e2..a8a0b15472501513ee6f388db4c9d3f9df67e3bb 100644
--- a/content/browser/frame_host/navigation_controller_impl_unittest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_unittest.cc
@@ -2706,14 +2706,21 @@ TEST_F(NavigationControllerTest, InPage) {
 
   // Finally, navigate to an unrelated URL to make sure in_page is not sticky.
   const GURL url3("http://bar");
-  params.page_id = 2;
-  params.nav_entry_id = 0;
-  params.did_create_new_entry = true;
-  params.url = url3;
+  FrameHostMsg_DidCommitProvisionalLoad_Params bar_params;
+  bar_params.page_id = 2;
+  bar_params.nav_entry_id = 0;
+  bar_params.did_create_new_entry = true;
+  bar_params.url = url3;
+  bar_params.transition = ui::PAGE_TRANSITION_LINK;
+  bar_params.should_update_history = false;
+  bar_params.gesture = NavigationGestureUser;
+  bar_params.method = "GET";
+  bar_params.page_state = PageState::CreateFromURL(url3);
+  bar_params.was_within_same_page = false;
   navigation_entry_committed_counter_ = 0;
   main_test_rfh()->SendRendererInitiatedNavigationRequest(url3, false);
   main_test_rfh()->PrepareForCommit();
-  main_test_rfh()->SendNavigateWithParams(&params);
+  main_test_rfh()->SendNavigateWithParams(&bar_params);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
   EXPECT_FALSE(observer.details().is_in_page);
@@ -3760,9 +3767,13 @@ TEST_F(NavigationControllerTest, DontShowRendererURLInNewTabAfterCommit) {
 
 // Tests that IsInPageNavigation returns appropriate results.  Prevents
 // regression for bug 1126349.
-TEST_F(NavigationControllerTest, IsInPageNavigation) {
+TEST_F(NavigationControllerTest, IsInPageNavigationFromAboutBlank) {
   NavigationControllerImpl& controller = controller_impl();
-  const GURL url("http://www.google.com/home.html");
+  const GURL google_url("http://www.google.com/home.html");
+  const url::Origin google_origin(google_url);
+
+  const GURL foo_url("http://www.foo.com");
+  const url::Origin foo_origin(foo_url);
 
   // If the renderer claims it performed an in-page navigation from
   // about:blank, trust the renderer.
@@ -3773,16 +3784,39 @@ TEST_F(NavigationControllerTest, IsInPageNavigation) {
   // information to identify that case currently.
   // TODO(creis): Update this to verify that the origin of the about:blank page
   // matches if the URL doesn't look same-origin.
+
+  // Navigate to about:blank, with an empty/unique origin.
   const GURL blank_url(url::kAboutBlankURL);
-  const url::Origin blank_origin;
   main_test_rfh()->NavigateAndCommitRendererInitiated(0, true, blank_url);
-  EXPECT_TRUE(controller.IsURLInPageNavigation(url, url::Origin(url), true,
+
+  // A web URL cannot be in-page if the url::origin doesn't match.
+  MockRenderProcessHost* process = main_test_rfh()->GetProcess();
+  int expected_bad_messages = 0;
+  EXPECT_EQ(expected_bad_messages, process->bad_msg_count());
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      google_url, google_origin, true, main_test_rfh()));
+  EXPECT_EQ(++expected_bad_messages, process->bad_msg_count());
+
+  // A web URL can in-page with about:blank if the url::Origin matches.
+  main_test_rfh()->frame_tree_node()->SetCurrentOrigin(google_origin, false);
+  EXPECT_TRUE(controller.IsURLInPageNavigation(google_url, google_origin, true,
                                                main_test_rfh()));
+  EXPECT_EQ(expected_bad_messages, process->bad_msg_count());
+
+  // A different web URL cannot be in-page with about:blank.
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      foo_url, foo_origin, true, main_test_rfh()));
+  EXPECT_EQ(++expected_bad_messages, process->bad_msg_count());
+}
+
+TEST_F(NavigationControllerTest, IsInPageNavigation) {
+  NavigationControllerImpl& controller = controller_impl();
+  const GURL url("http://www.google.com/home.html");
 
   // Navigate to URL with no refs.
-  main_test_rfh()->NavigateAndCommitRendererInitiated(0, false, url);
+  main_test_rfh()->NavigateAndCommitRendererInitiated(0, true, url);
 
-  // Reloading the page is not an in-page navigation.
+  // Respect what the renderer says when the origin doesn't change.
   EXPECT_FALSE(controller.IsURLInPageNavigation(url, url::Origin(url), false,
                                                 main_test_rfh()));
   const GURL other_url("http://www.google.com/add.html");