SameSite: Correctly set requests' initiator for new tabs.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index c73b789cb8f00d00a90ce6b3407b47fca487437e..1f9dd9c480e9605724ee0d0ad7e15ef4185caf4d 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -3903,17 +3903,18 @@ void RenderFrameImpl::willSendRequest(
     if (request.getFrameType() == blink::WebURLRequest::FrameTypeTopLevel) {
       request.setFirstPartyForCookies(request.url());
     } else {
-      // TODO(nasko): When the top-level frame is remote, there is no document.
-      // This is broken and should be fixed to propagate the first party.
-      WebFrame* top = frame->top();
-      if (top->isWebLocalFrame()) {
-        request.setFirstPartyForCookies(
-            frame->top()->document().firstPartyForCookies());
-      }
+      request.setFirstPartyForCookies(frame->document().firstPartyForCookies());

[Mike West, 2016/06/20 10:22:15]

Drive-by: We don't need to poke only at the top-level document now;
'Document::firstPartyForCookies()' should correctly handle remote frames (this
change is verified by the last part of
'RequestDataResourceDispatcherHostBrowserTest::CrossOriginNested').

     }
+  }
 
-    // If we need to set the first party, then we need to set the request's
-    // initiator as well; it will not be updated during redirects.
+  // Set the requestor origin to the same origin as the frame's document if it
+  // hasn't yet been set.
+  //
+  // TODO(mkwst): It would be cleaner to adjust blink::ResourceRequest to
+  // initialize itself with a `nullptr` initiator so that this can be a simple
+  // `isNull()` check.
+  if (request.requestorOrigin().isUnique() &&
+      !frame->document().getSecurityOrigin().isUnique()) {
     request.setRequestorOrigin(frame->document().getSecurityOrigin());
   }
 
@@ -5453,6 +5454,9 @@ void RenderFrameImpl::NavigateInternal(
   WebURLRequest request =
       CreateURLRequestForNavigation(common_params, std::move(stream_params),
                                     frame_->isViewSourceModeEnabled());
+  request.setFrameType(IsTopLevelNavigation(frame_)
+                           ? blink::WebURLRequest::FrameTypeTopLevel
+                           : blink::WebURLRequest::FrameTypeNested);
 
   if (IsBrowserSideNavigationEnabled() && common_params.post_data)
     request.setHTTPBody(GetWebHTTPBodyForRequestBody(common_params.post_data));