Add a check for mismatching URL and origin in the renderer process.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 4754 matching lines @@
     else
       params.transition = ui::PAGE_TRANSITION_AUTO_SUBFRAME;
 
     DCHECK(!navigation_state->request_params().should_clear_history_list);
     params.history_list_was_cleared = false;
     params.report_type = FrameMsg_UILoadMetricsReportType::NO_REPORT;
     // Subframes should match the zoom level of the main frame.
     render_view_->SetZoomLevel(render_view_->page_zoom_level());
   }
 
+  // Standard URLs must match the reported origin, when it is not unique.
+  if (params.url.IsStandard() && !params.origin.unique() &&
+      render_view_->GetWebkitPreferences().web_security_enabled) {

[Charlie Reis, 2016/07/15 20:33:17]

Ah, good point.  We'll need to skip the check for file URLs when
prefs.allow_universal_access_from_file_urls is true, too, or we'll get a bunch
of Android WebView crash reports.  

We're basically encoding RFHI::CanCommitOrigin into here, but I think I'm ok
with that.  Maybe put a reference to that method in the comment above?

[nasko, 2016/07/15 20:56:31]

Such check added. However, all tests passed before I added it, so it indicates
that we probably have no test coverage for this :(.
 
Done. Yeah, it isn't nice, but we need it to at least diagnose the kills. We can
decide whether we want to keep it longer term later on.

+    CHECK(params.origin.IsSameOriginWith(url::Origin(params.url)))
+        << " url:" << params.url << " origin:" << params.origin;
+  }
+
   // This message needs to be sent before any of allowScripts(),
   // allowImages(), allowPlugins() is called for the new page, so that when
   // these functions send a ViewHostMsg_ContentBlocked message, it arrives
   // after the FrameHostMsg_DidCommitProvisionalLoad message.
   Send(new FrameHostMsg_DidCommitProvisionalLoad(routing_id_, params));
 
   // If we end up reusing this WebRequest (for example, due to a #ref click),
   // we don't want the transition type to persist.  Just clear it.
   navigation_state->set_transition_type(ui::PAGE_TRANSITION_LINK);
 }
@@ skipping 1550 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content