Fix extension bindings injection for iframes (reland)

extensions/renderer/script_context_set.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/script_context_set.h"
 
 #include "base/location.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/public/common/url_constants.h"
@@ skipping 122 matching lines @@
 
 const Extension* ScriptContextSet::GetExtensionFromFrameAndWorld(
     const blink::WebLocalFrame* frame,
     int world_id,
     bool use_effective_url) {
   std::string extension_id;
   if (world_id != 0) {
     // Isolated worlds (content script).
     extension_id = ScriptInjection::GetHostIdForIsolatedWorld(world_id);
   } else {
-    // Extension pages (chrome-extension:// URLs).
-    GURL frame_url = ScriptContext::GetDataSourceURLForFrame(frame);
+    // For looking up the extension associated with this frame, we either want
+    // to use the current url or possibly the data source url (which this frame
+    // may be navigating to shortly), depending on the security origin of the
+    // frame. We don't always want to use the data source url because some
+    // frames (eg iframes and windows created via window.open) briefly contain
+    // an about:blank script context that is scriptable by their parent/opener
+    // before they finish navigating.
+    GURL frame_url = ScriptContext::GetAccessCheckedFrameURL(frame);
     frame_url = ScriptContext::GetEffectiveDocumentURL(frame, frame_url,
                                                        use_effective_url);
     extension_id =
         RendererExtensionRegistry::Get()->GetExtensionOrAppIDByURL(frame_url);
   }
 
   // There are conditions where despite a context being associated with an
   // extension, no extension actually gets found. Ignore "invalid" because CSP
   // blocks extension page loading by switching the extension ID to "invalid".
   const Extension* extension =
@@ skipping 61 matching lines @@
   return Feature::WEB_PAGE_CONTEXT;
 }
 
 void ScriptContextSet::RecordAndRemove(std::set<ScriptContext*>* removed,
                                        ScriptContext* context) {
   removed->insert(context);
   Remove(context);  // Note: context deletion is deferred to the message loop.
 }
 
 }  // namespace extensions