Don't set the request target type to object when navigating from a Pepper plug-in.

content/renderer/pepper/pepper_plugin_instance_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
@@ skipping 2738 matching lines @@
     return PP_ERROR_FAILED;
 
   WebDocument document = container_->element().document();
   WebFrame* frame = document.frame();
   if (!frame)
     return PP_ERROR_FAILED;
 
   ppapi::URLRequestInfoData completed_request = request;
 
   WebURLRequest web_request;
-  if (!CreateWebURLRequest(&completed_request, frame, &web_request))
+  if (!CreateWebURLRequest(&completed_request,
+                           WebURLRequest::TargetIsMainFrame,

[yzshen1, 2013/09/03 18:13:40]

Is it possible that this navigate happens in a subframe?

[Bernhard Bauer, 2013/09/03 20:58:02]

Hm, good point! Fixed.

+                           frame,
+                           &web_request))
     return PP_ERROR_FAILED;
   web_request.setFirstPartyForCookies(document.firstPartyForCookies());
   web_request.setHasUserGesture(from_user_action);
 
   GURL gurl(web_request.url());
   if (gurl.SchemeIs("javascript")) {
     // In imitation of the NPAPI implementation, only |target_frame == frame| is
     // allowed for security reasons.
     WebFrame* target_frame =
         frame->view()->findFrameByName(WebString::fromUTF8(target), frame);
@@ skipping 136 matching lines @@
     // Running out-of-process. Initiate an IPC call to notify the plugin
     // process.
     ppapi::proxy::HostDispatcher* dispatcher =
         ppapi::proxy::HostDispatcher::GetForInstance(pp_instance());
     dispatcher->Send(new PpapiMsg_PPPInstance_HandleDocumentLoad(
         ppapi::API_ID_PPP_INSTANCE, pp_instance(), pending_host_id, data));
   }
 }
 
 }  // namespace content