Reenable framebusting deprecation, change it to allow navigation if iframe has ever had a user gestu

third_party/WebKit/Source/core/frame/Frame.cpp

Index: third_party/WebKit/Source/core/frame/Frame.cpp
diff --git a/third_party/WebKit/Source/core/frame/Frame.cpp b/third_party/WebKit/Source/core/frame/Frame.cpp
index b9b95f4a23e1dd76a6b994eecccfa175e934ea5c..1a999b09a4807bd1ab50de09eb3296013d7722fa 100644
--- a/third_party/WebKit/Source/core/frame/Frame.cpp
+++ b/third_party/WebKit/Source/core/frame/Frame.cpp
@@ -47,7 +47,6 @@
 #include "core/page/FocusController.h"
 #include "core/page/Page.h"
 #include "platform/Histogram.h"
-#include "platform/UserGestureIndicator.h"
 
 namespace blink {
 
@@ -171,7 +170,10 @@ bool Frame::canNavigate(const Frame& targetFrame) {
     const unsigned allowedBit = 0x2;
     unsigned framebustParams = 0;
     UseCounter::count(&targetFrame, UseCounter::TopNavigationFromSubFrame);
-    bool hasUserGesture = UserGestureIndicator::processingUserGesture();
+    bool hasUserGesture =
+        isLocalFrame()
+            ? toLocalFrame(this)->document()->hasReceivedUserGesture()

[Rick Byers, 2016/10/06 16:26:47]

I've been looking over all the places that take a UserGestureIndicator and I'm
nervous about the other cases you haven't yet instrumented.  For example, it
seems there are accessibility scenarios.  It would be bad it frame-busting
worked for input-driven navigation but not accessibility-tool driven navigation,
right?

One mitigation could be to also check processingUserGesture here.  But really
the only full solution is probably to audit every single instance of
UserGestureIndicator and associate a Document with it :-(

+            : false;
     if (hasUserGesture)
       framebustParams |= userGestureBit;
     if (isAllowedNavigation)