PlzNavigate: Fix the FindInPageControllerTest.SearchWithinSpecialURL browser test.

content/browser/frame_host/navigator_impl.cc

Index: content/browser/frame_host/navigator_impl.cc
diff --git a/content/browser/frame_host/navigator_impl.cc b/content/browser/frame_host/navigator_impl.cc
index 8e704b1fc7d314d2bcda10d78ead7d017047e4a7..ebcac6c94f7bf806a580209c6265a0c6d60edfca 100644
--- a/content/browser/frame_host/navigator_impl.cc
+++ b/content/browser/frame_host/navigator_impl.cc
@@ -10,6 +10,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
+#include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
@@ -20,6 +21,7 @@
 #include "content/browser/frame_host/navigation_request_info.h"
 #include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
@@ -1133,6 +1135,14 @@ void NavigatorImpl::RequestNavigation(FrameTreeNode* frame_tree_node,
   frame_tree_node->CreatedNavigationRequest(std::move(scoped_request));
   navigation_request->CreateNavigationHandle(entry.GetUniqueID());
 
+  // Grant access to the process associated with the RFH to ensure that the
+  // navigation completes.
+  if (frame_tree_node->current_frame_host()->GetProcess()) {
+    ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(

[jam, 2016/10/21 20:28:21]

GrantRequestURL should only be called for browser-initiated loads. if we call it
here, that means that an exploited renderer would say a navigation occurred to a
scheme it doesn't have access to and then this codepath would allow it.

[ananta, 2016/10/21 21:08:29]

This function appears to be only called for top level navigations. These include
navigations originating in the browser and those via the
RenderFrameImpl::OpenURL code path. nasko please confirm if this is the case.

[jam, 2016/10/21 21:25:24]

(from our chat, so Nasko can clarify)
on the NTP, clicking the icons led to this code path. is the NTP treated
differently?

+        frame_tree_node->current_frame_host()->GetProcess()->GetID(),
+        dest_url);
+  }
+
   // Have the current renderer execute its beforeunload event if needed. If it
   // is not needed then NavigationRequest::BeginNavigation should be directly
   // called instead.