Remove about:srcdoc url conversion.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 994 matching lines @@
 void RenderFrameHostImpl::OnDetach() {
   frame_tree_->RemoveFrame(frame_tree_node_);
 }
 
 void RenderFrameHostImpl::OnFrameFocused() {
   delegate_->SetFocusedFrame(frame_tree_node_, GetSiteInstance());
 }
 
 void RenderFrameHostImpl::OnOpenURL(const FrameHostMsg_OpenURL_Params& params) {
   GURL validated_url(params.url);
-  GetProcess()->FilterURL(false, &validated_url);
+  if (validated_url != GURL(content::kAboutSrcDocURL))
+    GetProcess()->FilterURL(false, &validated_url);
 
   if (params.is_history_navigation_in_new_child) {
     DCHECK(SiteIsolationPolicy::UseSubframeNavigationEntries());
 
     // Try to find a FrameNavigationEntry that matches this frame instead, based
     // on the frame's unique name.  If this can't be found, fall back to the
     // default params using RequestOpenURL below.
     if (frame_tree_node_->navigator()->NavigateNewChildFrame(this,
                                                              validated_url))
       return;
@@ skipping 157 matching lines @@
     return;
   }
 
   // Without this check, an evil renderer can trick the browser into creating
   // a navigation entry for a banned URL.  If the user clicks the back button
   // followed by the forward button (or clicks reload, or round-trips through
   // session restore, etc), we'll think that the browser commanded the
   // renderer to load the URL and grant the renderer the privileges to request
   // the URL.  To prevent this attack, we block the renderer from inserting
   // banned URLs into the navigation controller in the first place.
-  process->FilterURL(false, &validated_params.url);
+  if (validated_params.url != GURL(content::kAboutSrcDocURL))
+    process->FilterURL(false, &validated_params.url);
   process->FilterURL(true, &validated_params.referrer.url);
   for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
       it != validated_params.redirects.end(); ++it) {
-    process->FilterURL(false, &(*it));
+    if (*it != GURL(content::kAboutSrcDocURL))

[nasko, 2016/11/10 18:14:14]

All of these checks will be unnecessary if we update FilterURL.

+      process->FilterURL(false, &(*it));
   }
   process->FilterURL(true, &validated_params.searchable_form_url);
 
   // Without this check, the renderer can trick the browser into using
   // filenames it can't access in a future session restore.
   if (!CanAccessFilesOfPageState(validated_params.page_state)) {
     bad_message::ReceivedBadMessage(
         GetProcess(), bad_message::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE);
     return;
   }
@@ skipping 1980 matching lines @@
     NavigationEntryImpl* pending_entry =
         NavigationEntryImpl::FromNavigationEntry(
             frame_tree_node()->navigator()->GetController()->GetPendingEntry());
     if (pending_entry && pending_entry->GetUniqueID() == params.nav_entry_id) {
       pending_nav_entry_id = params.nav_entry_id;
       is_renderer_initiated = pending_entry->is_renderer_initiated();
     }
 
     return NavigationHandleImpl::Create(
         params.url, frame_tree_node_, is_renderer_initiated,
-        params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(),
+        params.was_within_same_page, base::TimeTicks::Now(),
         pending_nav_entry_id, false);  // started_from_context_menu
   }
 
   // Determine if the current NavigationHandle can be used.
   if (navigation_handle_ && navigation_handle_->GetURL() == params.url) {
     return std::move(navigation_handle_);
   }
 
   // If the URL does not match what the NavigationHandle expects, treat the
   // commit as a new navigation. This can happen when loading a Data
@@ skipping 31 matching lines @@
 
     // Reset any existing NavigationHandle.
     navigation_handle_.reset();
   }
 
   // There is no pending NavigationEntry in these cases, so pass 0 as the
   // pending_nav_entry_id. If the previous handle was a prematurely aborted
   // navigation loaded via LoadDataWithBaseURL, propagate the entry id.
   return NavigationHandleImpl::Create(
       params.url, frame_tree_node_, is_renderer_initiated,
-      params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(),
+      params.was_within_same_page, base::TimeTicks::Now(),
       entry_id_for_data_nav, false);  // started_from_context_menu
 }
 
 }  // namespace content