Move Origin::GetURL() out of resource request critical path

content/child/site_isolation_stats_gatherer.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/site_isolation_stats_gatherer.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include "base/macros.h"
@@ skipping 80 matching lines @@
 
 SiteIsolationResponseMetaData::SiteIsolationResponseMetaData() {
 }
 
 void SiteIsolationStatsGatherer::SetEnabled(bool enabled) {
   g_stats_gathering_enabled = enabled;
 }
 
 std::unique_ptr<SiteIsolationResponseMetaData>
 SiteIsolationStatsGatherer::OnReceivedResponse(
-    const GURL& frame_origin,
+    const url::Origin& frame_origin,
     const GURL& response_url,
     ResourceType resource_type,
     int origin_pid,
     const ResourceResponseInfo& info) {
   if (!g_stats_gathering_enabled)
     return nullptr;
 
   // if |origin_pid| is non-zero, it means that this response is for a plugin
   // spawned from this renderer process. We exclude responses for plugins for
   // now, but eventually, we're going to make plugin processes directly talk to
   // the browser process so that we don't apply cross-site document blocking to
   // them.
   if (origin_pid)
     return nullptr;
 
   UMA_HISTOGRAM_COUNTS("SiteIsolation.AllResponses", 1);
 
   // See if this is for navigation. If it is, don't block it, under the
   // assumption that we will put it in an appropriate process.
   if (IsResourceTypeFrame(resource_type))
     return nullptr;
 
   if (!CrossSiteDocumentClassifier::IsBlockableScheme(response_url))
     return nullptr;
 
-  if (CrossSiteDocumentClassifier::IsSameSite(frame_origin, response_url))
+  // TODO(csharrison): Add a path for IsSameSite/IsValidCorsHeaderSet to take an
+  // Origin.

[ncarter (slow), 2016/12/08 21:39:49]

Another option here is to delete this class, or enable it fractionally (e.g. for
1% of renderers or requests).

[Charlie Harrison, 2016/12/08 21:57:33]

I think once the CL I referenced lands, it will be easy to do this plumbing. If
not I'll consider it. No big deal though.

+  GURL frame_origin_url = frame_origin.GetURL();
+  if (CrossSiteDocumentClassifier::IsSameSite(frame_origin_url, response_url))
     return nullptr;
 
   CrossSiteDocumentMimeType canonical_mime_type =
       CrossSiteDocumentClassifier::GetCanonicalMimeType(info.mime_type);
 
   if (canonical_mime_type == CROSS_SITE_DOCUMENT_MIME_TYPE_OTHERS)
     return nullptr;
 
   // Every CORS request should have the Access-Control-Allow-Origin header even
   // if it is preceded by a pre-flight request. Therefore, if this is a CORS
   // request, it has this header.  response.httpHeaderField() internally uses
   // case-insensitive matching for the header name.
   std::string access_control_origin;
 
   // We can use a case-insensitive header name for EnumerateHeader().
   info.headers->EnumerateHeader(NULL, "access-control-allow-origin",
                                 &access_control_origin);
   if (CrossSiteDocumentClassifier::IsValidCorsHeaderSet(
-          frame_origin, response_url, access_control_origin))
+          frame_origin_url, response_url, access_control_origin))
     return nullptr;
 
   // Real XSD data collection starts from here.
   std::string no_sniff;
   info.headers->EnumerateHeader(NULL, "x-content-type-options", &no_sniff);
 
   std::unique_ptr<SiteIsolationResponseMetaData> resp_data(
       new SiteIsolationResponseMetaData);
-  resp_data->frame_origin = frame_origin.spec();
+  resp_data->frame_origin = frame_origin_url.spec();
   resp_data->response_url = response_url;
   resp_data->resource_type = resource_type;
   resp_data->canonical_mime_type = canonical_mime_type;
   resp_data->http_status_code = info.headers->response_code();
   resp_data->no_sniff = base::LowerCaseEqualsASCII(no_sniff, "nosniff");
 
   return resp_data;
 }
 
 bool SiteIsolationStatsGatherer::OnReceivedFirstChunk(
@@ skipping 86 matching lines @@
 }
 
 bool SiteIsolationStatsGatherer::SniffForJS(base::StringPiece data) {
   // The purpose of this function is to try to see if there's any possibility
   // that this data can be JavaScript (superset of JS). Search for "var " for JS
   // detection. This is a real hack and should only be used for stats gathering.
   return data.find("var ") != base::StringPiece::npos;
 }
 
 }  // namespace content