Use main frame URL to identify referrer if sub-frame url is not available

chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager.h"
 
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/stringprintf.h"
 #include "base/time/time.h"
@@ skipping 146 matching lines @@
 
 SafeBrowsingNavigationObserverManager::AttributionResult
 SafeBrowsingNavigationObserverManager::IdentifyReferrerChain(
     const GURL& target_url,
     int target_tab_id,
     int user_gesture_count_limit,
     std::vector<ReferrerChainEntry>* out_referrer_chain) {
   if (!target_url.is_valid())
     return INVALID_URL;
 
-  NavigationEvent* nav_event = FindNavigationEvent(target_url, target_tab_id);
+  NavigationEvent* nav_event = FindNavigationEvent(
+      target_url,
+      GURL(),
+      target_tab_id);
   if (!nav_event) {
     // We cannot find a single navigation event related to this download.
     return NAVIGATION_EVENT_NOT_FOUND;
   }
 
   AddToReferrerChain(out_referrer_chain, nav_event,
                      ReferrerChainEntry::DOWNLOAD_URL);
   AttributionResult result = SUCCESS;
   int user_gesture_count = 0;
   while (user_gesture_count < user_gesture_count_limit) {
     // Back trace to the next nav_event that was initiated by the user.
     while (!nav_event->is_user_initiated) {
       nav_event =
-          FindNavigationEvent(nav_event->source_url, nav_event->source_tab_id);
+          FindNavigationEvent(nav_event->source_url,
+                              nav_event->source_main_frame_url,
+                              nav_event->source_tab_id);
       if (!nav_event)
         return result;
       AddToReferrerChain(out_referrer_chain, nav_event,
                          nav_event->has_server_redirect
                              ? ReferrerChainEntry::SERVER_REDIRECT
                              : ReferrerChainEntry::CLIENT_REDIRECT);
     }
 
     user_gesture_count++;
 
     // If the source_url and source_main_frame_url of current navigation event
     // are empty, and is_user_initiated is true, this is a browser initiated
     // navigation (e.g. trigged by typing in address bar, clicking on bookmark,
     // etc). We reached the end of the referrer chain.
     if (nav_event->source_url.is_empty() &&
         nav_event->source_main_frame_url.is_empty()) {
       DCHECK(nav_event->is_user_initiated);
       return result;
     }
 
     nav_event =
-        FindNavigationEvent(nav_event->source_url, nav_event->source_tab_id);
+        FindNavigationEvent(nav_event->source_url,
+                            nav_event->source_main_frame_url,
+                            nav_event->source_tab_id);
     if (!nav_event)
       return result;
 
     // Landing page of a download refers to the page user directly interacts
     // with to trigger this download (e.g. clicking on download button). Landing
     // referrer page is the one user interacts with right before navigating to
     // the landing page.
     // Since we are tracing navigations backwards, if we've encountered 1 user
     // gesture before this navigation event, this is a navigation leading to the
     // landing page. If we've encountered 2 user gestures, it leads to landing
@@ skipping 123 matching lines @@
     base::TimeDelta interval) {
   DCHECK_GT(interval, base::TimeDelta());
   cleanup_timer_.Stop();
   cleanup_timer_.Start(
       FROM_HERE, interval, this,
       &SafeBrowsingNavigationObserverManager::CleanUpStaleNavigationFootprints);
 }
 
 NavigationEvent* SafeBrowsingNavigationObserverManager::FindNavigationEvent(
     const GURL& target_url,
+    const GURL& target_main_frame_url,
     int target_tab_id) {
-  auto it = navigation_map_.find(target_url);
+  if (target_url.is_empty() && target_main_frame_url.is_empty())
+    return nullptr;
+
+  // If target_url is empty, we should back trace navigation based on its
+  // main frame URL instead.
+  GURL search_url = target_url.is_empty() ? target_main_frame_url : target_url;

[Nathan Parker, 2017/01/04 18:54:51]

nit: could be 
const GURL&
so you don't make a copy.

[Jialiu Lin, 2017/01/04 21:47:01]

Done.

+
+  auto it = navigation_map_.find(search_url);
   if (it == navigation_map_.end()) {
     return nullptr;
   }
   // Since navigation events are recorded in chronological order, we traverse
   // the vector in reverse order to get the latest match.
   for (auto rit = it->second.rbegin(); rit != it->second.rend(); ++rit) {
     // If tab id is not valid, we only compare url, otherwise we compare both.
-    if (rit->destination_url == target_url &&
+    if (rit->destination_url == search_url &&
         (target_tab_id == -1 || rit->target_tab_id == target_tab_id)) {
       // If both source_url and source_main_frame_url are empty, and this
       // navigation is not triggered by user, a retargeting navigation probably
       // causes this navigation. In this case, we skip this navigation event and
       // looks for the retargeting navigation event.
       if (rit->source_url.is_empty() && rit->source_main_frame_url.is_empty() &&
           !rit->is_user_initiated) {
         continue;
       } else {
         return &*rit;
@@ skipping 24 matching lines @@
         nav_event->source_main_frame_url.spec());
   }
   referrer_chain_entry.set_is_retargeting(nav_event->source_tab_id !=
                                           nav_event->target_tab_id);
   referrer_chain_entry.set_navigation_time_msec(
       nav_event->last_updated.ToJavaTime());
   referrer_chain->push_back(std::move(referrer_chain_entry));
 }
 
 }  // namespace safe_browsing