Use main frame URL to identify referrer if sub-frame url is not available

chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_SAFE_BROWSING_SAFE_BROWSING_NAVIGATION_OBSERVER_MANAGER_H_
 #define CHROME_BROWSER_SAFE_BROWSING_SAFE_BROWSING_NAVIGATION_OBSERVER_MANAGER_H_
 
 #include "base/feature_list.h"
 #include "chrome/common/safe_browsing/csd.pb.h"
 #include "content/public/browser/notification_observer.h"
@@ skipping 121 matching lines @@
   void CleanUpUserGestures();
 
   // Remove stale entries from host_to_ip_map_ if they are older than
   // kNavigationFootprintTTLInSecond (2 minutes).
   void CleanUpIpAddresses();
 
   bool IsCleanUpScheduled() const;
 
   void ScheduleNextCleanUpAfterInterval(base::TimeDelta interval);
 
-  // Find the most recent navigation event that navigated to |target_url| in the
-  // tab with ID |target_tab_id|. If |target_tab_id| is not available (-1), we
-  // look for all tabs for the most recent navigation to |target_url|.
+  // Find the most recent navigation event that navigated to |target_url| and
+  // its associated |target_main_frame_url| in the tab with ID |target_tab_id|.
+  // If navigation happened in the main frame, |target_url| and |target_main_
+  // frame_url| are the same.
+  // If |target_url| is empty, we use its main frame url (a.k.a.
+  // |target_main_frame_url|) to search for navigation events.
+  // If |target_tab_id| is not available (-1), we look for all tabs for the most
+  // recent navigation to |target_url| or |target_main_frame_url|.
   // For some cases, the most recent navigation to |target_url| may not be
   // relevant.
   // For example, url1 in window A opens url2 in window B, url1 then opens an
   // about:blank page window C and injects script code in it to trigger a
   // delayed download in Window D. Before the download occurs, url2 in window B
   // opens a different about:blank page in window C.
   // A ---- C - D
   //   \   /
   //     B
   // In this case, FindNavigationEvent() will think url2 in Window B is the
   // referrer of about::blank in Window C since this navigation is more recent.
   // However, it does not prevent us to attribute url1 in Window A as the cause
   // of all these navigations.
   NavigationEvent* FindNavigationEvent(const GURL& target_url,
+                                       const GURL& target_main_frame_url,
                                        int target_tab_id);
 
   void AddToReferrerChain(std::vector<ReferrerChainEntry>* referrer_chain,
                           NavigationEvent* nav_event,
                           ReferrerChainEntry::URLType type);
 
   // navigation_map_ keeps track of all the observed navigations. This map is
   // keyed on the resolved request url. In other words, in case of server
   // redirects, its key is the last server redirect url, otherwise, it is the
   // original target url. Since the same url can be requested multiple times
   // across different tabs and frames, the value of this map is a vector of
   // NavigationEvent ordered by navigation finish time.
-  // TODO(jialiul): Entries in navigation_map_ will be removed if they are older
-  // than 2 minutes since their corresponding navigations finish.
+  // Entries in navigation_map_ will be removed if they are older than 2 minutes
+  // since their corresponding navigations finish.
   NavigationMap navigation_map_;
 
   // user_gesture_map_ keeps track of the timestamp of last user gesture in
   // in each WebContents. We assume for majority of cases, a navigation
   // shortly after a user gesture indicate this navigation is user initiated.
   UserGestureMap user_gesture_map_;
 
   // Host to timestamped IP addresses map that covers all the main frame and
   // subframe URLs' hosts. Since it is possible for a host to resolve to more
   // than one IP in even a short period of time, we map a single host to a
   // vector of ResolvedIPAddresss. This map is used to fill in ip_address field
   // in URLChainEntry in ClientDownloadRequest.
   HostToIpMap host_to_ip_map_;
 
   content::NotificationRegistrar registrar_;
 
   base::OneShotTimer cleanup_timer_;
 
   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingNavigationObserverManager);
 };
 }  // namespace safe_browsing
 
 #endif  // CHROME_BROWSER_SAFE_BROWSING_SAFE_BROWSING_NAVIGATION_OBSERVER_MANAGER_H_