Only show a beforeunload dialog if a frame has had a user gesture since its load.

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 2f2611587cd266c7d2a511d7d9522b7051e41614..3e0b81300fc9e19cc75c3e1f86d26de2afb6c99c 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -3071,6 +3071,15 @@ bool Document::dispatchBeforeUnloadEvent(ChromeClient& chromeClient,
   if (!frame() || beforeUnloadEvent->returnValue().isNull())
     return true;
 
+  if (!frame()->hasReceivedUserGesture()) {

[Charlie Reis, 2017/04/10 06:20:11]

Sanity check: Does this mean the frame has received a user gesture, or the
document?  It's confusing that it's on frame, but the documentation on
WebLocalFrame kind of implies it's about the document.

Can you add a test that beforeunload doesn't fire if there was a user gesture
for a previous document in the same frame?  (Ideally this would be a
content_browsertest that checked both same-process and cross-process, in case
there's some kind of replication that confuses us.)

[Avi (use Gerrit), 2017/05/05 15:30:04]

This is actually about the document, not the frame. It lives on the frame, is
set when the frame gets a gesture, but is reset when a new document is attached.
Done.

+    addConsoleMessage(ConsoleMessage::create(
+        JSMessageSource, ErrorMessageLevel,
+        "Blocked attempt to show a 'beforeunload' confirmation panel for a "
+        "frame that never had a user gesture since its load. "
+        "https://www.chromestatus.com/feature/5082396709879808"));
+    return true;
+  }
+
   if (didAllowNavigation) {
     addConsoleMessage(ConsoleMessage::create(
         JSMessageSource, ErrorMessageLevel,