Don't kill Chrome Apps that make XHRs from guests.

chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc

Index: chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
diff --git a/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc b/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
index 6bf45963aa2b568c9e7217d0440f37e4599cdb8b..b1fabc73e2d0d30f40b806a8154bd734c67088c9 100644
--- a/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
+++ b/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
@@ -202,14 +202,15 @@ content::HeaderInterceptorResult CheckOriginHeader(
     return content::HeaderInterceptorResult::FAIL;
 
   // Check for platform app origins.  These can only be committed by the app
-  // itself, or by one if its guests if there are accessible_resources.
+  // itself, or by one if its guests if it has the webview permission.
   // Processes that incorrectly claim to be an app should be killed.
   const ProcessMap& process_map = extension_info_map->process_map();
   if (extension->is_platform_app() &&
       !process_map.Contains(extension->id(), child_id)) {
-    // This is a platform app origin not in the app's own process.  If there
-    // are no accessible resources, this is illegal.
-    if (!extension->GetManifestData(manifest_keys::kWebviewAccessibleResources))
+    // This is a platform app origin not in the app's own process.  If it cannot
+    // create webviews, this is illegal.
+    if (!extension->permissions_data()->HasAPIPermission(
+            extensions::APIPermission::kWebView))

[lazyboy, 2017/04/06 21:03:29]

nit: {}

[Charlie Reis, 2017/04/06 21:09:15]

Sure.  (Not strictly necessary since the body is still one line, but I agree
that it makes things easier to read here due to the various other indents
nearby.)

       return content::HeaderInterceptorResult::KILL;
 
     // If there are accessible resources, the origin is only legal if the