Require a process ID when looking up RFHs by FrameTreeNode ID.

chrome/browser/safe_browsing/safe_browsing_navigation_observer.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/safe_browsing_navigation_observer.h"
 
 #include "base/memory/ptr_util.h"
 #include "base/time/time.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/profile.h"
@@ skipping 126 matching lines @@
   nav_event->frame_id = navigation_handle->GetFrameTreeNodeId();
 
   // If there was a URL previously committed in the current RenderFrameHost,
   // set it as the source url of this navigation. Otherwise, this is the
   // first url going to commit in this frame. We set navigation_handle's URL as
   // the source url.
   // TODO(jialiul): source_url, source_tab_id, and source_main_frame_url may be
   // incorrect when another frame is targeting this frame. Need to refine this
   // logic after the true initiator details are added to NavigationHandle
   // (https://crbug.com/651895).
+  int current_process_id =
+      navigation_handle->GetStartingSiteInstance()->GetProcess()->GetID();

[Charlie Reis, 2017/05/01 21:56:59]

This is only ok because it matches the limitations described in the comment
above.  All of this will go away as soon as we track initiators.

   content::RenderFrameHost* current_frame_host =
       navigation_handle->GetWebContents()->FindFrameByFrameTreeNodeId(
-          nav_event->frame_id);
+          nav_event->frame_id, current_process_id);
   // For browser initiated navigation (e.g. from address bar or bookmark), we
   // don't fill the source_url to prevent attributing navigation to the last
   // committed navigation.
   if (navigation_handle->IsRendererInitiated() && current_frame_host &&
       current_frame_host->GetLastCommittedURL().is_valid()) {
     nav_event->source_url =
         SafeBrowsingNavigationObserverManager::ClearEmptyRef(
             current_frame_host->GetLastCommittedURL());
   }
   nav_event->original_request_url =
@@ skipping 89 matching lines @@
     ui::PageTransition transition,
     bool started_from_context_menu,
     bool renderer_initiated) {
   manager_->RecordNewWebContents(
       web_contents(), source_render_frame_host->GetProcess()->GetID(),
       source_render_frame_host->GetRoutingID(), url, new_contents,
       renderer_initiated);
 }
 
 }  // namespace safe_browsing