PlzNavigate: blocked browser-initiated navigations should transfer processes sometimes

content/browser/frame_host/navigation_request.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_request.h"
 
 #include <utility>
 
 #include "base/memory/ptr_util.h"
 #include "content/browser/appcache/appcache_navigation_handle.h"
@@ skipping 616 matching lines @@
     frame_tree_node_->navigator()->DiscardPendingEntryIfNeeded(
         navigation_handle_.get());
   }
 
   // If the request was canceled by the user do not show an error page.
   if (net_error == net::ERR_ABORTED) {
     frame_tree_node_->ResetNavigationRequest(false, true);
     return;
   }
 
-  // There are two types of error pages that need to be handled differently.
-  // * Error pages resulting from blocking the request, because the original
-  //   document wasn't even allowed to make the request. In such case,
-  //   the error pages should be committed in the process of the original
-  //   document, to avoid creating a process for the destination.
-  // * Error pages resulting from either network outage (no network, DNS
-  //   error, etc) or similar cases, where the user can reasonably expect that
-  //   a reload at a later point in time can be successful. Such error pages
-  //   do belong to the process that will host the destination URL, as a
-  //   reload will end up committing in that process anyway.
+  // Decide whether to leave the error page in the original process.
+  // * If this was a renderer-initiated navigation, and the request is blocked
+  //   because the initiating document wasn't allowed to make the request,
+  //   commit the error in the existing process. This is a strategy to to avoid
+  //   creating a process for the destination, which may belong to an origin
+  //   with a higher privilege level.
+  // * Error pages resulting from errors like network outage, no network, or DNS
+  //   error can reasonably expect that a reload at a later point in time would
+  //   work. These should be allowed to transfer away from the current process:
+  //   they do belong to whichever process that will host the destination URL,
+  //   as a reload will end up committing in that process anyway.
+  // * Error pages that arise during browser-initiated navigations to blocked
+  //   URLs should be allowed to transfer away from the current process, which
+  //   didn't request the navigation and may have a higher privilege level than
+  //   the blocked destination.
   RenderFrameHostImpl* render_frame_host = nullptr;
-  if (net_error == net::ERR_BLOCKED_BY_CLIENT) {
+  if (net_error == net::ERR_BLOCKED_BY_CLIENT && !browser_initiated()) {
     render_frame_host = frame_tree_node_->current_frame_host();
   } else {
     render_frame_host =
         frame_tree_node_->render_manager()->GetFrameHostForNavigation(*this);
   }
 
   // Don't ask the renderer to commit an URL if the browser will kill it when
   // it does.
   DCHECK(render_frame_host->CanCommitURL(common_params_.url));
 
@@ skipping 203 matching lines @@
   DCHECK_EQ(request_params_.has_user_gesture, begin_params_.has_user_gesture);
 
   render_frame_host->CommitNavigation(response_.get(), std::move(body_),
                                       std::move(handle_), common_params_,
                                       request_params_, is_view_source_);
 
   frame_tree_node_->ResetNavigationRequest(true, true);
 }
 
 }  // namespace content