PlzNavigate: blocked browser-initiated navigations should transfer processes sometimes

content/browser/frame_host/navigation_request.cc

Index: content/browser/frame_host/navigation_request.cc
diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index 55eb1ee156e9d58516b5d4eafbb640d93c2d3119..786a0b5907588c28d7899ab7b9f2c232913f340e 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc
@@ -634,18 +634,23 @@ void NavigationRequest::OnRequestFailed(bool has_stale_copy_in_cache,
     return;
   }
 
-  // There are two types of error pages that need to be handled differently.
-  // * Error pages resulting from blocking the request, because the original
-  //   document wasn't even allowed to make the request. In such case,
-  //   the error pages should be committed in the process of the original
-  //   document, to avoid creating a process for the destination.
-  // * Error pages resulting from either network outage (no network, DNS
-  //   error, etc) or similar cases, where the user can reasonably expect that
-  //   a reload at a later point in time can be successful. Such error pages
-  //   do belong to the process that will host the destination URL, as a
-  //   reload will end up committing in that process anyway.
+  // Decide whether to leave the error page in the original process.
+  // * If this was a renderer-initiated navigation, and the request is blocked
+  //   because the initiating document wasn't allowed to make the request,
+  //   commit the error in the existing process. This is a strategy to to avoid
+  //   creating a process for the destination, which may belong to an origin
+  //   with a higher privilege level.
+  // * Error pages resulting from errors like network outage, no network, or DNS
+  //   error can reasonably expect that a reload at a later point in time would
+  //   work. These should be allowed to transfer away from the current process:
+  //   they do belong to whichever process that will host the destination URL,
+  //   as a reload will end up committing in that process anyway.
+  // * Error pages that arise during browser-initiated navigations to blocked
+  //   URLs should be allowed to transfer away from the current process, which
+  //   didn't request the navigation and may have a higher privilege level than
+  //   the blocked destination.
   RenderFrameHostImpl* render_frame_host = nullptr;
-  if (net_error == net::ERR_BLOCKED_BY_CLIENT) {
+  if (net_error == net::ERR_BLOCKED_BY_CLIENT && !browser_initiated()) {
     render_frame_host = frame_tree_node_->current_frame_host();
   } else {
     render_frame_host =