Fix scheme check in SiteInstance::IsSameWebSite for nested URLs.

content/browser/site_instance_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_instance_impl.h"
 
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "content/browser/browsing_instance.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ skipping 300 matching lines @@
 
   // If either URL has an isolated origin, compare origins rather than sites.
   url::Origin src_origin(src_url);
   url::Origin dest_origin(dest_url);
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
   if (policy->IsIsolatedOrigin(src_origin) ||
       policy->IsIsolatedOrigin(dest_origin))
     return src_origin == dest_origin;
 
   // If the schemes differ, they aren't part of the same site.
-  //
-  // Note that this happens after the isolated origin check, since blob or
-  // filesystem URLs will fail this check even though they might have the
-  // same origin.
-  //
-  // TODO(alexmos): This check seems broken for nested URLs involving
-  // non-isolated origins too.  See https://crbug.com/726370.
-  if (src_url.scheme() != dest_url.scheme())
+  if (src_origin.scheme() != dest_origin.scheme())
     return false;
 
   return net::registry_controlled_domains::SameDomainOrHost(
-      src_url,
-      dest_url,
+      src_origin, dest_origin,
       net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
 }
 
 // static
 GURL SiteInstance::GetSiteForURL(BrowserContext* browser_context,
                                  const GURL& real_url) {
   // TODO(fsamuel, creis): For some reason appID is not recognized as a host.
   if (real_url.SchemeIs(kGuestScheme))
     return real_url;
 
@@ skipping 114 matching lines @@
             browsing_instance_->browser_context(), site_))
       return;
 
     ChildProcessSecurityPolicyImpl* policy =
         ChildProcessSecurityPolicyImpl::GetInstance();
     policy->LockToOrigin(process_->GetID(), site_);
   }
 }
 
 }  // namespace content