Allow "cross-origin" navigations from about:blank in AreURLsInPageNavigation

Allow "cross-origin" navigations from about:blank in AreURLsInPageNavigation

This can happen when an iframe is opened, then popualted via a document.write()
from its parent. This will cause the url to change to the parent's url, but the
browser process will not be notified of this url change. If the iframe then
attempts a fragment navigation, it looks like a cross-origin navigation from
about:blank.

BUG=390798
TEST=Added case to NavigationControllerTest.IsInPageNavigation

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=282679

[Nate Chapin, 2014-07-08 20:07:58]

nasko: PTAL

abarth: Does this seem like a reasonable way to handle the url change that
happens when one document write()s another, while still ensuring we catch
renderer attempts to do a cross-origin same-document navigation?

[abarth-chromium, 2014-07-09 06:58:34]

On 2014/07/08 at 20:07:58, japhet wrote:
> abarth: Does this seem like a reasonable way to handle the url change that
happens when one document write()s another, while still ensuring we catch
renderer attempts to do a cross-origin same-document navigation?

It makes sense to handle the is_empty case the same way as about:blank.  I don't
know what the consequence of this change is, however.

[nasko, 2014-07-09 07:11:17]

https://codereview.chromium.org/372403002/diff/1/content/browser/frame_host/n...
File content/browser/frame_host/navigation_controller_impl.cc (right):

https://codereview.chromium.org/372403002/diff/1/content/browser/frame_host/n...
content/browser/frame_host/navigation_controller_impl.cc:126: existing_url ==
GURL(url::kAboutBlankURL) ||
Shouldn't this only apply if there is no session history? It looks like any
navigation to about:blank anywhere in the history will allow this true.

[Nate Chapin, 2014-07-09 19:09:19]

On 2014/07/09 07:11:17, nasko (in Munich) wrote:
>
https://codereview.chromium.org/372403002/diff/1/content/browser/frame_host/n...
> File content/browser/frame_host/navigation_controller_impl.cc (right):
> 
>
https://codereview.chromium.org/372403002/diff/1/content/browser/frame_host/n...
> content/browser/frame_host/navigation_controller_impl.cc:126: existing_url ==
> GURL(url::kAboutBlankURL) ||
> Shouldn't this only apply if there is no session history? It looks like any
> navigation to about:blank anywhere in the history will allow this true.

It should be if this is the first navigation in the given frame. But if it's an
iframe (as in the repro website in bug 390798), then there probably is an entry
from the main frame in the session history. I don't immediately see a way to
observe the needed state from the browser process at this time, though maybe I'm
missing it (I assume this will be possible as site isolation progresses, at
which point we should tighten the check).

[nasko, 2014-07-10 09:41:01]

Please add a TODO or a comment so we don't forget to get this done.

LGTM

[Nate Chapin, 2014-07-11 17:39:58]

The CQ bit was checked by japhet@chromium.org

[commit-bot: I haz the power, 2014-07-11 17:41:00]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/japhet@chromium.org/372403002/20001

[commit-bot: I haz the power, 2014-07-11 20:06:06]

Change committed as 282679

[vapier, 2014-07-13 16:52:01]

i guess your BUG line is incorrect.  you probably want to mention the real BUG #
here for posterity (and update the bug in question with the CLs that landed).

[Nate Chapin, 2014-07-14 17:53:24]

On 2014/07/13 16:52:01, vapier wrote:
> i guess your BUG line is incorrect.  you probably want to mention the real BUG
#
> here for posterity (and update the bug in question with the CLs that landed).

Ah, yeah, there was a typo. Should have been 390796