If a RemoteFrame asks to navigate, send an OpenURL IPC

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <map>
 
 #include "base/lazy_instance.h"
 #include "content/child/webmessageportchannel_impl.h"
 #include "content/common/frame_messages.h"
 #include "content/common/swapped_out_messages.h"
 #include "content/common/view_messages.h"
 #include "content/renderer/child_frame_compositing_helper.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
+#include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
 #include "third_party/WebKit/public/web/WebView.h"
 
 namespace content {
 
 namespace {
 
 // Facilitates lookup of RenderFrameProxy by routing_id.
 typedef std::map<int, RenderFrameProxy*> RoutingIDProxyMap;
 static base::LazyInstance<RoutingIDProxyMap> g_routing_id_proxy_map =
     LAZY_INSTANCE_INITIALIZER;
@@ skipping 251 matching lines @@
   if (source_frame) {
     RenderViewImpl* source_view =
         RenderViewImpl::FromWebView(source_frame->view());
     if (source_view)
       params.source_routing_id = source_view->routing_id();
   }
 
   Send(new ViewHostMsg_RouteMessageEvent(render_view_->GetRoutingID(), params));
 }
 
+void RenderFrameProxy::navigate(blink::WebRemoteFrame* frame,
+                                const blink::WebURLRequest& request,
+                                bool should_replace_current_entry) {
+  DCHECK_EQ(web_frame_, frame);
+
+  FrameHostMsg_OpenURL_Params params;
+  params.url = request.url();
+  params.referrer = Referrer(
+      GURL(request.httpHeaderField(blink::WebString::fromUTF8("Referer"))),
+      request.referrerPolicy());
+  params.disposition = CURRENT_TAB;
+  params.should_replace_current_entry = should_replace_current_entry;
+  params.user_gesture =
+      blink::WebUserGestureIndicator::isProcessingUserGesture();
+  blink::WebUserGestureIndicator::consumeUserGesture();
+  Send(new FrameHostMsg_OpenURL(routing_id_, params));

[Charlie Reis, 2014/09/17 21:31:41]

I'm surprised this has an effect in the browser process.  Doesn't it get
delivered to RenderFrameProxyHost::OnMessageReceived when render_frame_host_ is
null?  (RenderFrameProxyHosts only have render_frame_host_'s for main frames.)

+}
+
 }  // namespace