If a RemoteFrame asks to navigate, send an OpenURL IPC

content/renderer/render_frame_proxy.cc

Index: content/renderer/render_frame_proxy.cc
diff --git a/content/renderer/render_frame_proxy.cc b/content/renderer/render_frame_proxy.cc
index 11ee8108dae9a7e6489d52d28da7af518d7a7620..694502aaef5ab451f117d4552e1ec7f4ed85aa45 100644
--- a/content/renderer/render_frame_proxy.cc
+++ b/content/renderer/render_frame_proxy.cc
@@ -16,6 +16,7 @@
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
+#include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
 #include "third_party/WebKit/public/web/WebView.h"
 
 namespace content {
@@ -287,4 +288,22 @@ void RenderFrameProxy::postMessageEvent(
   Send(new ViewHostMsg_RouteMessageEvent(render_view_->GetRoutingID(), params));
 }
 
+void RenderFrameProxy::navigate(blink::WebRemoteFrame* frame,
+                                const blink::WebURLRequest& request,
+                                bool should_replace_current_entry) {
+  DCHECK_EQ(web_frame_, frame);
+
+  FrameHostMsg_OpenURL_Params params;
+  params.url = request.url();
+  params.referrer = Referrer(
+      GURL(request.httpHeaderField(blink::WebString::fromUTF8("Referer"))),
+      request.referrerPolicy());
+  params.disposition = CURRENT_TAB;
+  params.should_replace_current_entry = should_replace_current_entry;
+  params.user_gesture =
+      blink::WebUserGestureIndicator::isProcessingUserGesture();
+  blink::WebUserGestureIndicator::consumeUserGesture();
+  Send(new FrameHostMsg_OpenURL(routing_id_, params));

[Charlie Reis, 2014/09/17 21:31:41]

I'm surprised this has an effect in the browser process.  Doesn't it get
delivered to RenderFrameProxyHost::OnMessageReceived when render_frame_host_ is
null?  (RenderFrameProxyHosts only have render_frame_host_'s for main frames.)

+}
+
 }  // namespace