OOPIF: Data URLs are now rendered in the renderer that initiated the navigation.

content/browser/frame_host/navigator_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigator_impl.h"
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
 #include "base/time/time.h"
 #include "content/browser/frame_host/frame_tree.h"
@@ skipping 598 matching lines @@
   // about:blank should not "use up" a new SiteInstance.  The SiteInstance can
   // still be used for a normal web site.
   if (url == GURL(url::kAboutBlankURL))
     return false;
 
   // The embedder will then have the opportunity to determine if the URL
   // should "use up" the SiteInstance.
   return GetContentClient()->browser()->ShouldAssignSiteForURL(url);
 }
 
-void NavigatorImpl::RequestOpenURL(
-    RenderFrameHostImpl* render_frame_host,
-    const GURL& url,
-    const Referrer& referrer,
-    WindowOpenDisposition disposition,
-    bool should_replace_current_entry,
-    bool user_gesture) {
+void NavigatorImpl::RequestOpenURL(RenderFrameHostImpl* render_frame_host,
+                                   const GURL& url,
+                                   SiteInstance* site_instance,
+                                   const Referrer& referrer,
+                                   WindowOpenDisposition disposition,
+                                   bool should_replace_current_entry,
+                                   bool user_gesture) {
   SiteInstance* current_site_instance =
       GetRenderManager(render_frame_host)->current_frame_host()->
           GetSiteInstance();
   // If this came from a swapped out RenderFrameHost, we only allow the request
   // if we are still in the same BrowsingInstance.
   // TODO(creis): Move this to RenderFrameProxyHost::OpenURL.

[Charlie Reis, 2014/11/20 19:58:43]

Side note: There's a lot of cleanup needed here, which I'll look into. 
RequestOpenURL should probably take in a FrameTreeNode rather than a
RenderFrameHostImpl, and this check needs to be moved to RenderFrameProxyHost.

I mention because it's relevant to what information we have on hand for fixing
this bug.  It seems like we may want some notion of which RFH/RFPH initiated the
navigation in a few places (e.g., when deciding which SiteInstance to use for
data URLs, what to pass to WebContentsObserver::DidOpenRequestedURL).  Maybe a
source_site_instance is useful after all.

   if (render_frame_host->is_swapped_out() &&
       !render_frame_host->GetSiteInstance()->IsRelatedSiteInstance(
           current_site_instance)) {
     return;
   }
 
   // Delegate to RequestTransferURL because this is just the generic
   // case where |old_request_id| is empty.
   // TODO(creis): Pass the redirect_chain into this method to support client
   // redirects.  http://crbug.com/311721.
   std::vector<GURL> redirect_chain;
-  RequestTransferURL(render_frame_host,
-                     url,
-                     redirect_chain,
-                     referrer,
-                     ui::PAGE_TRANSITION_LINK,
-                     disposition,
-                     GlobalRequestID(),
-                     should_replace_current_entry,
+  RequestTransferURL(render_frame_host, url, site_instance, redirect_chain,
+                     referrer, ui::PAGE_TRANSITION_LINK, disposition,
+                     GlobalRequestID(), should_replace_current_entry,
                      user_gesture);
 }
 
 void NavigatorImpl::RequestTransferURL(
     RenderFrameHostImpl* render_frame_host,
     const GURL& url,
+    SiteInstance* site_instance,
     const std::vector<GURL>& redirect_chain,
     const Referrer& referrer,
     ui::PageTransition page_transition,
     WindowOpenDisposition disposition,
     const GlobalRequestID& transferred_global_request_id,
     bool should_replace_current_entry,
     bool user_gesture) {
   GURL dest_url(url);
   SiteInstance* current_site_instance =
       GetRenderManager(render_frame_host)->current_frame_host()->
           GetSiteInstance();
   if (!GetContentClient()->browser()->ShouldAllowOpenURL(
           current_site_instance, url)) {
     dest_url = GURL(url::kAboutBlankURL);
   }
 
   int64 frame_tree_node_id = -1;
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSitePerProcess)) {
     frame_tree_node_id =
         render_frame_host->frame_tree_node()->frame_tree_node_id();
   }
   OpenURLParams params(
       dest_url, referrer, frame_tree_node_id, disposition, page_transition,
       true /* is_renderer_initiated */);
+  params.site_instance = site_instance;
   if (redirect_chain.size() > 0)
     params.redirect_chain = redirect_chain;
   params.transferred_global_request_id = transferred_global_request_id;
   params.should_replace_current_entry = should_replace_current_entry;
   params.user_gesture = user_gesture;
 
   if (GetRenderManager(render_frame_host)->web_ui()) {
     // Web UI pages sometimes want to override the page transition type for
     // link clicks (e.g., so the new tab page can specify AUTO_BOOKMARK for
     // automatically generated suggestions).  We don't override other types
@@ skipping 230 matching lines @@
         "Navigation.TimeToCommit_ExistingRenderer_BeforeUnloadDiscounted",
         time_to_commit);
     UMA_HISTOGRAM_TIMES(
         "Navigation.TimeToURLJobStart_ExistingRenderer_BeforeUnloadDiscounted",
         time_to_network);
   }
   navigation_data_.reset();
 }
 
 }  // namespace content