Prevent the browser process from creating duplicate RenderViewHosts.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index e05cab0f097872512e1ae9eee65624193aa7bcf7..b9f41ed13e1ebda764b087ebb571ccbe4a59379a 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -12,6 +12,7 @@
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/stats_counters.h"
+#include "base/process/process.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
@@ -73,6 +74,7 @@
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/page_zoom.h"
+#include "content/public/common/result_codes.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/mime_util.h"
 #include "net/base/net_util.h"
@@ -1252,6 +1254,7 @@ void WebContentsImpl::LostMouseLock() {
 }
 
 void WebContentsImpl::CreateNewWindow(
+    int render_process_id,
     int route_id,

[Charlie Reis, 2013/12/02 22:25:34]

I had trouble following how route_id could be used in the opener_suppressed
case, but that's set to MSG_ROUTING_NONE by RenderWidgetHelper.  Let's add a
DCHECK to help make that explicit and discoverable.

[nasko, 2013/12/02 22:51:08]

Done.

     int main_frame_route_id,
     const ViewHostMsg_CreateWindow_Params& params,
@@ -1267,6 +1270,21 @@ void WebContentsImpl::CreateNewWindow(
       SiteInstance::CreateForURL(GetBrowserContext(), params.target_url) :
       GetSiteInstance();
 
+  // A message to create a new window can only come from the active process for
+  // this WebContentsImpl instance. If any other process sends the request,
+  // it is invalid and the process must be terminated.
+  if (GetRenderProcessHost() &&

[Charlie Reis, 2013/12/02 22:25:34]

nit: No need to check for null here.  This should always be valid, and we would
have crashed on line 1266 if not anyway.

[nasko, 2013/12/02 22:51:08]

Done.

+      GetRenderProcessHost()->GetID() != render_process_id) {
+    base::ProcessHandle process_handle =
+        RenderProcessHost::FromID(render_process_id)->GetHandle();
+    if (process_handle != base::kNullProcessHandle) {
+      RecordAction(
+          UserMetricsAction("Terminate_ProcessMismatch_CreateNewWindow"));
+      base::KillProcess(process_handle, content::RESULT_CODE_KILLED, false);
+    }
+    return;
+  }
+
   // We must assign the SessionStorageNamespace before calling Init().
   //
   // http://crbug.com/142685