Ensure frames have the necessary proxies to be discoverable by name.
With OOPIF, when a frame navigates another frame via window.open(url,
name), we must ensure that a proxy for the target named frame exists
in the caller frame's process. This doesn't actually involve creating
this proxy in all SiteInstances in the current BrowsingInstance.
Although Blink uses a global namespace for frame names, it only
returns the target named frame if the caller is allowed to navigate
it, as decided by Frame::canNavigate (corresponding spec: [1]).
Currently, canNavigate may return true in these cases (some also
involve sandboxing checks):
1. Target is the top frame in caller's frame tree.
2. Target is a descendant of the caller.
3. Caller is same-origin with the target or one of its ancestors.
4. The target is a top-level frame and is the caller's opener.
5. The target is a top-level frame and caller has same origin as
an ancestor of the target's opener.
If caller and target frames are in different processes, the right
proxy for the target frame is already created in cases 1-4 by a
combination of CreateProxiesForNewRenderFrameHost,
CreateProxiesForChildFrame, and SwapOutOldFrame. This CL adds support
to handle case 5 (corresponding to [2] in Frame::canNavigate). Note
that we only have to do this for new frames that have a name, or if a
frame without a name acquires a name later.
[1] Case 4 in https://html.spec.whatwg.org/#the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name,
and https://html.spec.whatwg.org/#familiar-with that it references
[2] https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit/Source/core/frame/Frame.cpp&sq=package:chromium&l=247
if (!targetFrame.tree().parent()) {
...
if (canAccessAncestor(origin, targetFrame.client()->opener()))
return true;
BUG=511474
Review URL: https://codereview.chromium.org/1250473008
Cr-Commit-Position: refs/heads/master@{#340381}
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 7be4267..158201d 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -1734,6 +1734,13 @@
partition_id,
session_storage_namespace);
+ // If the new frame has a name, make sure any SiteInstances that can find
+ // this named frame have proxies for it. Must be called after
+ // SetSessionStorageNamespace, since this calls CreateRenderView, which uses
+ // GetSessionStorageNamespace.
+ if (!params.frame_name.empty())
+ new_contents->GetRenderManager()->CreateProxiesForNewNamedFrame();
+
// Save the window for later if we're not suppressing the opener (since it
// will be shown immediately).
if (!params.opener_suppressed) {
