Don't do cross-process navigations in subframes unless --site-per-process.

BUG=499972
TEST=NavigateFrameToURL works for cross-site subframes by default.

Review URL: https://codereview.chromium.org/1185703005

Cr-Commit-Position: refs/heads/master@{#334291}

3 files changed, 36 insertions, 1 deletions

diff --git a/content/browser/frame_host/navigation_controller_impl_browsertest.cc b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
index 82fb779..ff9f3ad 100644
--- a/content/browser/frame_host/navigation_controller_impl_browsertest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
@@ -41,6 +41,33 @@ class NavigationControllerBrowserTest : public ContentBrowserTest {
   }
 };
 
+// Ensure that tests can navigate subframes cross-site in both default mode and
+// --site-per-process, but that they only go cross-process in the latter.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, LoadCrossSiteSubframe) {
+  // Load a main frame with a subframe.
+  GURL main_url(embedded_test_server()->GetURL(
+      "/navigation_controller/page_with_iframe.html"));
+  NavigateToURL(shell(), main_url);
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+  ASSERT_EQ(1U, root->child_count());
+  ASSERT_NE(nullptr, root->child_at(0));
+
+  // Use NavigateFrameToURL to go cross-site in the subframe.
+  GURL foo_url(embedded_test_server()->GetURL(
+      "foo.com", "/navigation_controller/simple_page_1.html"));
+  NavigateFrameToURL(root->child_at(0), foo_url);
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  // We should only have swapped processes in --site-per-process.
+  bool cross_process = root->current_frame_host()->GetProcess() !=
+                       root->child_at(0)->current_frame_host()->GetProcess();
+  EXPECT_EQ(base::CommandLine::ForCurrentProcess()->HasSwitch(
+                switches::kSitePerProcess),
+            cross_process);
+}
+
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, LoadDataWithBaseURL) {
   const GURL base_url("http://baseurl");
   const GURL history_url("http://historyurl");
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 952b0b0..abff2f7 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -1958,6 +1958,13 @@ RenderFrameHostImpl* RenderFrameHostManager::UpdateStateForNavigate(
     bool dest_is_view_source_mode,
     const GlobalRequestID& transferred_request_id,
     int bindings) {
+  // Don't swap for subframes unless we are in --site-per-process.  We can get
+  // here in tests for subframes (e.g., NavigateFrameToURL).
+  if (!frame_tree_node_->IsMainFrame() &&
+      !base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kSitePerProcess))
+    return render_frame_host_.get();
+
   // If we are currently navigating cross-process, we want to get back to normal
   // and then navigate as usual.
   if (pending_render_frame_host_)
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 4b50c00..1e31837 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -1995,7 +1995,8 @@ bool WebContentsImpl::NavigateToPendingEntry(
   FrameTreeNode* node = frame_tree_.root();
 
   // Navigate in the FrameTreeNode specified in the pending entry, if any.  This
-  // is currently only used in --site-per-process and tests.
+  // is currently only used in --site-per-process and tests
+  // (e.g., NavigateFrameToURL).
   // TODO(creis): Remove this method and NavigationEntryImpl::frame_tree_node_id
   // by using FrameNavigationEntries instead.  See https://crbug.com/236848.
   NavigationEntryImpl* pending_entry = controller_.GetPendingEntry();