commit 57b48499000515a4d8ebee662f35ec92c4ebe9f7
author Haxatron Sec <haxatron1@gmail.com> Wed Sep 13 19:57:30 2023
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Sep 13 19:57:30 2023
tree 413f8a5352c07ae3bab5112d3e1255ea65d8575d
parent 867b39ee0ef07e6a3427b4e7f3f3c19aa7d6e7b9

Do not hang the renderer if attempting to open document pip window from about:blank URL

When a parent window opens an about:blank window, the new window will inherit its document URL from the parent window while the URL in the omnibox shows "about:blank". This means that the renderer code in  https://chromium-review.googlesource.com/c/chromium/src/+/4595397 fails to detect that the URL in the omnibox is about:blank and cause the code to reach  https://chromium-review.googlesource.com/c/chromium/src/+/4746980 without a compromised  renderer. This will cause the browser to report bad_message and instruct the renderer to hang,  which doesn't have any security implications but it isn't nice.

Unfortunately, AFAICT, there isn't a way to detect the exact URL (whether it is about:blank or not) in the omnibox from the renderer. Therefore, change the browser-side code such that attempting to open document pip windows from such URLs doesn't hang the renderer.

Fixed: 1460025

Change-Id: I355bcfbc8ba791f73645cdcc4e546186706e199f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4853095
Commit-Queue: Ken Buchanan <kenrb@chromium.org>
Reviewed-by: Tommy Steimel <steimel@chromium.org>
Reviewed-by: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1196209}