commit 5ce3ecbcdfc196f0341d992da6a6f19d0845029d
author Charlie Reis <creis@chromium.org> Wed Jun 05 23:55:30 2024
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Jun 05 23:55:30 2024
tree 98bd95baa892cf54a0ba5f27c16a4ba3166e3d7b
parent 10ff4750ffb1ad97febe842f5ade82a812cb5b67

Prevent CanCommitURL renderer kills for document.open on error pages.

Failed navigations commit an error page with the failed URL from the
browser process's perspective, but the renderer process uses
kUnreachableWebDataURL instead. This chrome-error://chromewebdata URL
can end up being inherited if document.open() is later used. This does
not normally occur on error pages, but it is possible in Android WebView
apps, leading to CanCommitURL failures because the chrome-error: scheme
has not been granted to the process.

This CL avoids a renderer kill in this scenario by granting access to
the kUnreachableWebDataURL when a process is legitimately committing a
failed navigation.

This CL also avoids checking CanAccessMaybeOpaqueOrigin for the
kUnreachableWebDataURL, since that function cannot compute the expected
process lock when error page isolation is not in effect. The rest of the
checks (including the CPSP::State::CanCommitURL check) still apply.

Bug: 326250356
Change-Id: I2ac56c14ce4dda242d0dd37e8087cd934228d9d2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5601582
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Commit-Queue: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1310986}