Make sure new site instance (and therefore) render is used when navigating away

from blank page (about:blank) that has been loaded in WebUI-bindings-enabled renderer.

This currently reproduces in process models other than default
process-per-site(-instance) as they only enforce new renderer
on webui-vs-regular navigations and fail to recognize that about:blank
might have been loaded in WebUI (as per http://crbug.com/42547).

This CL includes the browser test that reproduces this problem
and verifies the fix.

BUG=424526

Review URL: https://codereview.chromium.org/659293002

Cr-Commit-Position: refs/heads/master@{#300645}

content/browser/frame_host/render_frame_host_manager.cc

@@ -690,7 +690,9 @@ bool RenderFrameHostManager::ShouldSwapBrowsingInstancesForNavigation(
 
   // For security, we should transition between processes when one is a Web UI
   // page and one isn't.
-  if (WebUIControllerFactoryRegistry::GetInstance()->UseWebUIForURL(
+  if (ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+          render_frame_host_->GetProcess()->GetID()) ||
+      WebUIControllerFactoryRegistry::GetInstance()->UseWebUIForURL(
           browser_context, current_effective_url)) {
     // If so, force a swap if destination is not an acceptable URL for Web UI.
     // Here, data URLs are never allowed.
@@ -747,7 +749,8 @@ SiteInstance* RenderFrameHostManager::GetSiteInstanceForNavigation(
   SiteInstance* new_instance = current_instance;
 
   // We do not currently swap processes for navigations in webview tag guests.
-  bool is_guest_scheme = current_instance->GetSiteURL().SchemeIs(kGuestScheme);
+  if (current_instance->GetSiteURL().SchemeIs(kGuestScheme))
+    return current_instance;
 
   // Determine if we need a new BrowsingInstance for this entry.  If true, this
   // implies that it will get a new SiteInstance (and likely process), and that
@@ -765,14 +768,13 @@ SiteInstance* RenderFrameHostManager::GetSiteInstanceForNavigation(
       render_frame_host_->GetSiteInstance()->GetSiteURL();
   bool current_is_view_source_mode = current_entry ?
       current_entry->IsViewSourceMode() : dest_is_view_source_mode;
-  bool force_swap = !is_guest_scheme &&
-      ShouldSwapBrowsingInstancesForNavigation(
-          current_effective_url,
-          current_is_view_source_mode,
-          dest_instance,
-          SiteInstanceImpl::GetEffectiveURL(browser_context, dest_url),
-          dest_is_view_source_mode);
-  if (!is_guest_scheme && (ShouldTransitionCrossSite() || force_swap)) {
+  bool force_swap = ShouldSwapBrowsingInstancesForNavigation(
+      current_effective_url,
+      current_is_view_source_mode,
+      dest_instance,
+      SiteInstanceImpl::GetEffectiveURL(browser_context, dest_url),
+      dest_is_view_source_mode);
+  if (ShouldTransitionCrossSite() || force_swap) {
     new_instance = GetSiteInstanceForURL(
         dest_url,
         dest_instance,

content/browser/frame_host/render_frame_host_manager_browsertest.cc

@@ -1473,4 +1473,27 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, WebUIGetsBindings) {
       new_web_contents->GetRenderViewHost()->GetEnabledBindings());
 }
 
+// crbug.com/424526
+// The test loads a WebUI page in rocess-per-tab mode, then navigates to a blank
+// page and then to a regular page. The bug reproduces if blank page is visited
+// in between WebUI and regular page.
+IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
+                       ForceSwapAfterWebUIBindings) {
+  CommandLine::ForCurrentProcess()->AppendSwitch(switches::kProcessPerTab);
+  ASSERT_TRUE(test_server()->Start());
+
+  const GURL web_ui_url(std::string(kChromeUIScheme) + "://" +
+                        std::string(kChromeUIGpuHost));
+  NavigateToURL(shell(), web_ui_url);
+  EXPECT_TRUE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+      shell()->web_contents()->GetRenderProcessHost()->GetID()));
+
+  NavigateToURL(shell(), GURL(url::kAboutBlankURL));
+
+  GURL regular_page_url(test_server()->GetURL("files/title2.html"));
+  NavigateToURL(shell(), regular_page_url);
+  EXPECT_FALSE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+      shell()->web_contents()->GetRenderProcessHost()->GetID()));
+}
+
 }  // namespace content