Don't focus a frame target by a link or a form submit, only window.open()

Bug: 966975
Test: fast/loader/iframe-navigation-stealing-focus.html
Change-Id: Ife6548f349e9cecca2ad13fcd549fa07ad01499d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1627756Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#664502}

third_party/blink/renderer/core/frame/local_dom_window.cc

@@ -93,6 +93,7 @@
 #include "third_party/blink/renderer/core/loader/document_loader.h"
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 #include "third_party/blink/renderer/core/page/create_window.h"
+#include "third_party/blink/renderer/core/page/focus_controller.h"
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/page/scrolling/scrolling_coordinator.h"
 #include "third_party/blink/renderer/core/page/scrolling/snap_coordinator.h"
@@ -1522,6 +1523,18 @@ DOMWindow* LocalDOMWindow::open(v8::Isolate* isolate,
   if (!result.frame)
     return nullptr;
 
+  // If the navigation opened a new window, focus is handled during window
+  // creation. If the navigation reused an existing frame in a different page,
+  // FindOrCreateFrameForNavigation() took care of focus. Most navigations don't
+  // refocus when a different frame in the same page is navigated, but
+  // window.open() does. Why?
+  if (result.frame->GetPage() == GetFrame()->GetPage()) {
+    GetFrame()->GetPage()->GetFocusController().SetFocusedFrame(result.frame);
+    // Focusing can fire onblur, so check for detach.
+    if (!result.frame->GetPage())
+      return nullptr;
+  }
+
   if (!completed_url.IsEmpty() || result.new_window)
     result.frame->Navigate(frame_request, WebFrameLoadType::kStandard);
 

third_party/blink/renderer/core/page/frame_tree.cc

@@ -30,7 +30,6 @@
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 #include "third_party/blink/renderer/core/page/create_window.h"
-#include "third_party/blink/renderer/core/page/focus_controller.h"
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/platform/wtf/assertions.h"
 #include "third_party/blink/renderer/platform/wtf/text/cstring.h"
@@ -217,9 +216,7 @@ FrameTree::FindResult FrameTree::FindOrCreateFrameForNavigation(
   }
 
   if (frame && !new_window) {
-    if (frame->GetPage() == current_frame->GetPage())
-      frame->GetPage()->GetFocusController().SetFocusedFrame(frame);
-    else
+    if (frame->GetPage() != current_frame->GetPage())
       frame->GetPage()->GetChromeClient().Focus(current_frame);
     // Focusing can fire onblur, so check for detach.
     if (!frame->GetPage())

third_party/blink/web_tests/fast/loader/iframe-navigation-stealing-focus-expected.txt

+  PASS

third_party/blink/web_tests/fast/loader/iframe-navigation-stealing-focus.html

+<a id="a" target="i" href="about:blank"></a>
+<input id="input" type="text" autofocus="true" onkeydown="a.click()">
+<iframe name="i"></iframe>
+<script>
+window.onload = () => {
+  if (!window.eventSender) {
+    document.body.appendChild(document.createTextNode(
+        "To run manually, type into the input field and see if text appears"));
+    return;
+  }
+  testRunner.dumpAsText();
+  eventSender.keyDown("a");
+  document.body.appendChild(document.createTextNode(
+      input.value == "a" ? "PASS" : "FAIL"));
+};
+</script>