Avoid renderer kills for extension URLs in the wrong extension process.

We should track down the cause, but the intent of the restriction is to
prevent web processes from committing extension URLs, so make an
exception for now.

BUG=840857

Change-Id: I5259f870140896400eb076b870981750a9ff73cd
Reviewed-on: https://chromium-review.googlesource.com/1120840
Commit-Queue: Charlie Reis <creis@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#571626}

chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc

@@ -438,10 +438,23 @@ bool ChromeContentBrowserClientExtensionsPart::CanCommitURL(
   if (!extension)
     return true;
 
-  // If the process is the dedicated process for this extension, then it's safe
-  // to commit.
-  if (ProcessMap::Get(process_host->GetBrowserContext())
-          ->Contains(extension->id(), process_host->GetID())) {
+  // If the process is a dedicated process for this extension, then it's safe to
+  // commit. This accounts for cases where an extension might have multiple
+  // processes, such as incognito split mode.
+  ProcessMap* process_map = ProcessMap::Get(process_host->GetBrowserContext());
+  if (process_map->Contains(extension->id(), process_host->GetID())) {
+    return true;
+  }
+
+  // TODO(creis): We're seeing cases where an extension URL commits in an
+  // extension process but not one registered for it in ProcessMap. This is
+  // surprising and we do not yet have repro steps for it. We should fix this,
+  // but we're primarily concerned with preventing web processes from committing
+  // an extension URL, which is more severe. (Extensions currently share
+  // processes with each other anyway.) Allow it for now, as long as this is an
+  // extension and not a hosted app.
+  if (GetProcessPrivilege(process_host, process_map, registry) ==
+      PRIV_EXTENSION) {
     return true;
   }