Sync web-platform-tests PR 34879 into mozilla-central (this bug is closed when the sync is complete).
Fix document.referrer on about:blank creation
The HTML Standard assigns
document.referrer  in two ways:
1.) During Document/browsing context creation
2.) Upon navigation to a new Document
For creation (1):
Per the HTML Standard's "create a new browsing context" algorithm  step 3, all new browsing contexts with a non-null creator (always same-BCG) have their "creator URL" set to the creator document's full URL, unredacted and subjected to no referrer policy sanitization. Later in step 20, we set the referrer of the newly-created document to the newly-created browsing context's creator URL.
For navigation (2):
In "create and initialize a Document object", with the referrer from
"navigation params" 
In Blink, we handle
document.referrer assignment the same for both creation and navigation; we simply set
DocumentLoader::referrer_ to what the resulting
WebNavigationParams carries , and we don't do anything special for the browsing context creation case. This leads to the final
document.referrer on Documents being created in new BCs actually being incorrectly subjected to referrer policy sanitization/redaction.
Due to existing issues, Chrome does not perfectly follow the HTML Standard for creation of new browsing contexts. In short, for iframes we create a new browsing context/document  and immediately navigate it to about:blank . This navigation commits synchronously via a special
path that tries to make up for Blink's mismatch with the spec .
During this synchronous about:blank navigation, the request's referrer is computed as "" (in FrameLoadRequest::ctor), because the origin of the "about:blank" URL is opaque and therefore cross-origin with the embedder, and the default referrer policy is
For newly created windows (with openers, since this is only relevant for windows with "creators"), something very similar happens. We create a FrameLoadRequest whose referrer gets set to "" (in FrameLoadRequest::ctor as well as ), and we perform the special-case synchronous navigation which ends up with the resulting document having an empty referrer, just like in the iframe case.
This CL fixes the above issues by modifying
RenderFrameImpl::SynchronouslyCommitAboutBlankForBug778318() to find the initiator frame (should be equivalent to the spec's "creator" Document), if it is local (should be the case for about:blank subframes and new windows w/o "noopener"), and sets the navigation params's referrer member to the initiator Document's full unredacted URL. This will be used to set the eventual
DocumentLoader::referrer_ member when the synchronous navigation commits, which will be used to reflect the correct value to
In cases where we don't go through Blink's special sync navigation case,
document.referrer is unchanged.
: https://html.spec.whatwg.org/multipage/dom.html#dom-document-referrer and https://html.spec.whatwg.org/multipage/dom.html#the-document's-referrer