BTW: full expected error message:

CONSOLE ERROR: line 8: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html'. The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor is it processing a user gesture. See https://www.chromestatus.com/features/5851021045661696.

I'll put together a CL to disable (for now) the test with --site-per-process flag.

Actually, I see that third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture-expected.txt didn't conver the console messages until r434375.  So maybe, it would be find to just disable console output for this test.

Nevertheless to make the site isolation bot green, I probably should still land first a CL that disables the CL with --site-per-process.

Also - note that we have other issues around console message differences when OOPIFs are present - for example see  issue 619662  and  issue 602497 .

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a066b28c6d14ca55c6262f4bfb90084b0a885bdb

commit a066b28c6d14ca55c6262f4bfb90084b0a885bdb
Author: lukasza <lukasza@chromium.org>
Date: Tue Nov 29 00:17:16 2016

OOPIF test expectation for xss-DENIED-top-navigation-without-user-gesture.html

BUG=669083
NOTRY=true

Review-Url: https://codereview.chromium.org/2537613002
Cr-Commit-Position: refs/heads/master@{#434794}

[modify] https://crrev.com/a066b28c6d14ca55c6262f4bfb90084b0a885bdb/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process

We are trying to ship Strict Site Isolation (aka site-per-process) "soon" (aiming for M67 at the moment).  I assume that there is nothing here that would block this launch (i.e. it is okay it console messages in OOPIFs include only the origin and not the full URL).

If the above sounds okay, then the only decision to be made here is to either
1. Forever skip this test in the (soon-to-be-default) site-per-process mode
or
2. Update console message emitted by the product code, so that it only includes the origin (even if site-per-process is not enabled)