[Extensions] Don't inject scripts into remote frames, null documents.

extensions/renderer/user_script_set.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/user_script_set.h"
 
 #include "base/memory/ref_counted.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/renderer/render_thread.h"
 #include "extensions/common/extension.h"
@@ skipping 187 matching lines @@
   GURL effective_document_url = ScriptContext::GetEffectiveDocumentURL(
       web_frame, document_url, script->match_about_blank());
 
   if (!script->MatchesURL(effective_document_url))
     return injection.Pass();
 
   scoped_ptr<ScriptInjector> injector(new UserScriptInjector(script,
                                                              this,
                                                              is_declarative));
 
-  blink::WebDocument top_document = web_frame->top()->document();
-  // This can be null if site isolation is turned on. The best we can do is to
-  // just give up - generally the wrong behavior, but better than crashing.
+  blink::WebFrame* top_frame = web_frame->top();
+  // It doesn't make sense to do script injection for remote frames, since they
+  // cannot host any documents or content.
   // TODO(kalman): Fix this properly by moving all security checks into the
   // browser. See http://crbug.com/466373 for ongoing work here.
-  if (top_document.isNull())
+  if (top_frame->isWebRemoteFrame())
     return injection.Pass();
 
   if (injector->CanExecuteOnFrame(injection_host.get(), web_frame,
                                   -1,  // Content scripts are not tab-specific.
-                                  top_document.url()) ==
+                                  top_frame->document().url()) ==
       PermissionsData::ACCESS_DENIED) {
     return injection.Pass();
   }
 
   bool inject_css = !script->css_scripts().empty() &&
                     run_location == UserScript::DOCUMENT_START;
   bool inject_js =
       !script->js_scripts().empty() && script->run_location() == run_location;
   if (inject_css || inject_js) {
     injection.reset(new ScriptInjection(
         injector.Pass(),
         web_frame->toWebLocalFrame(),
         injection_host.Pass(),
         run_location,
         tab_id));
   }
   return injection.Pass();
 }
 
 }  // namespace extensions