Don't create ServiceWorkerProviderHost for sandboxed frames without allow-same-origin flag.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 
 #include "base/auto_reset.h"
@@ skipping 2041 matching lines @@
 blink::WebServiceWorkerProvider* RenderFrameImpl::createServiceWorkerProvider(
     blink::WebLocalFrame* frame) {
   DCHECK(!frame_ || frame_ == frame);
   // At this point we should have non-null data source.
   DCHECK(frame->dataSource());
   if (!ChildThreadImpl::current())
     return NULL;  // May be null in some tests.
   ServiceWorkerNetworkProvider* provider =
       ServiceWorkerNetworkProvider::FromDocumentState(
           DocumentState::FromDataSource(frame->dataSource()));
+  DCHECK(provider);
   return new WebServiceWorkerProviderImpl(
       ChildThreadImpl::current()->thread_safe_sender(),
-      provider ? provider->context() : NULL);
+      provider->context());
 }
 
 void RenderFrameImpl::didAccessInitialDocument(blink::WebLocalFrame* frame) {
   DCHECK(!frame_ || frame_ == frame);
   // If the request hasn't yet committed, notify the browser process that it is
   // no longer safe to show the pending URL of the main frame, since a URL spoof
   // is now possible. (If the request has committed, the browser already knows.)
   if (!frame->parent()) {
     DocumentState* document_state =
         DocumentState::FromDataSource(frame->dataSource());
@@ skipping 378 matching lines @@
       default:
         NOTREACHED();
     }
   }
 
   // Create the serviceworker's per-document network observing object if it
   // does not exist (When navigation happens within a page, the provider already
   // exists).
   if (!ServiceWorkerNetworkProvider::FromDocumentState(
           DocumentState::FromDataSource(datasource))) {
+    ServiceWorkerProviderType provider_type =
+        SERVICE_WORKER_PROVIDER_FOR_WINDOW;
+    if ((frame->effectiveSandboxFlags() & blink::WebSandboxFlags::Origin) ==
+        blink::WebSandboxFlags::Origin) {
+      provider_type = SERVICE_WORKER_PROVIDER_FOR_SANDBOXED_FRAME;
+    }
     scoped_ptr<ServiceWorkerNetworkProvider> network_provider(
-        new ServiceWorkerNetworkProvider(routing_id_,
-                                         SERVICE_WORKER_PROVIDER_FOR_WINDOW));
+        new ServiceWorkerNetworkProvider(routing_id_, provider_type));
     ServiceWorkerNetworkProvider::AttachToDocumentState(
         DocumentState::FromDataSource(datasource),
         network_provider.Pass());
   }
 }
 
 void RenderFrameImpl::didStartProvisionalLoad(blink::WebLocalFrame* frame,
                                               double triggering_event_time) {
   DCHECK(!frame_ || frame_ == frame);
   WebDataSource* ds = frame->provisionalDataSource();
@@ skipping 1186 matching lines @@
     RenderFrameImpl::webScreenOrientationClient() {
   if (!screen_orientation_dispatcher_)
     screen_orientation_dispatcher_ = new ScreenOrientationDispatcher(this);
   return screen_orientation_dispatcher_;
 }
 
 bool RenderFrameImpl::isControlledByServiceWorker(WebDataSource& data_source) {
   ServiceWorkerNetworkProvider* provider =
       ServiceWorkerNetworkProvider::FromDocumentState(
           DocumentState::FromDataSource(&data_source));
+  if (!provider->context())
+    return false;
   return provider->context()->controller_handle_id() !=
       kInvalidServiceWorkerHandleId;
 }
 
 int64_t RenderFrameImpl::serviceWorkerID(WebDataSource& data_source) {
   ServiceWorkerNetworkProvider* provider =
       ServiceWorkerNetworkProvider::FromDocumentState(
           DocumentState::FromDataSource(&data_source));
-
-  if (provider->context()->controller())
+  if (provider->context() && provider->context()->controller())
     return provider->context()->controller()->version_id();
   return kInvalidServiceWorkerVersionId;
 }
 
 void RenderFrameImpl::postAccessibilityEvent(const blink::WebAXObject& obj,
                                              blink::WebAXEvent event) {
   HandleWebAccessibilityEvent(obj, event);
 }
 
 void RenderFrameImpl::handleAccessibilityFindInPageResult(
@@ skipping 1269 matching lines @@
 #elif defined(ENABLE_BROWSER_CDMS)
         cdm_manager_,
 #endif
         this);
   }
 
   return cdm_factory_;
 }
 
 }  // namespace content