Check for empty security info when sending security info to devtools

content/child/web_url_loader_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/web_url_loader_impl.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 277 matching lines @@
                                 bool report_security_info) {
   if (!report_security_info) {
     response->setSecurityStyle(WebURLResponse::SecurityStyleUnknown);
     return;
   }
   if (!url.SchemeIsCryptographic()) {
     response->setSecurityStyle(WebURLResponse::SecurityStyleUnauthenticated);
     return;
   }
 
+  // There are cases where an HTTPS request can come in without security
+  // info attached (such as a redirect response).

[davidben, 2015/08/11 12:17:10]

(Huh, we don't send down security info in this case? An extension-simulated
redirect certainly would do it, but I would have thought it'd be available for
redirects.)

+  if (security_info.empty()) {
+    response->setSecurityStyle(WebURLResponse::SecurityStyleUnknown);
+    return;
+  }
+
   SSLStatus ssl_status;
   if (!DeserializeSecurityInfo(security_info, &ssl_status)) {
     response->setSecurityStyle(WebURLResponse::SecurityStyleUnknown);
     DLOG(ERROR)
         << "DeserializeSecurityInfo() failed for an authenticated request.";
     return;
   }
 
   int ssl_version =
       net::SSLConnectionStatusToVersion(ssl_status.connection_status);
@@ skipping 836 matching lines @@
                                          int intra_priority_value) {
   context_->DidChangePriority(new_priority, intra_priority_value);
 }
 
 bool WebURLLoaderImpl::attachThreadedDataReceiver(
     blink::WebThreadedDataReceiver* threaded_data_receiver) {
   return context_->AttachThreadedDataReceiver(threaded_data_receiver);
 }
 
 }  // namespace content