Exempt about: URLs from self-reference check for nested frames

third_party/WebKit/Source/core/frame/LocalFrame.cpp

Index: third_party/WebKit/Source/core/frame/LocalFrame.cpp
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.cpp b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
index 323d50475cdcb4b872ed4d2ae4631dc1af0587da..4c5e763458b6cdeb52ee451cd1f3e99d20d665ea 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrame.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
@@ -754,6 +754,10 @@ EphemeralRange LocalFrame::rangeForPoint(const IntPoint& framePoint)
 
 bool LocalFrame::isURLAllowed(const KURL& url) const
 {
+    // srcdoc is always allowed
+    if (equalIgnoringFragmentIdentifier(document()->completeURL(AtomicString("about:srcdoc")), url))

[dcheng, 2015/10/29 14:47:07]

How about using Document::isSrcdocDocument() instead? Also, this should be
integrated into the for loop below: otherwise, you can use srcdoc to break the
self-reference checker.

+        return true;
+
     // We allow one level of self-reference because some sites depend on that,
     // but we don't allow more than one.
     bool foundSelfReference = false;