Exempt about: URLs from self-reference check for nested frames

third_party/WebKit/LayoutTests/fast/frames/deep-nested-about-blank.html

Index: third_party/WebKit/LayoutTests/fast/frames/deep-nested-about-blank.html
diff --git a/third_party/WebKit/LayoutTests/fast/frames/deep-nested-about-blank.html b/third_party/WebKit/LayoutTests/fast/frames/deep-nested-about-blank.html
new file mode 100644
index 0000000000000000000000000000000000000000..e40f97f54c1ab5498bf96e917b2c736d3a2983e4
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/frames/deep-nested-about-blank.html
@@ -0,0 +1,17 @@
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+window.onload = function() {
+    var frames = new Set();
+    var win = window;
+    for (i = 0; i < 10; i++) {
+        var frame = win.document.createElement('iframe');
+        win.document.body.appendChild(frame);
+        frames.add(frame);
+        win = win[0];
+    }
+    test(function() {
+            frames.forEach( function(value) { assert_not_equals(value.clientHeight, 0) } )

[dcheng, 2015/11/18 03:23:18]

How come this can't use a check for contentDocument?

[Xiaocheng, 2015/11/18 10:26:00]

TL;DR: For a nested frame created in this way, its contentDocument is always
non-null as soon as appendChild is executed, regardless of whether it is
displayed. 

The contentDocument becomes non-null after appendChild is called. I digged a
little bit into the implementation of appendChild, which does the following:
1. Modify the DOM tree.
2. Call HTMLFrameElementBase::isURLAllowed to checks if the frame's URL is
allowed. This method returns true immediately if the URL is the empty string,
and otherwise calls the self-reference checker LocalFrame::isURLAllowed.
3. If the URL is an empty string, replace it by "about:blank".
4. If the previous step returns true, load the contentDocument.
5. Set the LayoutObject for the contentDocument. This step calls
LocalFrame::isURLAllowed again, and aborts if it gets false.

createElement('iframe') returns an iframe whose URL is the empty string instead
of "about:blank". Therefore, in the execution of appendChild, it passes step 2
and gets a non-null contentDocument in step 4. However, since its URL has
already become "about:blank" in step 5, it fails the self-reference checker, and
hence, is not displayed.

[dcheng, 2015/11/18 21:32:51]

Hmm. I think there's some room for cleanup in the code here.

We have:
- HTMLFrameElementBase::isURLAllowed which does an empty string check and
javascript: URL check, and then calls LocalFrame::isURLAllowed.
- HTMLPlugInElement::allowedToLoadFrameURL which just does a javascript: URL
check, and then calls LocalFrame::isURLAllowed.
- LocalFrame::isURLAllowed which is just the self-reference check (and now
about: protocol) check.

Can we simplify this so it's not so weird?

+        }, "all nested about:blank iframes should be displayed correctly");

[dcheng, 2015/11/18 03:23:18]

Nit: "nested about:blank iframes should not be blocked as self-referential
frames."

[Xiaocheng, 2015/11/18 10:26:00]

Done.

+}
+</script>