Commit empty document instead of canceling the load for blocked CSP/XFO responses.

third_party/WebKit/Source/core/dom/DocumentInit.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
@@ skipping 86 matching lines @@
     if (m_frame)
         return m_frame;
     if (m_importsController)
         return m_importsController->master()->frame();
     return 0;
 }
 
 SandboxFlags DocumentInit::getSandboxFlags() const
 {
     ASSERT(frameForSecurityContext());
-    return frameForSecurityContext()->loader().effectiveSandboxFlags();
+    FrameLoader* loader = &frameForSecurityContext()->loader();
+    SandboxFlags flags = loader->effectiveSandboxFlags();
+
+    // If the load was blocked by X-Frame-Options or CSP, force the Document's
+    // origin to be unique, so that the blocked document appears to be a normal
+    // cross-origin document's load per CSP spec:
+    // https://www.w3.org/TR/CSP2/#directive-frame-ancestors
+    if (loader->documentLoader() && loader->documentLoader()->wasBlockedAfterXFrameOptionsOrCSP())
+        flags |= SandboxOrigin;
+
+    return flags;
 }
 
 bool DocumentInit::shouldEnforceStrictMixedContentChecking() const
 {
     ASSERT(frameForSecurityContext());
     return frameForSecurityContext()->loader().shouldEnforceStrictMixedContentChecking();
 }
 
 SecurityContext::InsecureRequestsPolicy DocumentInit::getInsecureRequestsPolicy() const
 {
@@ skipping 59 matching lines @@
     return m_contextDocument;
 }
 
 DocumentInit DocumentInit::fromContext(WeakPtrWillBeRawPtr<Document> contextDocument, const KURL& url)
 {
     return DocumentInit(url, 0, contextDocument, 0);
 }
 
 } // namespace blink