Disallow use of Web Bluetooth from cross-origin iframes.

url/origin.h

Index: url/origin.h
diff --git a/url/origin.h b/url/origin.h
index aab1f05a2013cc84cd4aedbb91a9e10b0df88307..24260636596b0cfc931827b6a6448fe636662020 100644
--- a/url/origin.h
+++ b/url/origin.h
@@ -137,6 +137,10 @@ URL_EXPORT std::ostream& operator<<(std::ostream& out, const Origin& origin);
 
 URL_EXPORT bool IsSameOriginWith(const GURL& a, const GURL& b);
 
+inline URL_EXPORT bool operator!=(const Origin& a, const Origin& b) {

[Jeffrey Yasskin, 2016/04/06 05:38:31]

I'm not certain it makes sense to have the non-reflexive operator==, but if we
have that, we should have != to match.

[Mike West, 2016/04/06 06:06:59]

We only added `==` for nice output in tests from `EXPECT_EQ` and the like. I
think it would be confusing for `==` or `!=` to spread further in the codebase,
given the non-reflexive behavior you noted. I don't think adding `!=` is a good
idea.

On a side note: is there a difference in behavior between this form of an
operator declaration and the class-bound form used for `==`?

[Jeffrey Yasskin, 2016/04/06 06:17:15]

Removed.
Yes: the member form allows implicit conversions (if any) for the right side of
the operator but not the left. The free function form allows implicit
conversions (if any) for both sides. For Origin they should be the same.

+  return !(a == b);
+}
+
 }  // namespace url
 
 #endif  // URL_ORIGIN_H_