service worker: Don't control a subframe of an insecure context

third_party/WebKit/Source/web/WebFrame.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "public/web/WebFrame.h"
 
 #include "bindings/core/v8/WindowProxyManager.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 255 matching lines @@
 
 WebFrame* WebFrame::fromFrameOwnerElement(const WebElement& webElement)
 {
     Element* element = webElement;
 
     if (!element->isFrameOwnerElement())
         return nullptr;
     return fromFrame(toHTMLFrameOwnerElement(element)->contentFrame());
 }
 
+bool WebFrame::canHaveSecureChild(WebString& errorMessage) const

[jww, 2016/05/28 01:35:25]

Can you add some unit tests to this, similar to what we have for
SecurityOrigin::isPotentiallyTrustworthy()?

[falken, 2016/05/30 10:20:53]

Didn't get to this in the latest patchset, but will do this.

+{
+    Frame* frame = toImplBase()->frame();
+    if (!frame)
+        return false;
+    String message;
+    bool result = frame->canHaveSecureChild(&message);
+    errorMessage = message;
+    return result;
+}
+
 bool WebFrame::isLoading() const
 {
     if (Frame* frame = toImplBase()->frame())
         return frame->isLoading();
     return false;
 }
 
 WebFrame* WebFrame::fromFrame(Frame* frame)
 {
     if (!frame)
@@ skipping 66 matching lines @@
     void WebFrame::traceFrame(VisitorDispatcher visitor, WebFrame* frame) { traceFrameImpl(visitor, frame); }                  \
     void WebFrame::traceFrames(VisitorDispatcher visitor, WebFrame* frame) { traceFramesImpl(visitor, frame); }                \
     void WebFrame::clearWeakFrames(VisitorDispatcher visitor) { clearWeakFramesImpl(visitor); }
 
 DEFINE_VISITOR_METHOD(Visitor*)
 DEFINE_VISITOR_METHOD(InlinedGlobalMarkingVisitor)
 
 #undef DEFINE_VISITOR_METHOD
 
 } // namespace blink