service worker: Don't control a subframe of an insecure context

content/browser/service_worker/service_worker_request_handler.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_request_handler.h"
 
 #include <string>
 #include <utility>
 
 #include "base/macros.h"
@@ skipping 198 matching lines @@
   host_for_cross_site_transfer_ = context_->TransferProviderHostOut(
       old_process_id, provider_host_->provider_id());
   DCHECK_EQ(provider_host_.get(), host_for_cross_site_transfer_.get());
 }
 
 void ServiceWorkerRequestHandler::CompleteCrossSiteTransfer(
     int new_process_id, int new_provider_id) {
   CHECK(!IsBrowserSideNavigationEnabled());
   if (!host_for_cross_site_transfer_.get() || !context_)
     return;
+  if (new_provider_id == kInvalidServiceWorkerVersionId)

[alexmos, 2016/06/02 23:54:47]

Why is this needed?

[falken, 2016/06/03 08:22:05]

Ah, this was needed in the earlier patch that used
kInvalidServiceWorkerProviderId instead of passing is_parent_frame_secure. That
patch caused site isolation bot to fail without this code.

I still think there's a bug here because we can use
kInvalidServiceWorkerProviderId due to sandboxed iframes, in which case
TransferProviderHostIn will crash. But I'll fix that in a separate patch.

Reverted changes to this file.

+    return;
   DCHECK_EQ(provider_host_.get(), host_for_cross_site_transfer_.get());
-  context_->TransferProviderHostIn(new_process_id, new_provider_id,
-                                   std::move(host_for_cross_site_transfer_));
-  DCHECK_EQ(provider_host_->provider_id(), new_provider_id);
+  if (context_->TransferProviderHostIn(
+          new_process_id, new_provider_id,
+          std::move(host_for_cross_site_transfer_))) {
+    DCHECK_EQ(provider_host_->provider_id(), new_provider_id);
+  }
 }
 
 void ServiceWorkerRequestHandler::MaybeCompleteCrossSiteTransferInOldProcess(
     int old_process_id) {
   CHECK(!IsBrowserSideNavigationEnabled());
   if (!host_for_cross_site_transfer_.get() || !context_ ||
       old_process_id_ != old_process_id) {
     return;
   }
   CompleteCrossSiteTransfer(old_process_id_, old_provider_id_);
@@ skipping 16 matching lines @@
     ResourceType resource_type)
     : context_(context),
       provider_host_(provider_host),
       blob_storage_context_(blob_storage_context),
       resource_type_(resource_type),
       old_process_id_(0),
       old_provider_id_(kInvalidServiceWorkerProviderId) {
 }
 
 }  // namespace content