service worker: Don't control a subframe of an insecure context

content/browser/service_worker/service_worker_context_core.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_context_core.h"
 
 #include <limits>
 #include <set>
 #include <utility>
 
@@ skipping 613 matching lines @@
     const StatusCallback& callback) {
   job_coordinator_->AbortAll();
   storage_->DeleteAndStartOver(callback);
 }
 
 std::unique_ptr<ServiceWorkerProviderHost>
 ServiceWorkerContextCore::TransferProviderHostOut(int process_id,
                                                   int provider_id) {
   ProviderMap* map = GetProviderMapForProcess(process_id);
   ServiceWorkerProviderHost* transferee = map->Lookup(provider_id);
-  ServiceWorkerProviderHost* replacement =
-      new ServiceWorkerProviderHost(process_id,
-                                    transferee->frame_id(),
-                                    provider_id,
-                                    transferee->provider_type(),
-                                    AsWeakPtr(),
-                                    transferee->dispatcher_host());
+  ServiceWorkerProviderHost* replacement = new ServiceWorkerProviderHost(
+      process_id, transferee->frame_id(), provider_id,
+      transferee->provider_type(), transferee->is_parent_frame_secure(),
+      AsWeakPtr(), transferee->dispatcher_host());
   map->Replace(provider_id, replacement);
   transferee->PrepareForCrossSiteTransfer();
   return base::WrapUnique(transferee);
 }
 
-void ServiceWorkerContextCore::TransferProviderHostIn(
+bool ServiceWorkerContextCore::TransferProviderHostIn(
     int new_process_id,
     int new_provider_id,
     std::unique_ptr<ServiceWorkerProviderHost> transferee) {
   ProviderMap* map = GetProviderMapForProcess(new_process_id);
   ServiceWorkerProviderHost* temp = map->Lookup(new_provider_id);
   if (!temp)
-    return;
+    return false;

[horo, 2016/06/03 09:54:44]

Do we need the returned value?

[falken, 2016/06/03 12:10:45]

Not anymore. Failed partial revert. Done.

 
   DCHECK(temp->document_url().is_empty());
   transferee->CompleteCrossSiteTransfer(new_process_id,
                                         temp->frame_id(),
                                         new_provider_id,
                                         temp->provider_type(),
                                         temp->dispatcher_host());
   map->Replace(new_provider_id, transferee.release());
   delete temp;
+  return true;
 }
 
 void ServiceWorkerContextCore::ClearAllServiceWorkersForTest(
     const base::Closure& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   // |callback| will be called in the destructor of |helper| on the UI thread.
   scoped_refptr<ClearAllServiceWorkersHelper> helper(
       new ClearAllServiceWorkersHelper(callback));
   if (!was_service_worker_registered_)
     return;
@@ skipping 177 matching lines @@
 }
 
 void ServiceWorkerContextCore::OnRegistrationFinishedForCheckHasServiceWorker(
     const ServiceWorkerContext::CheckHasServiceWorkerCallback callback,
     const scoped_refptr<ServiceWorkerRegistration>& registration) {
   callback.Run(registration->active_version() ||
                registration->waiting_version());
 }
 
 }  // namespace content