service worker: Don't control a subframe of an insecure context

content/common/service_worker/service_worker_messages.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Message definition file, included multiple times, hence no include guard.
 
 #include <stdint.h>
 
 #include <string>
 #include <vector>
@@ skipping 185 matching lines @@
     std::vector<int> /* sent_message_ports */)
 
 // Informs the browser of a new ServiceWorkerProvider in the child process,
 // |provider_id| is unique within its child process. When this provider is
 // created for a document, |route_id| is the frame ID of it. When this provider
 // is created for a Shared Worker, |route_id| is the Shared Worker route ID.
 // When this provider is created for a Service Worker, |route_id| is
 // MSG_ROUTING_NONE. |provider_type| identifies whether this provider is for
 // Service Worker controllees (documents and Shared Workers) or for controllers
 // (Service Workers).
-IPC_MESSAGE_CONTROL3(ServiceWorkerHostMsg_ProviderCreated,
+//
+// |is_parent_frame_secure| is false if the provider is created for a
+// document whose parent frame is not secure from the point of view of the
+// document; that is, blink::WebFrame::canHaveSecureChild() returns false.
+// This doesn't mean the document is necessarily an insecure context,
+// because the document may have a URL whose scheme is granted an exception
+// that allows bypassing the ancestor secure context check. See the
+// comment in blink::Document::isSecureContextImpl for more details.
+// If the provider is not created for a document, or the document does not have
+// a parent frame, |is_parent_frame_secure| is true.
+IPC_MESSAGE_CONTROL4(ServiceWorkerHostMsg_ProviderCreated,
                      int /* provider_id */,
                      int /* route_id */,
-                     content::ServiceWorkerProviderType /* provider_type */)
+                     content::ServiceWorkerProviderType /* provider_type */,
+                     bool /* is_parent_frame_secure */)
 
 // Informs the browser of a ServiceWorkerProvider being destroyed.
 IPC_MESSAGE_CONTROL1(ServiceWorkerHostMsg_ProviderDestroyed,
                      int /* provider_id */)
 
 // Increments and decrements the ServiceWorker object's reference
 // counting in the browser side. The ServiceWorker object is created
 // with ref-count==1 initially.
 IPC_MESSAGE_CONTROL1(ServiceWorkerHostMsg_IncrementServiceWorkerRefCount,
                      int /* handle_id */)
@@ skipping 301 matching lines @@
 
 // Sent via EmbeddedWorker as a response of NavigateClient.
 IPC_MESSAGE_CONTROL2(ServiceWorkerMsg_NavigateClientResponse,
                      int /* request_id */,
                      content::ServiceWorkerClientInfo /* client */)
 
 // Sent via EmbeddedWorker as an error response of NavigateClient.
 IPC_MESSAGE_CONTROL2(ServiceWorkerMsg_NavigateClientError,
                      int /* request_id */,
                      GURL /* url */)