PaymentRequest should throw if not in top context.

PaymentRequest should throw if not in top context.

The PaymentRequest specification currently states that PaymentRequest
can be constructed only in a top-level browsing context. When inside of
an iframe, the constructor should throw a SecurityError.

https://w3c.github.io/browser-payment-api/specs/paymentrequest.html#paymentrequest-constructor

Note this may change in the future via iframe sandboxing.

https://github.com/w3c/browser-payment-api/issues/2

BUG=587995
Committed: https://crrev.com/b26313ef9d24c94f72c87f450e54999404e55e51
Cr-Commit-Position: refs/heads/master@{#397035}

[please use gerrit instead, 2016-05-31 23:57:44]

Patchset #1 (id:1) has been deleted

[please use gerrit instead, 2016-05-31 23:58:02]

rouslan@chromium.org changed reviewers:
+ mek@chromium.org

[please use gerrit instead, 2016-05-31 23:58:02]

mek@, ptal.

[Marijn Kruisselbrink, 2016-06-01 00:19:25]

https://codereview.chromium.org/2029473002/diff/20001/third_party/WebKit/Layo...
File third_party/WebKit/LayoutTests/payments/payment-request-in-iframe.html
(right):

https://codereview.chromium.org/2029473002/diff/20001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/payments/payment-request-in-iframe.html:6:
<iframe sandbox="allow-scripts allow-same-origin" style="width: 0px; height:
0px; margin: 0px; padding: 0px; border: 0px;" srcdoc="
Why the sandbox? A non-sandboxed iframe should currently throw as well for this,
right? Also the width/height/margin/padding/border don't seem like they're
actually relevant to this test?

https://codereview.chromium.org/2029473002/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/modules/payments/PaymentRequest.cpp (right):

https://codereview.chromium.org/2029473002/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/modules/payments/PaymentRequest.cpp:309: if
(scriptState->domWindow() != scriptState->domWindow()->top()) {
I believe this check is more typically written as
scriptState->domWindow()->frame()->isMainFrame()

[please use gerrit instead, 2016-06-01 00:42:29]

ptal patch 2.

https://codereview.chromium.org/2029473002/diff/20001/third_party/WebKit/Layo...
File third_party/WebKit/LayoutTests/payments/payment-request-in-iframe.html
(right):

https://codereview.chromium.org/2029473002/diff/20001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/payments/payment-request-in-iframe.html:6:
<iframe sandbox="allow-scripts allow-same-origin" style="width: 0px; height:
0px; margin: 0px; padding: 0px; border: 0px;" srcdoc="
On 2016/06/01 00:19:25, Marijn Kruisselbrink wrote:
> Why the sandbox? A non-sandboxed iframe should currently throw as well for
this,
> right? Also the width/height/margin/padding/border don't seem like they're
> actually relevant to this test?

Removed the extra bits. It still works without them.

https://codereview.chromium.org/2029473002/diff/20001/third_party/WebKit/Sour...
File third_party/WebKit/Source/modules/payments/PaymentRequest.cpp (right):

https://codereview.chromium.org/2029473002/diff/20001/third_party/WebKit/Sour...
third_party/WebKit/Source/modules/payments/PaymentRequest.cpp:309: if
(scriptState->domWindow() != scriptState->domWindow()->top()) {
On 2016/06/01 00:19:25, Marijn Kruisselbrink wrote:
> I believe this check is more typically written as
> scriptState->domWindow()->frame()->isMainFrame()

Done.

[Marijn Kruisselbrink, 2016-06-01 00:46:45]

lgtm

[please use gerrit instead, 2016-06-01 00:48:24]

The CQ bit was checked by rouslan@chromium.org

[commit-bot: I haz the power, 2016-06-01 00:49:09]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2029473002/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2029473002/40001

[commit-bot: I haz the power, 2016-06-01 02:53:46]

Committed patchset #2 (id:40001)

[commit-bot: I haz the power, 2016-06-01 02:56:07]

Description was changed from

==========
PaymentRequest should throw if not in top context.

The PaymentRequest specification currently states that PaymentRequest
can be constructed only in a top-level browsing context. When inside of
an iframe, the constructor should throw a SecurityError.

https://w3c.github.io/browser-payment-api/specs/paymentrequest.html#paymentre...

Note this may change in the future via iframe sandboxing.

https://github.com/w3c/browser-payment-api/issues/2

BUG=587995
==========

to

==========
PaymentRequest should throw if not in top context.

The PaymentRequest specification currently states that PaymentRequest
can be constructed only in a top-level browsing context. When inside of
an iframe, the constructor should throw a SecurityError.

https://w3c.github.io/browser-payment-api/specs/paymentrequest.html#paymentre...

Note this may change in the future via iframe sandboxing.

https://github.com/w3c/browser-payment-api/issues/2

BUG=587995

Committed: https://crrev.com/b26313ef9d24c94f72c87f450e54999404e55e51
Cr-Commit-Position: refs/heads/master@{#397035}
==========

[commit-bot: I haz the power, 2016-06-01 02:56:08]

Patchset 2 (id:??) landed as
https://crrev.com/b26313ef9d24c94f72c87f450e54999404e55e51
Cr-Commit-Position: refs/heads/master@{#397035}