Sprinkle some release asserts over HTMLFrameElementBase

third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 29 matching lines @@
 
 namespace blink {
 
 using namespace HTMLNames;
 
 HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Document& document)
     : HTMLFrameOwnerElement(tagName, document)
     , m_scrollingMode(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
+    , m_javaScriptURLFailedAccessCheck(false)
 {
 }
 
 bool HTMLFrameElementBase::isURLAllowed() const
 {
     if (m_URL.isEmpty())
         return true;
 
     const KURL& completeURL = document().completeURL(m_URL);
 
     if (protocolIsJavaScript(completeURL)) {
-        if (contentFrame() && !ScriptController::canAccessFromCurrentOrigin(toIsolate(&document()), contentFrame()))
+        if (contentFrame() && !ScriptController::canAccessFromCurrentOrigin(toIsolate(&document()), contentFrame())) {
+            m_javaScriptURLFailedAccessCheck = true;
             return false;
+        }
+        SECURITY_CHECK(!m_javaScriptURLFailedAccessCheck);
     }
 
     LocalFrame* parentFrame = document().frame();
     if (parentFrame)
         return parentFrame->isURLAllowed(completeURL);
 
     return true;
 }
 
 void HTMLFrameElementBase::openURL(bool replaceCurrentItem)
@@ skipping 86 matching lines @@
 }
 
 void HTMLFrameElementBase::didNotifySubtreeInsertionsToDocument()
 {
     if (!document().frame())
         return;
 
     if (!SubframeLoadingDisabler::canLoadFrame(*this))
         return;
 
+    // We should never have a content frame at the point where we got inserted
+    // into a tree.
+    SECURITY_CHECK(!contentFrame());
+
     setNameAndOpenURL();
 }
 
 void HTMLFrameElementBase::attachLayoutTree(const AttachContext& context)
 {
     HTMLFrameOwnerElement::attachLayoutTree(context);
 
     if (layoutPart()) {
         if (Frame* frame = contentFrame()) {
             if (frame->isLocalFrame())
                 setWidget(toLocalFrame(frame)->view());
             else if (frame->isRemoteFrame())
                 setWidget(toRemoteFrame(frame)->view());
         }
     }
 }
 
 void HTMLFrameElementBase::setLocation(const String& str)
 {
     m_URL = AtomicString(str);
+    m_javaScriptURLFailedAccessCheck = false;
 
     if (isConnected())
         openURL(false);
 }
 
 bool HTMLFrameElementBase::supportsFocus() const
 {
     return true;
 }
 
@@ skipping 47 matching lines @@
     frameOwnerPropertiesChanged();
 }
 
 void HTMLFrameElementBase::setMarginHeight(int marginHeight)
 {
     m_marginHeight = marginHeight;
     frameOwnerPropertiesChanged();
 }
 
 } // namespace blink