Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(418)

Unified Diff: third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp

Issue 2169453002: Sprinkle some release asserts over HTMLFrameElementBase (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: updates Created 4 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « third_party/WebKit/Source/core/html/HTMLFrameElementBase.h ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp b/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
index 2e3534b3059a5c1ef8a0e9dec3e630f2c3b1859a..566a9cb9b6a65e356cd67d5d46c9ce83ed18c4d5 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp
@@ -47,6 +47,7 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
, m_scrollingMode(ScrollbarAuto)
, m_marginWidth(-1)
, m_marginHeight(-1)
+ , m_javaScriptURLFailedAccessCheck(false)
{
}
@@ -58,8 +59,11 @@ bool HTMLFrameElementBase::isURLAllowed() const
const KURL& completeURL = document().completeURL(m_URL);
if (protocolIsJavaScript(completeURL)) {
- if (contentFrame() && !ScriptController::canAccessFromCurrentOrigin(toIsolate(&document()), contentFrame()))
+ if (contentFrame() && !ScriptController::canAccessFromCurrentOrigin(toIsolate(&document()), contentFrame())) {
+ m_javaScriptURLFailedAccessCheck = true;
return false;
+ }
+ SECURITY_CHECK(!m_javaScriptURLFailedAccessCheck);
}
LocalFrame* parentFrame = document().frame();
@@ -166,6 +170,10 @@ void HTMLFrameElementBase::didNotifySubtreeInsertionsToDocument()
if (!SubframeLoadingDisabler::canLoadFrame(*this))
return;
+ // We should never have a content frame at the point where we got inserted
+ // into a tree.
+ SECURITY_CHECK(!contentFrame());
+
setNameAndOpenURL();
}
@@ -186,6 +194,7 @@ void HTMLFrameElementBase::attachLayoutTree(const AttachContext& context)
void HTMLFrameElementBase::setLocation(const String& str)
{
m_URL = AtomicString(str);
+ m_javaScriptURLFailedAccessCheck = false;
if (isConnected())
openURL(false);
« no previous file with comments | « third_party/WebKit/Source/core/html/HTMLFrameElementBase.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698