Only do security checks on javascript: URLs for frames for loading

third_party/WebKit/Source/core/html/HTMLFrameElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 26 matching lines @@
     , m_frameBorder(true)
     , m_frameBorderSet(false)
 {
 }
 
 DEFINE_NODE_FACTORY(HTMLFrameElement)
 
 bool HTMLFrameElement::layoutObjectIsNeeded(const ComputedStyle&)
 {
     // For compatibility, frames render even when display: none is set.
-    return isURLAllowed();
+    return isURLAllowed(WillNotLoadURL);
 }
 
 LayoutObject* HTMLFrameElement::createLayoutObject(const ComputedStyle&)
 {
     return new LayoutFrame(this);
 }
 
 bool HTMLFrameElement::noResize() const
 {
     return hasAttribute(noresizeAttr);
@@ skipping 17 matching lines @@
         // FIXME: If we are already attached, this has no effect.
     } else if (name == noresizeAttr) {
         if (layoutObject())
             layoutObject()->updateFromElement();
     } else {
         HTMLFrameElementBase::parseAttribute(name, oldValue, value);
     }
 }
 
 } // namespace blink