Block navigator.vibrate in cross-domain iframe.

third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp

Index: third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp
diff --git a/third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp b/third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp
index 50e5ce29ebf0b5d6baff3a91dfdb0d42f0616a0a..2c91263b2cc6daf7892b95de00d9f881c74608a9 100644
--- a/third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp
+++ b/third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp
@@ -20,6 +20,7 @@
 #include "modules/vibration/NavigatorVibration.h"
 
 #include "core/dom/Document.h"
+#include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Navigator.h"
 #include "core/frame/UseCounter.h"
@@ -81,6 +82,14 @@ bool NavigatorVibration::vibrate(Navigator& navigator, const VibrationPattern& p
     if (!frame->page()->isPageVisible())
         return false;
 
+    if (frame->isCrossOriginSubframe()) {
+        // TODO(binlu): Once FeaturePolicy is ready, exploring using it to
+        // remove the API instead of having it return false.
+        frame->localDOMWindow()->printErrorMessage(
+            "A cross-origin iframe may not call navigator.vibrate: https://www.chromestatus.com/feature/5682658461876224.");

[Michael van Ouwerkerk, 2016/09/29 13:36:16]

nit: Has this message been discussed? Technically, you can _call_ it, it just
doesn't do anything.

+        return false;
+    }
+
     return NavigatorVibration::from(navigator).controller(*frame)->vibrate(pattern);
 }