Block navigator.vibrate in cross-domain iframe.

third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp

Index: third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp
diff --git a/third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp b/third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp
index 50e5ce29ebf0b5d6baff3a91dfdb0d42f0616a0a..dddd51799dae182b44f89ae481587a509b26450b 100644
--- a/third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp
+++ b/third_party/WebKit/Source/modules/vibration/NavigatorVibration.cpp
@@ -20,6 +20,7 @@
 #include "modules/vibration/NavigatorVibration.h"
 
 #include "core/dom/Document.h"
+#include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Navigator.h"
 #include "core/frame/UseCounter.h"
@@ -81,6 +82,14 @@ bool NavigatorVibration::vibrate(Navigator& navigator, const VibrationPattern& p
     if (!frame->page()->isPageVisible())
         return false;
 
+    if (frame->isCrossOriginSubframe()) {
+        // TODO(binlu): Once FeaturePolicy is ready, exploring using it to
+        // remove the API instead of having it return false.
+        frame->localDOMWindow()->printErrorMessage(
+            "A call of navigator.vibrate will be no-op inside cross-origin iframes: https://www.chromestatus.com/feature/5682658461876224.");
+        return false;
+    }
+
     return NavigatorVibration::from(navigator).controller(*frame)->vibrate(pattern);
 }