Walk up frame tree for srcdoc referrer policies

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 3363 matching lines @@
       frame = toLocalFrame(frame->tree().parent());
       // Srcdoc documents cannot be top-level documents, by definition,
       // because they need to be contained in iframes with the srcdoc.
       DCHECK(frame);
     }
     referrerDocument = frame->document();
   }
   return referrerDocument->m_url.strippedForUseAsReferrer();
 }
 
+ReferrerPolicy Document::getReferrerPolicy() const {
+  ReferrerPolicy policy = ExecutionContext::getReferrerPolicy();
+  // For srcdoc documents without their own policy, walk up the frame
+  // tree to find the document that is either not a srcdoc or doesn't
+  // have its own policy. This algorithm is defined in
+  // https://html.spec.whatwg.org/multipage/browsers.html#set-up-a-browsing-context-environment-settings-object.
+  if (!m_frame || policy != ReferrerPolicyDefault || !isSrcdocDocument()) {
+    return policy;
+  }
+  LocalFrame* frame = toLocalFrame(m_frame->tree().parent());
+  DCHECK(frame);
+  return frame->document()->getReferrerPolicy();
+}
+
 MouseEventWithHitTestResults Document::performMouseEventHitTest(
     const HitTestRequest& request,
     const LayoutPoint& documentPoint,
     const PlatformMouseEvent& event) {
   DCHECK(layoutViewItem().isNull() || layoutViewItem().isLayoutView());
 
   // LayoutView::hitTest causes a layout, and we don't want to hit that until
   // the first layout because until then, there is nothing shown on the screen -
   // the user can't have intentionally clicked on something belonging to this
   // page.  Furthermore, mousemove events before the first layout should not
@@ skipping 2994 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif