Walk up frame tree for srcdoc referrer policies

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index bf41969b6cffd1d1300de3e7c5eb05df47081900..71123c6783c6073af1e6099cfe3415e36988035e 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -3381,6 +3381,20 @@ String Document::outgoingReferrer() const {
   return referrerDocument->m_url.strippedForUseAsReferrer();
 }
 
+ReferrerPolicy Document::getReferrerPolicy() const {
+  ReferrerPolicy policy = ExecutionContext::getReferrerPolicy();
+  // For srcdoc documents without their own policy, walk up the frame
+  // tree to find the document that is either not a srcdoc or doesn't
+  // have its own policy. This algorithm is defined in
+  // https://html.spec.whatwg.org/multipage/browsers.html#set-up-a-browsing-context-environment-settings-object.
+  if (!m_frame || policy != ReferrerPolicyDefault || !isSrcdocDocument()) {
+    return policy;
+  }
+  LocalFrame* frame = toLocalFrame(m_frame->tree().parent());
+  DCHECK(frame);
+  return frame->document()->getReferrerPolicy();
+}
+
 MouseEventWithHitTestResults Document::performMouseEventHitTest(
     const HitTestRequest& request,
     const LayoutPoint& documentPoint,