Don't call lower() on KURL protocol/host

third_party/WebKit/Source/platform/weborigin/SecurityOrigin.cpp

 /*
  * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 85 matching lines @@
     relevantURL = url;
   }
 
   // URLs with schemes that require an authority, but which don't have one,
   // will have failed the isValid() test; e.g. valid HTTP URLs must have a
   // host.
   ASSERT(!(
       (relevantURL.protocolIsInHTTPFamily() || relevantURL.protocolIs("ftp")) &&
       relevantURL.host().isEmpty()));
 
-  // SchemeRegistry needs a lower case protocol because it uses HashMaps
-  // that assume the scheme has already been canonicalized.
-  String protocol = relevantURL.protocol().lower();
-
-  if (SchemeRegistry::shouldTreatURLSchemeAsNoAccess(protocol))
+  if (SchemeRegistry::shouldTreatURLSchemeAsNoAccess(relevantURL.protocol()))
     return true;
 
   // This is the common case.
   return false;
 }
 
 SecurityOrigin::SecurityOrigin(const KURL& url)
-    : m_protocol(url.protocol().isNull() ? emptyString()
-                                         : url.protocol().lower()),
-      m_host(url.host().isNull() ? emptyString() : url.host().lower()),
+    : m_protocol(url.protocol()),
+      m_host(url.host().lower()),

[brettw, 2016/10/26 01:54:27]

Since you're here, you can delete this lower() call on the host for the same
reason.

[Charlie Harrison, 2016/10/26 01:58:32]

Actually, I tried that and hit a DCHECK failure in this case:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/web/tests/Fram...

I added a similar DCHECK_EQ(host(), host().lower()) that failed because the %3E 
changed %3e. This is after changing the constructor to KURL(KURL(),
"http://f--.com-->").

       m_port(url.port()),
       m_effectivePort(url.port() ? url.port()
                                  : defaultPortForProtocol(m_protocol)),
       m_isUnique(false),
       m_universalAccess(false),
       m_domainWasSetInDOM(false),
       m_blockLocalAccessFromLocalOrigin(false),
       m_isUniqueOriginPotentiallyTrustworthy(false) {
+  if (m_protocol.isNull())
+    m_protocol = emptyString();
+  if (m_host.isNull())
+    m_host = emptyString();
+
   // Suborigins are serialized into the host, so extract it if necessary.
   String suboriginName;
   if (deserializeSuboriginAndProtocolAndHost(m_protocol, m_host, suboriginName,
                                              m_protocol, m_host))
     m_suborigin.setName(suboriginName);
 
   // document.domain starts as m_host, but can be set by the DOM.
   m_domain = m_host;
 
   if (isDefaultPortForProtocol(m_port, m_protocol))
@@ skipping 174 matching lines @@
   if (url.protocolIsData())
     return false;
 
   return true;
 }
 
 bool SecurityOrigin::canDisplay(const KURL& url) const {
   if (m_universalAccess)
     return true;
 
-  String protocol = url.protocol().lower();
-
+  String protocol = url.protocol();
   if (SchemeRegistry::canDisplayOnlyIfCanRequest(protocol))
     return canRequest(url);
 
   if (SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(protocol))
     return m_protocol == protocol ||
            SecurityPolicy::isAccessToURLWhiteListed(this, url);
 
   if (SchemeRegistry::shouldTreatURLSchemeAsLocal(protocol))
     return canLoadLocalResources() ||
            SecurityPolicy::isAccessToURLWhiteListed(this, url);
@@ skipping 250 matching lines @@
       privilegeData->m_blockLocalAccessFromLocalOrigin;
 }
 
 void SecurityOrigin::setUniqueOriginIsPotentiallyTrustworthy(
     bool isUniqueOriginPotentiallyTrustworthy) {
   ASSERT(!isUniqueOriginPotentiallyTrustworthy || isUnique());
   m_isUniqueOriginPotentiallyTrustworthy = isUniqueOriginPotentiallyTrustworthy;
 }
 
 }  // namespace blink