Don't call lower() on KURL protocol/host

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 4361 matching lines @@
 const AtomicString& Document::referrer() const {
   if (loader())
     return loader()->request().httpReferrer();
   return nullAtom;
 }
 
 String Document::domain() const {
   return getSecurityOrigin()->domain();
 }
 
-void Document::setDomain(const String& newDomain,
+void Document::setDomain(const String& rawDomain,
                          ExceptionState& exceptionState) {
   UseCounter::count(*this, UseCounter::DocumentSetDomain);
 
   if (isSandboxed(SandboxDocumentDomain)) {
     exceptionState.throwSecurityError(
         "Assignment is forbidden for sandboxed iframes.");
     return;
   }
 
   if (SchemeRegistry::isDomainRelaxationForbiddenForURLScheme(
           getSecurityOrigin()->protocol())) {
     exceptionState.throwSecurityError("Assignment is forbidden for the '" +
                                       getSecurityOrigin()->protocol() +
                                       "' scheme.");
     return;
   }
 
+  bool success = false;
+  String newDomain = SecurityOrigin::canonicalizeHost(rawDomain, &success);
+  if (!success) {
+    exceptionState.throwSecurityError("'" + rawDomain +
+                                      "' could not be parsed properly.");

[Mike West, 2016/10/27 07:30:35]

Can you add a layout test that runs through `document.domain` assignments where
this would fail?

+    return;
+  }
+
   if (newDomain.isEmpty()) {
     exceptionState.throwSecurityError("'" + newDomain +
                                       "' is an empty domain.");
     return;
   }
 
   OriginAccessEntry accessEntry(getSecurityOrigin()->protocol(), newDomain,
                                 OriginAccessEntry::AllowSubdomains);
   OriginAccessEntry::MatchResult result =
       accessEntry.matchesOrigin(*getSecurityOrigin());
@@ skipping 2000 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif