Replicate feature policy headers to remote frames

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 79980d3a15af98e7e09735ee6d2db57dea23669c..585c81a15b14e15fad2f0d2385d94f76a7c355bd 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -596,6 +596,11 @@ void FrameLoader::didBeginDocument() {
             "Error with Feature-Policy header: " + message));
       }
       m_frame->document()->setFeaturePolicy(std::move(featurePolicy));
+      if (client()) {
+        client()->didSetFeaturePolicyHeader(
+            m_documentLoader->response().httpHeaderField(
+                HTTPNames::Feature_Policy));
+      }

[Mike West, 2016/11/08 12:12:23]

An approach that you might wish to consider would be moving this up to the
browser process entirely. That is, rather than parsing the header in Blink and
pushing a policy up through the browser, you could parse the policy in the
browser, store it on the frame tree, and forcibly apply parent's policy to child
frames when the browser created them for each navigation.

[iclelland, 2016/11/08 14:25:45]

Since a frame can also set policy for itself -- it can disable synchronous
script loading, or remove v8 features, I think we'll need to have the policy set
before we can continue with parsing the document; moving it to the browser
process would mean that we have to block on that process switch (twice), which I
was hoping to avoid.

     }
   }