Don't skip security checks for javascript: URLs when the JS stack is empty.

third_party/WebKit/Source/core/html/HTMLFrameElementBase.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 23 matching lines @@
   bool canContainRangeEndPoint() const final { return false; }
 
   // FrameOwner overrides:
   ScrollbarMode scrollingMode() const override { return m_scrollingMode; }
   int marginWidth() const override { return m_marginWidth; }
   int marginHeight() const override { return m_marginHeight; }
 
  protected:
   HTMLFrameElementBase(const QualifiedName&, Document&);
 
-  bool isURLAllowed() const;
+  bool isURLAllowed(bool fromLayout = false) const;
 
   void parseAttribute(const QualifiedName&,
                       const AtomicString&,
                       const AtomicString&) override;
   InsertionNotificationRequest insertedInto(ContainerNode*) override;
   void didNotifySubtreeInsertionsToDocument() final;
   void attachLayoutTree(const AttachContext& = AttachContext()) override;
 
   // FIXME: Remove this method once we have input routing in the browser
   // process. See http://crbug.com/339659.
@@ skipping 29 matching lines @@
 
 inline bool isHTMLFrameElementBase(const HTMLElement& element) {
   return isHTMLFrameElement(element) || isHTMLIFrameElement(element);
 }
 
 DEFINE_HTMLELEMENT_TYPE_CASTS_WITH_FUNCTION(HTMLFrameElementBase);
 
 }  // namespace blink
 
 #endif  // HTMLFrameElementBase_h