Part 5.2: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 1246 matching lines @@
     // Aggregate all serialized source lists of the returned CSP into a vector
     // based on a directive type, defaulting accordingly (for example, to
     // `default-src`).
     SourceListDirectiveVector returned = getSourceVector(directive, other);
     // TODO(amalika): Add checks for plugin-types, sandbox, disown-opener,
     // navigation-to, worker-src.
     if (!required->subsumes(returned))
       return false;
   }
 
-  return true;
+  if (!m_pluginTypes.get())
+    return true;
+
+  std::vector<MediaListDirective*> pluginTypesOther;

[amalika, 2016/12/09 10:24:40]

oilpan-reviews@ maybe this should be HeapVector<Member<>> instead?
and therefore `bool MediaListDirective::subsumes(const
std::vector<MediaListDirective*>& other)`, too?

[jochen (gone - plz use gerrit), 2016/12/12 07:40:15]

MediaListDirective isn't on the oilpan heap, so you can't use Member<> to
reference it. However, in general we don't use STL containers in Blink, so I'd
propose using WTF::Vector<MediaListDirective> or
WTF::Vector<std::unique_ptr<MediaListDirective>> if you want to manage lifetime

+  for (const auto& policy : other) {
+    if (policy->m_pluginTypes.get())
+      pluginTypesOther.push_back(policy->m_pluginTypes.get());
+  }
+
+  return m_pluginTypes->subsumes(pluginTypesOther);
 }
 
 DEFINE_TRACE(CSPDirectiveList) {
   visitor->trace(m_policy);
   visitor->trace(m_pluginTypes);
   visitor->trace(m_baseURI);
   visitor->trace(m_childSrc);
   visitor->trace(m_connectSrc);
   visitor->trace(m_defaultSrc);
   visitor->trace(m_fontSrc);
   visitor->trace(m_formAction);
   visitor->trace(m_frameAncestors);
   visitor->trace(m_frameSrc);
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
   visitor->trace(m_workerSrc);
 }
 
 }  // namespace blink