Prevent drag-and-drop events from firing over cross-site, same-page frames.

content/browser/web_contents/web_contents_view_aura.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_WEB_CONTENTS_WEB_CONTENTS_VIEW_AURA_H_
 #define CONTENT_BROWSER_WEB_CONTENTS_WEB_CONTENTS_VIEW_AURA_H_
 
 #include <memory>
 #include <vector>
 
@@ skipping 185 matching lines @@
 
   // We keep track of the RenderWidgetHost we're dragging over. If it changes
   // during a drag, we need to re-send the DragEnter message.
   base::WeakPtr<RenderWidgetHostImpl> current_rwh_for_drag_;
 
   // We also keep track of the RenderViewHost we're dragging over to avoid
   // sending the drag exited message after leaving the current
   // view. |current_rvh_for_drag_| should not be dereferenced.
   void* current_rvh_for_drag_;
 
+  // We track the source RenderProcessHost and RenderViewHost from which the
+  // current drag originated. These are used to ensure that drag events do not
+  // fire over a cross-site frame in the same page (with respect to the source
+  // frame). See crbug.com/666858. |drag_source_rph_| and |drag_source_rvh_|
+  // should not be dereferenced.
+  void* drag_source_rph_;
+  void* drag_source_rvh_;
+
   // The overscroll gesture currently in progress.
   OverscrollMode current_overscroll_gesture_;
 
   // This is the completed overscroll gesture. This is used for the animation
   // callback that happens in response to a completed overscroll gesture.
   OverscrollMode completed_overscroll_gesture_;
 
   // This manages the overlay window that shows the screenshot during a history
   // navigation triggered by the overscroll gesture.
   std::unique_ptr<OverscrollNavigationOverlay> navigation_overlay_;
 
   std::unique_ptr<GestureNavSimple> gesture_nav_simple_;
 
   bool init_rwhv_with_null_parent_for_testing_;
 
   DISALLOW_COPY_AND_ASSIGN(WebContentsViewAura);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_WEB_CONTENTS_WEB_CONTENTS_VIEW_AURA_H_