'data:' may not be used as a document's base URL.

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 3307 matching lines @@
   // FIXME: Since this doesn't share code with completeURL it may not handle
   // encodings correctly.
   KURL baseElementURL;
   if (href) {
     String strippedHref = stripLeadingAndTrailingHTMLSpaces(*href);
     if (!strippedHref.isEmpty())
       baseElementURL = KURL(url(), strippedHref);
   }
 
   if (!baseElementURL.isEmpty()) {
-    if (baseElementURL.protocolIsData())
+    if (baseElementURL.protocolIsData()) {
       UseCounter::count(*this, UseCounter::BaseWithDataHref);
+      addConsoleMessage(ConsoleMessage::create(
+          SecurityMessageSource, ErrorMessageLevel,
+          "'data:' URLs may not be used as base URLs for a document."));
+    }
     if (!this->getSecurityOrigin()->canRequest(baseElementURL))
       UseCounter::count(*this, UseCounter::BaseWithCrossOriginHref);
   }
 
-  if (m_baseElementURL != baseElementURL &&
+  if (baseElementURL != m_baseElementURL && !baseElementURL.protocolIsData() &&
       contentSecurityPolicy()->allowBaseURI(baseElementURL)) {
     m_baseElementURL = baseElementURL;
     updateBaseURL();
   }
 
   if (target) {
     if (target->contains('\n') || target->contains('\r'))
       UseCounter::count(*this, UseCounter::BaseWithNewlinesInTarget);
     if (target->contains('<'))
       UseCounter::count(*this, UseCounter::BaseWithOpenBracketInTarget);
@@ skipping 3231 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (blink::Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif