Initial Implementation of Iframe Attribute for Feature Policy (Part 3)

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 13857db271a9005fbcfd277261654baa7bd4495b..31fc6ea8cb15a5647a48fb5028b512b8c708d52b 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -617,8 +617,14 @@ void FrameLoader::didBeginDocument() {
       const WebParsedFeaturePolicy& parsedHeader = parseFeaturePolicy(
           featurePolicyHeader, m_frame->securityContext()->getSecurityOrigin(),
           &messages);
-      m_frame->securityContext()->initializeFeaturePolicy(parsedHeader,
-                                                          parentFeaturePolicy);
+      WebParsedFeaturePolicy containerPolicy;
+      if (m_frame->owner()) {

[dglazkov, 2017/03/20 20:57:12]

I wonder if even need to do anything with feature policy in situations when we
don't have a frame owner?

[lunalu1, 2017/03/20 21:07:01]

There are two ways to define feature policy. One is though HTTP header (in this
case, a frame owner is not required). The other is through iframe attribute
"allow" (see this CL). icelland@ please correct me if I am wrong

[dglazkov, 2017/03/20 22:18:26]

I could be wrong, but if I remember correctly, the only time when FrameOwner is
nullptr is when it's an SVGImage or a popup (or maybe something similar). Would
we still need to initialize feature policy for those?

+        containerPolicy = getContainerPolicyFromAllowedFeatures(
+            m_frame->owner()->allowedFeatures(),
+            m_frame->securityContext()->getSecurityOrigin());
+      }
+      m_frame->securityContext()->initializeFeaturePolicy(
+          parsedHeader, containerPolicy, parentFeaturePolicy);
       for (auto& message : messages) {
         m_frame->document()->addConsoleMessage(ConsoleMessage::create(
             OtherMessageSource, ErrorMessageLevel,