Enabling alwaysOnTop should fail to create app windows if the permission is lacking

chrome/browser/extensions/api/app_window/app_window_api.cc

Index: chrome/browser/extensions/api/app_window/app_window_api.cc
diff --git a/chrome/browser/extensions/api/app_window/app_window_api.cc b/chrome/browser/extensions/api/app_window/app_window_api.cc
index 63c40c0cee24d7d4849f528d714615b3ddd6b3c6..cba35a267eaa680dc13001bebeb3f8924d9c6655 100644
--- a/chrome/browser/extensions/api/app_window/app_window_api.cc
+++ b/chrome/browser/extensions/api/app_window/app_window_api.cc
@@ -48,6 +48,8 @@ const char kInactiveColorWithoutColor[] =
     "frame.inactiveColor must be used with frame.color.";
 const char kConflictingBoundsOptions[] =
     "The $1 property cannot be specified for both inner and outer bounds.";
+const char kAlwaysOnTopPermission[] =
+    "The \"app.window.alwaysOnTop\" permission is required.";
 }  // namespace app_window_constants
 
 const char kNoneFrameOption[] = "none";
@@ -234,10 +236,16 @@ bool AppWindowCreateFunction::RunAsync() {
     if (options->resizable.get())
       create_params.resizable = *options->resizable.get();
 
-    if (options->always_on_top.get() &&
-        GetExtension()->HasAPIPermission(APIPermission::kAlwaysOnTopWindows))
+    if (options->always_on_top.get()) {
       create_params.always_on_top = *options->always_on_top.get();
 
+      if (create_params.always_on_top && !GetExtension()->HasAPIPermission(
+              APIPermission::kAlwaysOnTopWindows)) {
+        error_ = app_window_constants::kAlwaysOnTopPermission;
+        return false;
+      }
+    }
+
     if (options->focused.get())
       create_params.focused = *options->focused.get();