Move container policy logic to frame owner classes.

third_party/WebKit/Source/core/html/HTMLFrameElementTest.cpp

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/html/HTMLFrameElement.h"
+
+#include "core/dom/Document.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+
+class HTMLFrameElementTest : public ::testing::Test {};
+
+// Test that the correct container policy is constructed on a frame element.
+// Frame elements do not have any container-policy related attributes, but the
+// fullscreen feature should be unconditionally disabled.
+TEST_F(HTMLFrameElementTest, DefaultContainerPolicy) {
+  Document* document = Document::Create();
+  KURL document_url = KURL(KURL(), "http://example.com");
+  document->SetURL(document_url);
+  document->UpdateSecurityOrigin(SecurityOrigin::Create(document_url));
+
+  HTMLFrameElement* frame_element = HTMLFrameElement::Create(*document);
+
+  frame_element->setAttribute(HTMLNames::srcAttr, "http://example.net/");
+  frame_element->UpdateContainerPolicyForTests();
+
+  const WebParsedFeaturePolicy& container_policy =
+      frame_element->ContainerPolicy();
+  EXPECT_EQ(1UL, container_policy.size());
+  // Fullscreen should be disabled in this frame
+  EXPECT_EQ(WebFeaturePolicyFeature::kFullscreen, container_policy[0].feature);

[foolip, 2017/06/13 14:59:30]

In addition to testing that the low-level fields were set correctly, is it
possible to test that the effective policy is to disallow, using the same style
of check as a call site in Fullscreen.cpp would?

[iclelland, 2017/06/13 18:36:47]

Without actually loading a document into the frame, we don't have the final
composed policy, so we can't check it here :(. Browsertests would be a better
place to do that, and we do have browsertests for the container policy, though
not for this exact situation. I'm writing a CL with some other browsertests
around container policy, so I'll make sure that the same-origin
disabled-by-container case is handled.

This also gets caught by LayoutTests/fullscreen/full-screen-frameset.html as
soon as I re-enable Feature Policy for Fullscreen.

The combination of container policy with the header policy of the embedded frame
is covered by unit tests in content/common/feature_policy, which is why the
tests here are just to ensure that the correct container policy is set in the
first place.

+  EXPECT_FALSE(container_policy[0].matches_all_origins);
+  EXPECT_EQ(0UL, container_policy[0].origins.size());
+}
+
+}  // namespace blink