Harden WebNavigation API against invalid navigation callbacks

chrome/browser/extensions/api/web_navigation/web_navigation_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Implements the Chrome Extensions WebNavigation API.
 
 #include "chrome/browser/extensions/api/web_navigation/web_navigation_api.h"
 
 #include "base/lazy_instance.h"
 #include "chrome/browser/chrome_notification_types.h"
@@ skipping 355 matching lines @@
 
   if (!navigation_state_.CanSendEvents(frame_id))
     return;
 
   helpers::DispatchOnBeforeNavigate(
       web_contents(),
       render_view_host->GetProcess()->GetID(),
       frame_id.frame_num,
       is_main_frame,
       parent_frame_id.frame_num,
-      navigation_state_.IsMainFrame(parent_frame_id),
+      is_main_frame ? false : navigation_state_.IsMainFrame(parent_frame_id),
       navigation_state_.GetUrl(frame_id));
 }
 
 void WebNavigationTabObserver::DidCommitProvisionalLoadForFrame(
     content::RenderFrameHost* render_frame_host,
     const GURL& url,
     content::PageTransition transition_type) {
   content::RenderViewHost* render_view_host =
       render_frame_host->GetRenderViewHost();
   DVLOG(2) << "DidCommitProvisionalLoad("
@@ skipping 359 matching lines @@
   GURL frame_url = frame_navigation_state.GetUrl(internal_frame_id);
   if (!frame_navigation_state.IsValidUrl(frame_url))
     return true;
 
   GetFrame::Results::Details frame_details;
   frame_details.url = frame_url.spec();
   frame_details.error_occurred =
       frame_navigation_state.GetErrorOccurredInFrame(internal_frame_id);
   FrameNavigationState::FrameID parent_frame_id =
       frame_navigation_state.GetParentFrameID(internal_frame_id);
-  frame_details.parent_frame_id = helpers::GetFrameId(
-      frame_navigation_state.IsMainFrame(parent_frame_id),
-      parent_frame_id.frame_num);
+  if (parent_frame_id.frame_num == -1) {
+    frame_details.parent_frame_id = -1;
+  } else {
+    frame_details.parent_frame_id =
+        helpers::GetFrameId(frame_navigation_state.IsMainFrame(parent_frame_id),
+                            parent_frame_id.frame_num);
+  }
   results_ = GetFrame::Results::Create(frame_details);
   return true;
 }
 
 bool WebNavigationGetAllFramesFunction::RunSync() {
   scoped_ptr<GetAllFrames::Params> params(GetAllFrames::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params.get());
   int tab_id = params->details.tab_id;
 
   SetResult(base::Value::CreateNullValue());
@@ skipping 24 matching lines @@
     FrameNavigationState::FrameID parent_frame_id =
         navigation_state.GetParentFrameID(frame_id);
     GURL frame_url = navigation_state.GetUrl(frame_id);
     if (!navigation_state.IsValidUrl(frame_url))
       continue;
     linked_ptr<GetAllFrames::Results::DetailsType> frame(
         new GetAllFrames::Results::DetailsType());
     frame->url = frame_url.spec();
     frame->frame_id = helpers::GetFrameId(
         navigation_state.IsMainFrame(frame_id), frame_id.frame_num);
-    frame->parent_frame_id = helpers::GetFrameId(
-        navigation_state.IsMainFrame(parent_frame_id),
-        parent_frame_id.frame_num);
+    if (parent_frame_id.frame_num == -1) {
+      frame->parent_frame_id = -1;
+    } else {
+      frame->parent_frame_id =
+          helpers::GetFrameId(navigation_state.IsMainFrame(parent_frame_id),
+                              parent_frame_id.frame_num);
+    }
     frame->process_id = frame_id.render_view_host->GetProcess()->GetID();
     frame->error_occurred = navigation_state.GetErrorOccurredInFrame(frame_id);
     result_list.push_back(frame);
   }
   results_ = GetAllFrames::Results::Create(result_list);
   return true;
 }
 
 WebNavigationAPI::WebNavigationAPI(content::BrowserContext* context)
     : browser_context_(context) {
@@ skipping 32 matching lines @@
   return g_factory.Pointer();
 }
 
 void WebNavigationAPI::OnListenerAdded(const EventListenerInfo& details) {
   web_navigation_event_router_.reset(new WebNavigationEventRouter(
       Profile::FromBrowserContext(browser_context_)));
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
 }  // namespace extensions