Malformed servers that don't pass a value in X-Frame-Options can trigger this assert. e.g. on <http://mweb.cbssports.com/ncaab/eye-on-college-basketball/24436548/night-court-marcus-foster-stars-xavier-and-iowa-get-key-wins> there's a load of <https://vine.co/v/MWmZ7L31emm/card> in an iframe. The headers for that URL are $ curl -I https://vine.co/v/MWmZ7L31emm/card HTTP/1.1 200 OK Cache-Control: max-age=1800 Content-Type: text/html; charset=utf-8 Date: Thu, 20 Feb 2014 05:36:30 GMT Strict-Transport-Security: max-age=631138519 X-Content-Type-Options: nosniff X-Frame-Options: X-XSS-Protection: 1; mode=block Connection: keep-alive The empty X-Frame-Options triggers the assert.
<rdar://problem/16026440>
Created attachment 224705 [details] Patch
Comment on attachment 224705 [details] Patch This breaks gcc build. I think that we need an ASSERT_NOT_REACHED() and return at the end. /mnt/eflews/webkit/WebKit/Source/WebCore/loader/FrameLoader.cpp: In member function 'bool WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions(const WTF::String&, const WebCore::URL&, long unsigned int)': /mnt/eflews/webkit/WebKit/Source/WebCore/loader/FrameLoader.cpp:3074:1: error: control reaches end of non-void function [-Werror=return-type] cc1plus: all warnings being treated as errors
(In reply to comment #3) > (From update of attachment 224705 [details]) > This breaks gcc build. I think that we need an ASSERT_NOT_REACHED() and return at the end. Ok. Will add that and land the patch. Thanks for the review.
Committed r164435: <http://trac.webkit.org/changeset/164435>