Code: static bool ShouldAutofocus(const HTMLFormControlElement* element) {
  if (!element->isConnected())
    return false;
  if (!element->IsAutofocusable())
    return false;



   Document& doc = element->GetDocument();
 
 
  if (doc.IsSandboxed(WebSandboxFlags::kAutomaticFeatures)) {
    doc.AddConsoleMessage(ConsoleMessage::Create(
        mojom::ConsoleMessageSource::kSecurity,
        mojom::ConsoleMessageLevel::kError,
        "Blocked autofocusing on a form control because the form's frame is "
        "sandboxed and the 'allow-scripts' permission is not set."));
    return false;
  }

  if (!doc.IsInMainFrame() &&
      !doc.TopFrameOrigin()->CanAccess(doc.GetSecurityOrigin())) {
    doc.AddConsoleMessage(ConsoleMessage::Create(
        mojom::ConsoleMessageSource::kSecurity,
        mojom::ConsoleMessageLevel::kError,
        "Blocked autofocusing on a form control in a cross-origin subframe."));
    return false;
  }

  return true;
}

Vulnerability Type: 
CWE ID: CWE-704
Summary: Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file.
Commit Message: autofocus: Fix a crash with an autofocus element in a document without browsing context.

ShouldAutofocus() should check existence of the browsing context.
Otherwise, doc.TopFrameOrigin() returns null.

Before crrev.com/695830, ShouldAutofocus() was called only for
rendered elements. That is to say, the document always had
browsing context.

Bug: 1003228
Change-Id: I2a941c34e9707d44869a6d7585dc7fb9f06e3bf4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1800902
Commit-Queue: Kent Tamura <tkent@chromium.org>
Reviewed-by: Keishi Hattori <keishi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#696291}