Code:  void ShellWindowFrameView::Init(views::Widget* frame) {
   frame_ = frame;
  ui::ResourceBundle& rb = ui::ResourceBundle::GetSharedInstance();
  close_button_ = new views::ImageButton(this);
  close_button_->SetImage(views::CustomButton::BS_NORMAL,
      rb.GetNativeImageNamed(IDR_CLOSE_BAR).ToImageSkia());
  close_button_->SetImage(views::CustomButton::BS_HOT,
      rb.GetNativeImageNamed(IDR_CLOSE_BAR_H).ToImageSkia());
  close_button_->SetImage(views::CustomButton::BS_PUSHED,
      rb.GetNativeImageNamed(IDR_CLOSE_BAR_P).ToImageSkia());
  close_button_->SetAccessibleName(
      l10n_util::GetStringUTF16(IDS_APP_ACCNAME_CLOSE));
  AddChildView(close_button_);
 
 #if defined(USE_ASH)
   aura::Window* window = frame->GetNativeWindow();
  int outside_bounds = ui::GetDisplayLayout() == ui::LAYOUT_TOUCH ?
      kResizeOutsideBoundsSizeTouch :
      kResizeOutsideBoundsSize;
  window->set_hit_test_bounds_override_outer(
      gfx::Insets(-outside_bounds, -outside_bounds,
                  -outside_bounds, -outside_bounds));
  window->set_hit_test_bounds_override_inner(
      gfx::Insets(kResizeInsideBoundsSize, kResizeInsideBoundsSize,
                  kResizeInsideBoundsSize, kResizeInsideBoundsSize));
#endif
 }

Vulnerability Type: XSS 
CWE ID: CWE-79
Summary: Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka *Universal XSS (UXSS).*
Commit Message: [views] Remove header bar on shell windows created with {frame: none}.

BUG=130182
R=ben@chromium.org


Review URL: https://chromiumcodereview.appspot.com/10597003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@143439 0039d316-1c4b-4281-b951-d872f2087c98