From 53e1827796c74e99d6a49c6e4cd1024613454f35 Mon Sep 17 00:00:00 2001
From: Yoav Weiss <yoavweiss@chromium.org>
Date: Wed, 17 Dec 2025 12:48:35 -0800
Subject: [PATCH] [M138-LTS] Avoid downcasting Hash and Integrity reports

(cherry picked from commit a31cbeed5522815651f4b620ffb63f004f3e9dd0)

Bug: 455600228, 438514989, 457818670
Change-Id: I7ea47b5cbf9d43c8997a29f2e47e1394db7bac5c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7122839
Reviewed-by: Antonio Sartori <antoniosartori@chromium.org>
Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org>
Reviewed-by: Noam Rosenthal <nrosenthal@google.com>
Cr-Original-Commit-Position: refs/heads/main@{#1540562}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7139580
Reviewed-by: Andrew Williams <awillia@chromium.org>
Reviewed-by: Yoav Weiss (@Shopify) <yoavweiss@chromium.org>
Cr-Commit-Position: refs/branch-heads/7204@{#3465}
Cr-Branched-From: d5de512dc9dc8ddfe4e6d71b0637578bb6158683-refs/heads/main@{#1465706}
---

diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_party/blink/renderer/core/frame/reporting_context.cc
index 4a121f1..1ef0689 100644
--- a/third_party/blink/renderer/core/frame/reporting_context.cc
+++ b/third_party/blink/renderer/core/frame/reporting_context.cc
@@ -195,11 +195,28 @@
     return;
   }
 
+  KURL url = KURL(report->url());
+  // CSP Hash and IntegrityPolicy reports are not a LocationReportBody.
+  if (type == ReportType::kCSPHash) {
+    const CSPHashReportBody* body =
+        static_cast<CSPHashReportBody*>(report->body());
+    GetReportingService()->QueueCSPHashReport(
+        url, endpoint, body->subresourceURL(), body->hash(), body->type(),
+        body->destination());
+    return;
+  } else if (type == ReportType::kIntegrityViolation) {
+    const IntegrityViolationReportBody* body =
+        static_cast<IntegrityViolationReportBody*>(report->body());
+    GetReportingService()->QueueIntegrityViolationReport(
+        url, endpoint, body->documentURL(), body->blockedURL(),
+        body->destination(), body->reportOnly());
+    return;
+  }
+
   const LocationReportBody* location_body =
       static_cast<LocationReportBody*>(report->body());
   int line_number = location_body->lineNumber().value_or(0);
   int column_number = location_body->columnNumber().value_or(0);
-  KURL url = KURL(report->url());
 
   if (type == ReportType::kCSPViolation) {
     // Send the CSP violation report.
@@ -212,12 +229,6 @@
         body->originalPolicy() ? body->originalPolicy() : "",
         body->sourceFile(), body->sample(), body->disposition().AsString(),
         body->statusCode(), line_number, column_number);
-  } else if (type == ReportType::kCSPHash) {
-    const CSPHashReportBody* body =
-        static_cast<CSPHashReportBody*>(report->body());
-    GetReportingService()->QueueCSPHashReport(
-        url, endpoint, body->subresourceURL(), body->hash(), body->type(),
-        body->destination());
   } else if (type == ReportType::kDeprecation) {
     // Send the deprecation report.
     const DeprecationReportBody* body =
@@ -226,12 +237,6 @@
         url, body->id(), body->AnticipatedRemoval(),
         body->message().IsNull() ? g_empty_string : body->message(),
         body->sourceFile(), line_number, column_number);
-  } else if (type == ReportType::kIntegrityViolation) {
-    const IntegrityViolationReportBody* body =
-        static_cast<IntegrityViolationReportBody*>(report->body());
-    GetReportingService()->QueueIntegrityViolationReport(
-        url, endpoint, body->documentURL(), body->blockedURL(),
-        body->destination(), body->reportOnly());
   } else if (type == ReportType::kPermissionsPolicyViolation) {
     // Send the permissions policy violation report.
     const PermissionsPolicyViolationReportBody* body =