Suppose https://a.com frames https://b.com which loads a script from https://expired.badssl.com (for which a user has previously clicked through an SSL warning). MixedContentChecker::handleCertificateErrors() will notify the browser about a broken-https subresource load on the subresource's effective frame (in this case, https://b.com), so the browser will mark b.com as having run insecure content. If b.com were the top-level frame, this would mean that the page would get marked with a red slashy lock icon. However, since b.com is not the top-level frame, a.com goes unmarked and the lock icon doesn't change.

When a subresource loads over broken-https, we should mark all ancestors in the frame tree as having run insecure content, so that all the origins in the frame tree get marked with a red slashy lock icon.