This is a fix of issue http://b/issue?id=1381845....

test/cctest/test-api.cc

 // Copyright 2007-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3149 matching lines @@
 
   // Check that env1.prop still exists.
   Local<Value> v = env1->Global()->Get(v8_str("prop"));
   CHECK(v->IsNumber());
   CHECK_EQ(3, v->Int32Value());
 
   env2.Dispose();
 }
 
 
+THREADED_TEST(CrossDomainForIn) {
+  v8::HandleScope handle_scope;
+  LocalContext env1;
+  v8::Persistent<Context> env2 = Context::New();
+
+  Local<Value> foo = v8_str("foo");
+  Local<Value> bar = v8_str("bar");
+
+  // Set to the same domain.
+  env1->SetSecurityToken(foo);
+  env2->SetSecurityToken(foo);
+
+  env1->Global()->Set(v8_str("prop"), v8_num(3));
+  env2->Global()->Set(v8_str("env1"), env1->Global());
+
+  // Change env2 to a different domain and set env1's global object
+  // as the __proto__ of an object in env2 and enumerate properties
+  // in for-in. It shouldn't enumerate properties on env1's global
+  // object.
+  env2->SetSecurityToken(bar);
+  {
+    Context::Scope scope_env2(env2);
+    Local<Value> result =
+        Script::Compile(v8_str("(function(){var obj = {'__proto__':env1};\

[Mads Ager (chromium), 2008/09/24 06:09:21]

I find it easier to read if you do not use \ and instead use the fact that
adjacent string literals are concatenated.

"function() {"
"  var obj = {'__proto__':env1};"
"  for (var p in obj)"
...

Also, you could use the CompileRun helper function.  We really should clean up
test-api.  I see that we have both v8_compile and CompileRun helper functions -
we should only have one and use it consistently.  Feel free to put this back
without doing that though. 

[Feng Qian, 2008/09/24 15:30:27]

Done.

+                                for (var p in obj) \
+                                  if (p == 'prop') return false; \
+                                return true;})()"))->Run();
+    CHECK(result->IsTrue());
+  }
+  env2.Dispose();
+}
+
 
 static bool NamedAccessBlocker(Local<v8::Object> global,
                                Local<Value> name,
                                v8::AccessType type,
                                Local<Value> data) {
   return Context::GetCurrentSecurityContext()->Global()->Equals(global);
 }
 
 
 static bool IndexedAccessBlocker(Local<v8::Object> global,
@@ skipping 1718 matching lines @@
   v8::Handle<v8::Script> script0 =
       v8::Script::Compile(source0, v8::String::New("test.js"));
   v8::Handle<v8::Script> script1 =
       v8::Script::Compile(source1, v8::String::New("test.js"));
   v8::Handle<v8::Script> script2 =
       v8::Script::Compile(source0);  // different origin
   CHECK_EQ(1234, script0->Run()->Int32Value());
   CHECK_EQ(1234, script1->Run()->Int32Value());
   CHECK_EQ(1234, script2->Run()->Int32Value());
 }