Use WebFrame::setIsolatedWorldSecurityOrigin to allow cross-origin XHRs in content scripts.

chrome/renderer/extensions/user_script_slave.h

Index: chrome/renderer/extensions/user_script_slave.h
diff --git a/chrome/renderer/extensions/user_script_slave.h b/chrome/renderer/extensions/user_script_slave.h
index f5037ac675c231e441e4f87b7ce6807c8a13f24c..638395df6c1c37dfae1ab9b853eff2d8008eb5fb 100644
--- a/chrome/renderer/extensions/user_script_slave.h
+++ b/chrome/renderer/extensions/user_script_slave.h
@@ -17,6 +17,7 @@
 #include "chrome/common/extensions/user_script.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebScriptSource.h"
 
+class Extension;
 class ExtensionSet;
 
 namespace WebKit {
@@ -28,7 +29,7 @@ using WebKit::WebScriptSource;
 // Manages installed UserScripts for a render process.
 class UserScriptSlave {
  public:
-  UserScriptSlave(const ExtensionSet* extensions);
+  explicit UserScriptSlave(const ExtensionSet* extensions);
   ~UserScriptSlave();
 
   // Returns the unique set of extension IDs this UserScriptSlave knows about.
@@ -47,6 +48,10 @@ class UserScriptSlave {
   static void InsertInitExtensionCode(std::vector<WebScriptSource>* sources,
                                       const std::string& extension_id);
  private:
+  void InitializeIsolatedWorld(WebKit::WebFrame* frame,
+                               int isolated_world_id,
+                               const Extension* extension) const;
+
   // Shared memory containing raw script data.
   scoped_ptr<base::SharedMemory> shared_memory_;