Use WebFrame::setIsolatedWorldSecurityOrigin to allow cross-origin XHRs in content scripts.

chrome/renderer/extensions/user_script_slave.h

Index: chrome/renderer/extensions/user_script_slave.h
diff --git a/chrome/renderer/extensions/user_script_slave.h b/chrome/renderer/extensions/user_script_slave.h
index f5037ac675c231e441e4f87b7ce6807c8a13f24c..53bcb058ad2710419d7397b9de5bc61d4cb94cc2 100644
--- a/chrome/renderer/extensions/user_script_slave.h
+++ b/chrome/renderer/extensions/user_script_slave.h
@@ -6,6 +6,7 @@
 #define CHROME_RENDERER_EXTENSIONS_USER_SCRIPT_SLAVE_H_
 #pragma once
 
+#include <map>
 #include <set>
 #include <string>
 #include <vector>
@@ -17,6 +18,7 @@
 #include "chrome/common/extensions/user_script.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebScriptSource.h"
 
+class Extension;
 class ExtensionSet;
 
 namespace WebKit {
@@ -28,7 +30,7 @@ using WebKit::WebScriptSource;
 // Manages installed UserScripts for a render process.
 class UserScriptSlave {
  public:
-  UserScriptSlave(const ExtensionSet* extensions);
+  explicit UserScriptSlave(const ExtensionSet* extensions);
   ~UserScriptSlave();
 
   // Returns the unique set of extension IDs this UserScriptSlave knows about.
@@ -47,6 +49,10 @@ class UserScriptSlave {
   static void InsertInitExtensionCode(std::vector<WebScriptSource>* sources,
                                       const std::string& extension_id);
  private:
+  void InitializeIsolatedWorld(WebKit::WebFrame* frame,
+                               int isolated_world_id,
+                               const Extension* extension);
+
   // Shared memory containing raw script data.
   scoped_ptr<base::SharedMemory> shared_memory_;
 
@@ -60,6 +66,17 @@ class UserScriptSlave {
   // Extension metadata.
   const ExtensionSet* extensions_;
 
+  // Map from WebFrame identifier to its origin, used to allow the extension
+  // origin access to the frame (and to disallow once the frame's URL changes)
+  typedef std::map<long long, std::pair<std::string, std::string> >
+      FrameOriginMap;
+  FrameOriginMap frame_origins_;
+
+  // Map from extension ID to host permissions that have been whitelisted for
+  // it. Used to avoid whitelisting an origin more than once.
+  typedef std::multimap<std::string, URLPattern> ExtensionOriginMap;
+  ExtensionOriginMap extension_origins_;
+
   DISALLOW_COPY_AND_ASSIGN(UserScriptSlave);
 };