Don't create cross origins references in the extension system

Don't create cross origins references in the extension system

BUG=504011
R=kalman@chromium.org,haraken@chromium.org

Committed: https://crrev.com/3b1351e5ead02ced4a026fcc6c6a24215a428f56
Cr-Commit-Position: refs/heads/master@{#338573}

[jochen (gone - plz use gerrit), 2015-07-13 11:42:27]

depends on https://codereview.chromium.org/1235463006/

[haraken, 2015-07-13 12:24:55]

LGTM

[not at google - send to devlin, 2015-07-13 17:20:03]

Is this an alternative to https://codereview.chromium.org/1231803002/?

[jochen (gone - plz use gerrit), 2015-07-13 17:22:43]

right.

I see from the other CL that you propose a way to add an regression test.

what do you think about doing this in a separate CL since this one will have to
be merged back quite a bit?

[not at google - send to devlin, 2015-07-13 17:27:08]

https://codereview.chromium.org/1235863003/diff/1/extensions/renderer/v8_cont...
File extensions/renderer/v8_context_native_handler.cc (right):

https://codereview.chromium.org/1235863003/diff/1/extensions/renderer/v8_cont...
extensions/renderer/v8_context_native_handler.cc:57: if
(blink::WebFrame::scriptCanAccess(context->web_frame()))
What is the context for "scriptCanAccess"? Does it read off
v8::Context::Current/Calling or something?

[jochen (gone - plz use gerrit), 2015-07-13 17:39:52]

it's calling context (the call maps to
blink::BindingSecurity::shouldAllowAccessToFrame)

[not at google - send to devlin, 2015-07-13 18:29:01]

but either way, blink::scriptCanAccess only takes a single WebFrame. Where does
it get the other webframe from (that it's comparing to)?

[jochen (gone - plz use gerrit), 2015-07-13 18:42:37]

it compares the frame you pass to the calling context.

[jochen (gone - plz use gerrit), 2015-07-13 18:48:37]

On 2015/07/13 at 18:42:37, jochen wrote:
> it compares the frame you pass to the calling context.

i.e. isolate->GetCallingContext()

[not at google - send to devlin, 2015-07-13 19:13:00]

ok got it thanks. lgtm.

[jochen (gone - plz use gerrit), 2015-07-13 21:01:59]

The CQ bit was checked by jochen@chromium.org

[commit-bot: I haz the power, 2015-07-13 21:03:15]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1235863003/1

[commit-bot: I haz the power, 2015-07-13 22:09:39]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-07-13 22:10:39]

Patchset 1 (id:??) landed as
https://crrev.com/3b1351e5ead02ced4a026fcc6c6a24215a428f56
Cr-Commit-Position: refs/heads/master@{#338573}