Don't create cross origins references in the extension system

extensions/renderer/v8_context_native_handler.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/v8_context_native_handler.h"
 
 #include "base/bind.h"
 #include "extensions/common/features/feature.h"
 #include "extensions/renderer/dispatcher.h"
 #include "extensions/renderer/script_context.h"
+#include "third_party/WebKit/public/web/WebLocalFrame.h"
 
 namespace extensions {
 
 V8ContextNativeHandler::V8ContextNativeHandler(ScriptContext* context,
                                                Dispatcher* dispatcher)
     : ObjectBackedNativeHandler(context),
       context_(context),
       dispatcher_(dispatcher) {
   RouteFunction("GetAvailability",
                 base::Bind(&V8ContextNativeHandler::GetAvailability,
@@ skipping 25 matching lines @@
 }
 
 void V8ContextNativeHandler::GetModuleSystem(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
   CHECK_EQ(args.Length(), 1);
   CHECK(args[0]->IsObject());
   v8::Local<v8::Context> v8_context =
       v8::Local<v8::Object>::Cast(args[0])->CreationContext();
   ScriptContext* context =
       dispatcher_->script_context_set().GetByV8Context(v8_context);
-  args.GetReturnValue().Set(context->module_system()->NewInstance());
+  if (blink::WebFrame::scriptCanAccess(context->web_frame()))

[not at google - send to devlin, 2015/07/13 17:27:08]

What is the context for "scriptCanAccess"? Does it read off
v8::Context::Current/Calling or something?

+    args.GetReturnValue().Set(context->module_system()->NewInstance());
 }
 
 void V8ContextNativeHandler::RunWithNativesEnabledModuleSystem(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
   CHECK_EQ(args.Length(), 1);
   CHECK(args[0]->IsFunction());
   v8::Local<v8::Value> call_with_args[] = {
     context()->module_system()->NewInstance()};
   ModuleSystem::NativesEnabledScope natives_enabled(context()->module_system());
   context()->CallFunction(v8::Local<v8::Function>::Cast(args[0]), 1,
                           call_with_args);
 }
 
 }  // namespace extensions